joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40633c
pop dword [ebp - 0x38]
mov eax, 0x40633c
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x136d8c26
add dword [ebp - 0x48], 0x3ae4b925
mov dword [ebp - 0x44], 0x9a71969e
sub dword [ebp - 0x44], 0x683e4a59
mov dword [ebp - 0x40], 0x21f98386
sub dword [ebp - 0x40], 0xd5ad3f58
mov dword [ebp - 0x3c], 0x9ecc04a8
sub dword [ebp - 0x3c], 0x9ecc04a8
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xf1c86184
add dword [ebp - 0x48], 0x82aa07d2
mov dword [ebp - 0x44], 0xe91cc4f2
add dword [ebp - 0x44], 0x584f9c83
mov dword [ebp - 0x40], 0x97fbfdd9
add dword [ebp - 0x40], 0xcb736e93
mov dword [ebp - 0x3c], 0x678fc3c2
add dword [ebp - 0x3c], 0x98703c3e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3807d
push 0
call eax
mov ecx, 0x63219e56
sub ecx, 0x632150b0
mov esi, eax
mov edx, 0x70ab1f0d
add edx, 0x8f95e0f3
add edx, dword [ebp - 0x38]
mov edi, 0x81b5cc30
add edi, 0x5aa39994
sub dword [ebp - 0x24], edx
mov ebx, dword [edx]
add dword [ebp - 0x18], 0xdec29b61
xor ebx, edi
xor dword [ebp - 0x14], eax
mov dword [esi], ebx
xor dword [ebp - 0x14], esi
add esi, 0x79d19a0b
sub esi, 0x79d19a07
add edx, 4
loop 0x40644f
add eax, 0x8e16c875
add eax, 0x71ea60f6
xor ebx, ebx
add ebx, eax
add eax, 0x937b70c4
add eax, 0x6c848f41
mov ecx, 0x32954b42
sub ecx, 0x32554b42
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x403774
Capabilities:
Query environment variable

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
mov eax, dword [esp + 0x18]
mov dword [0x4551cc], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00405000
push 0
push 0
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jle 0x40382a
mov ebx, dword [esp + 8]
add ebx, ebx
add ebx, 2
mov dword [esp + 8], ebx
push dword [esp + 8]
call fcn.00411110
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40382a
push dword [esp + 8]
push dword [esp + 8]
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x403809
push dword [0x4551cc]
push dword [0x4551cc]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00411060
lea eax, [esp + 4]
push eax
call fcn.00411c40
push dword [esp + 4]
call fcn.00411130
mov edx, dword [esp]
push dword [0x4551cc]
push edx
call fcn.00411be0
pop eax
add eax, dword [0x453724]
jmp 0x403854
mov edx, 0x453024
push dword [0x4551cc]
push edx
call fcn.00411be0
pop eax
add eax, dword [0x453724]
jmp 0x403854
push dword [esp]
call fcn.00411cc0
add esp, 0xc
pop ebx
ret 4
Function at 0x4056d8
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40572d
push dword [esp + 0x10]
push 0x405657
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x454fa8]
test esi, esi
je 0x405786
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x405725
cmp byte [esi + 0x10], 0
je 0x405725
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x405701
jmp 0x405786
mov esi, dword [0x454fa8]
test esi, esi
je 0x405786
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40577f
cmp byte [esi + 0x11], 0
je 0x40575b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x405772
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x454fa8
call fcn.00411aee
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40573a
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4058e9
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x4551d8]
call fcn.0041131b
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x4059e9
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x40593f
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x405937
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x40597f
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x4059c1
push 0x22
pop edx
cmp cx, dx
je 0x405971
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x405961
xor ecx, ecx
cmp word [eax], cx
je 0x4059c1
mov ecx, eax
add eax, 2
jmp 0x4059c3
test dx, dx
je 0x4059c9
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x405971
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x4059b7
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4059c1
cmp cx, dx
je 0x4059b4
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4059a4
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x405989
jmp 0x405971
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x4059cb
xor edx, edx
cmp dword [ebp], ebx
jne 0x4059d4
test edi, edi
jne 0x4059f1
test edx, edx
je 0x4059d9
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x40592d
test edi, edi
jne 0x405a02
mov eax, ebx
jmp 0x405a06
test esi, esi
je 0x405a02
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x405a06
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x408da5
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x455234]
call fcn.00411384
mov ebx, eax
test ebx, ebx
je 0x408e09
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x408dce
push dword [esp + 0xc]
push ebx
call eax
jmp 0x408e09
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00411df0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00411ec0
pop edi
pop esi
pop ebx
ret 8

Function at 0x40a11c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x40a196
