joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406607
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x55bb3c]
push esi
xor esi, esi
cmp eax, esi
je 0x406633
push esi
push eax
call fcn.00402382
pop ecx
pop ecx
test eax, eax
jne 0x40665b
mov eax, dword [0x55bb3c]
cmp eax, esi
je 0x406633
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.0040182c
pop ecx
mov ecx, dword [ebp + 8]
push esi
push esi
push eax
push 0x40658b
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push esi
push esi
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x55bb3c], eax
pop esi
pop ebp
ret

Function at 0x406997
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 4], edi
cmp ebx, 0xffffffff
je 0x406a01
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x4069f9
lea eax, [esi + 0xa]
push eax
call fcn.0040182c
pop ecx
push edi
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4069f9
push dword [ebp - 4]
call fcn.0040199d
pop ecx
mov dword [ebp - 4], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x4086b7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x38]
push edi
add ecx, 0x1f40
push ecx
push 0
add eax, 4
push eax
push 0x531c84
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esi + 4], 0
mov dword [ebp - 0x3f4], eax
je 0x408754
mov eax, dword [esi + 0x38]
add eax, 4
push eax
lea eax, [ebp - 0x3f0]
push str.SELECT__FROM
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x3f0]
add esp, 0xc
push eax
lea edi, [ebp - 0x3fc]
call fcn.004054f3
pop ecx
test eax, eax
jne 0x408754
cmp dword [ebp - 0x3fc], eax
je 0x408748
push 2
push dword [ebp - 0x3f8]
call fcn.0043caf0
pop ecx
pop ecx
mov dword [ebp - 0x3f4], eax
push dword [ebp - 0x3f8]
call fcn.0043b5e0
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3f4]
xor ecx, ebp
pop edi
call fcn.004f7824
leave
ret
Function at 0x408830
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push 0x404621
mov esi, str.ADSL
push esi
call fcn.00402eaf
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x96
push 0x12c
push ebx
push ebx
push 0x10080000
push ebx
push esi
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
call fcn.00402f0d
push ebx
push ebx
mov edi, esi
call fcn.00402f67
pop ecx
pop ecx
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebx
push ebx
call fcn.0040324b
pop edi
pop esi
pop ebx
ret
push ebx
mov ebx, dword [0x55ab30]
mov eax, dword [ebx + 0x3c]
push esi
push edi
mov edi, 0x1f40
add eax, edi
push eax
push 0
push 0x531d64
mov esi, 0x531d70
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x408911
mov eax, dword [ebx + 0x3c]
add eax, edi
push eax
push 0x100
push 0x55a2e8
push 0x531990
push 0x530408
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x408911
mov eax, dword [ebx + 0x3c]
add eax, edi
push eax
push 0x100
push 0x55a6ee
push 0x531990
push 0x5303fc
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x408911
mov eax, dword [ebx + 0x3c]
add eax, edi
push eax
push 0x100
push 0x55a8f0
push 0x531990
push 0x5303f0
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x408911
mov ebx, dword [ebx + 0x3c]
add ebx, edi
push ebx
push 0
push 0x531d78
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x55a2d8], eax
mov dword [0x55a2e4], 0x830
mov dword [0x55ab14], 0x10
mov dword [0x55ab18], 2
pop edi
pop esi
pop ebx
jmp 0x4047a2
pop edi
pop esi
pop ebx
ret
Function at 0x408a11
Capabilities:
Create directory
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov ebx, edx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
push edi
lea eax, [ebp - 0x3f4]
push 0x531da0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x3f4]
push 0x8ee8
push eax
call fcn.0040166a
mov dword [esi + 0xc], eax
mov eax, dword [eax + 4]
mov dword [esi + 0x34], eax
add eax, 8
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x34]
add eax, 0x3f4
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x34]
add eax, 0x3aa8
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x34]
add eax, 0x5390
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x34]
add eax, 0x5990
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x34]
add eax, 0x5ddc
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x34]
add eax, 0x5e10
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x34]
add eax, 0x5ec0
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x34]
add eax, 0x5f90
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x34]
pop ecx
mov dword [eax], edi
pop ecx
mov edi, 0x1f4
test ebx, ebx
je 0x408b06
cmp word [ebx], 0
je 0x408b06
push edi
push ebx
push dword [esi + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
call ebx
call fcn.00408d5c
push edi
push dword [esi + 0x3c]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
mov eax, dword [esi + 0x3c]
add eax, 0x7d0
push eax
call ebx
jmp 0x408b0d
mov eax, esi
call fcn.00408da3
mov eax, dword [esi + 0x3c]
push 0x5333dc
lea ecx, [eax + 0x3e8]
push ecx
add eax, 0x1f40
push 0x531758