push 9
call esi
test al, al
jns 0x40a196
push 0x11
call esi
test al, al
js 0x40a196
push 0x10
call esi
test al, al
js 0x40a196
push 0x12
call esi
test al, al
js 0x40a196
push 5
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [ebp - 0x10]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x40a196
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x40a196
xor eax, eax
jmp 0x40a217
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40a1be
push 0x11
call esi
test al, al
js 0x40a1b6
push 0x10
call esi
test al, al
js 0x40a1b6
push 0x12
call esi
test al, al
jns 0x40a1be
push 1
push edi
call fcn.0040a21f
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x40a1d4
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x40a214
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x40a214
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40a214
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x40a214
lea eax, [esi - 1]
push eax
push dword [0x455240]
call fcn.00411384
test eax, eax
je 0x40a214
mov eax, dword [eax + 8]
jmp 0x40a216
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a37e
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40a4c6
xor ecx, ecx
cmp word [eax], cx
je 0x40a4c6
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x40a3d7
cmp eax, 3
jne 0x40a411
cmp word [esp + 0xa], 0x3a
jne 0x40a411
cmp eax, 2
jne 0x40a3f5
lea eax, [esp + 8]
push 0x44a228
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40a4c6
push 0xfffffffffffffffe
pop edi
jmp 0x40a4c6
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40a426
cmp ax, bx
jne 0x40a430
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x40a419
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x40a46f
test byte [esp + 0x21c], 0x10
je 0x40a456
push 0xfffffffffffffffe
pop edi
jmp 0x40a466
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40a4c4
cmp word [esp + 0x10], bp
jne 0x40a47d
cmp word [esp + 0x12], bp
je 0x40a49c
cmp word [esp + 0x10], bx
jne 0x40a48b
cmp word [esp + 0x12], bx
je 0x40a49c
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40a4c4
cmp word [esp + 0x12], ax
jne 0x40a4c4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40a4b1
test al, 0x10
je 0x40a4c4
jmp 0x40a4c1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40a4c4
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x40bbb2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x2c]
mov ebp, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40bc36
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x454e24]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40bc2e
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bc1f
cmp dword [esp + 0x18], ebx
jne 0x40bc1f
push ebx
push edi
push dword [esp + 0x1c]
call fcn.0040bc50
mov ebp, eax
push edi
push 0
push dword [0x454e24]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x40cf08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4550f4], eax
test eax, eax
je 0x40cf36
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4550f0], eax
lea eax, [ebp - 0x114]
mov dword [0x4550f8], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40cf98
cmp dword [ebp - 0x104], 1
jne 0x40cf6d
and dword [0x4550f8], 0
jmp 0x40cfb0
cmp dword [ebp - 0x104], 2
jne 0x40cf98
cmp dword [ebp - 0x110], 5
jb 0x40cf64
jne 0x40cf98
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x4550f8]
mov dword [0x4550f8], eax
jmp 0x40cf9d
mov eax, dword [0x4550f8]
test eax, eax
je 0x40cfb0
call fcn.0040cd73
neg eax
sbb eax, eax
and dword [0x4550f8], eax
mov esp, ebp
pop ebp
ret

Function at 0x40e020
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40e052
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e04d
cmp dword [esp + 0xc], esi
je 0x40e069
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x426fb0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x426fdf
push esi
call fcn.00427190
add esp, 4
cmp byte [esi + 0x40], 0
je 0x426fd8
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x427062
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x42704d
mov eax, dword [esi + 8]
test eax, eax
je 0x427005
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x427048
cmp eax, 2
je 0x42704d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x426ff6
cmp eax, 3
je 0x42702d
cmp eax, 1
jne 0x426ff6
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x426ff6
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x426ff6
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00427090
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x427084
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.00427090
add esp, 4
pop edi
pop esi
ret
Function at 0x427090
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x4270bc
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x427142
lea ebx, [esi + 0x78]
jmp 0x4270d0
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x427116
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4270f5
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x427158
cmp eax, dword [esi + 0x60]
jb 0x4270d7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x4270d0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x4282d0
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.004344f0
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.004344c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x428317
push edi
call fcn.00434500
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.00427f60
mov dword [esi + 4], fcn.00427df0
mov dword [esi + 8], fcn.00427ec0
mov dword [esi + 0xc], fcn.00427d40
mov dword [esi + 0x10], 0x428630
mov dword [esi + 0x14], 0x4285c0
mov dword [esi + 0x18], 0x428420
mov dword [esi + 0x1c], 0x427bf0
mov dword [esi + 0x20], 0x427aa0
mov dword [esi + 0x24], 0x4281d0
mov dword [esi + 0x28], 0x4286a0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x4283fa
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x4283fa
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x4283e9
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x4283f1
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x42bbc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x42bbe5
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x42bbeb
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x42bd00
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x42bc3d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x42bc96
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x42bc80
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x42bc60
mov esi, dword [esp + 0x14]
test esi, esi
je 0x42bce1
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x42bcc0
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x42bcc0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x42bc20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4406a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov eax, dword [edi + 0x18]
cmp eax, 0xc
jle 0x4406bd
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
push ebp
push esi
cmp dword [edi + 0x2c], eax
jge 0x440781
lea esi, [edi + 0x44]
jmp 0x4406d0
mov dl, byte [esi]
test dl, dl
jne 0x440755
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4406eb
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x4406fc
push dword [ecx + 0x38]
push 1
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4407dc
mov al, byte [esi]
test al, al
je 0x4407ce
mov edx, dword [ebx + 0x48]
lea ebp, [esi + 1]
movzx eax, al
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x440729
push eax
push ebp
push ebx
call ecx
add esp, 0xc
jmp 0x440739
push dword [edx + 0x38]
push eax
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov cl, byte [esi]
mov edx, eax
movzx eax, cl
cmp edx, eax
jne 0x4407dc
mov al, byte [ebp]
dec cl
mov byte [ebp], 2
mov byte [esi], cl
jmp 0x440767
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
dec dl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
movzx eax, al
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
cmp eax, dword [edi + 0x18]
jl 0x4406d0
mov eax, dword [edi + 0x18]
movzx ecx, word [eax*2 + 0x44f688]
mov eax, dword [esp + 0x18]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x4407c4
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x4407c4
cmp ecx, 0xc
jge 0x4407c4
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
pop ebp
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
pop esi
pop ebp
pop edi
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop ebx
ret
Function at 0x440ab0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x440acf
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x440ae4
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x440b3b
mov cl, byte [esp + 0xc]
test cl, cl
je 0x440b47
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x440b18
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x440b30
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x440b5c
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x440b70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x440b8f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x440ba4
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x440bfb
mov cl, byte [esp + 0xc]
test cl, cl
je 0x440c07
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x440bd8
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x440bf0
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x440c11
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x440f60
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x440f78
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x440f8e
push 1
lea eax, [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x440fa3
push dword [eax + 0x38]
lea eax, [esp + 0xc]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x440fb3
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov al, byte [esp + 8]
cmp al, 0x21
je 0x440ff6
cmp al, 0x2c
je 0x440fe5
cmp al, 0x3b
mov eax, dword [esp + 0xc]
je 0x440fd8
mov dword [eax], 0
xor eax, eax
mov dword [esi + 0x40], 0x6b
pop esi
ret
mov dword [eax], 4
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 2
mov eax, 1
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 3
mov eax, 1
ret