push eax
call fcn.00414f88
mov eax, dword [esi + 0x3c]
add esp, 0x10
lea ecx, [eax + 0xbb8]
add eax, 0x1f40
push eax
push edi
push ecx
push 0x531990
push 0x531c64
push 0x531c70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x408b77
mov eax, dword [esi + 0x3c]
lea ecx, [eax + 0x3e8]
push ecx
push 0x531c78
add eax, 0xbb8
push edi
push eax
call fcn.004f7833
add esp, 0x10
mov eax, dword [esi + 0x3c]
push 0
add eax, 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.00408c8f
mov edi, esi
call fcn.00408bf7
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f7824
leave
ret 4
Function at 0x408c8f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x3c]
push edi
add eax, 0x1f40
push eax
push 0x1f4
lea eax, [ebp - 0x3f0]
push eax
push str.Data
push str.penc
push 0x531c70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi + 0x3c]
lea ecx, [ebp - 0x3f0]
push ecx
lea ecx, [eax + 0xbb8]
push ecx
add eax, 0x2328
push 0x531758
push eax
call fcn.00414f88
mov eax, dword [esi + 0x3c]
lea ecx, [ebp - 0x3f4]
add eax, 0x2328
push ecx
push eax
call fcn.0048e600
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x3f4]
push 0x531dd8
xor edi, edi
mov ecx, eax
mov dword [esi + 4], eax
call fcn.004054f3
mov ecx, dword [esi + 4]
add esp, 0x1c
push str.CREATE_TABLE_Game__ID_INTEGER_PRIMARY_KEY_AUTOINCREMENT_
call fcn.004054f3
mov ecx, dword [esi + 4]
mov dword [esp], str.CREATE_TABLE_Main__ID_INTEGER_PRIMARY_KEY_AUTOINCREMENT_
call fcn.004054f3
mov ecx, dword [esi + 4]
mov dword [esp], str.CREATE_TABLE_Batch__
call fcn.004054f3
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004f7824
leave
ret
Function at 0x408e23
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x40], eax
cmp dword [0x55ab34], ebx
jne 0x408fb7
push 0x32
lea eax, [ebp - 0x37]
push ebx
push eax
mov byte [ebp - 0x38], bl
call fcn.004f8f00
mov eax, dword [0x55ab30]
mov esi, dword [eax + 0x40]
add esp, 0xc
push 0x16d0
add esi, 0x218
push ebx
push esi
call fcn.004f8f00
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esp, 0xc
lea eax, [esi + 0x15e8]
push eax
push 0x33
push 0xd
push 0x3eb
push dword [ebp - 0x3c]
call ebx
lea eax, [esi + 0x161b]
push eax
push 0x33
push 0xd
push 0x3ec
push dword [ebp - 0x3c]
call ebx
test edi, edi
je 0x408ecc
lea eax, [esi + 0x164e]
push eax
push 0x33
push 0xd
push edi
push dword [ebp - 0x3c]
call ebx
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x408ee7
lea ecx, [esi + 0x1681]
push ecx
push 0x27
push 0xd
push eax
push dword [ebp - 0x3c]
call ebx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x44], 0
je 0x408f00
lea eax, [ebp - 0x38]
push eax
push 0x33
push 0xd
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
call ebx
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x44]
neg eax
sbb eax, eax
lea ecx, [esi + 0x1681]
and eax, ecx
push eax
neg ebx
sbb ebx, ebx
lea eax, [ebp - 0x38]
and ebx, eax
neg edi
lea eax, [esi + 0x164e]
sbb edi, edi
and edi, eax
lea eax, [esi + 0x161b]
push edi
push eax
lea eax, [esi + 0x15e8]
call fcn.0040154d
xor edi, edi
add esp, 0xc
cmp eax, edi
jne 0x408fa6
mov ebx, dword [ebp + 8]
mov edx, dword [0x55ab38]
push ebx
call fcn.00408177
pop ecx
test eax, eax
je 0x408fb7
push edi
call fcn.00408de8
mov eax, dword [0x55ab38]
pop ecx
push 0x21
push dword [0x55ab2c]
mov dword [esi], eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
push edi
push esi
push 0x40825d
push edi
push edi
mov dword [esi + 0x1598], ebx
mov dword [esi + 0x159c], 0x40
mov dword [esi + 0x15a0], 0x138
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x55ab34], eax
jmp 0x408fb7
push 0x10
push 0x530110
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f7824
leave
ret
Function at 0x410365
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x44]
add eax, 0x14
cmp word [eax], 0
je 0x4103cc
push 0x1f4
push eax
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x3ec]
push 0x5c
push eax
call fcn.004f83b4
pop ecx
pop ecx
test eax, eax
je 0x4103cc
push 0x532a5c
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7824
leave
ret
Function at 0x4112ac
Capabilities:
Check if file exists
Clear file content
Copy file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x41130c
push ebx
call fcn.004f8821
push eax
push esi
lea eax, [ebp - 0x3ec]
push 0x532b7c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push ebx
lea eax, [ebp - 0x3ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41130c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41130c
xor eax, eax
jmp 0x411459
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x48]
push edi
push dword [eax + 8]
mov dword [ebp - 0x3f0], ebx
call fcn.00410be2
mov edi, eax
pop ecx
mov dword [ebp - 0x400], edi
cmp edi, ebx
je 0x411452
push ebx
push ebx
push 2
push ebx
push 7
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x3f8], eax
cmp eax, 0xffffffff
je 0x41143f
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea ecx, [ebp - 0x3fc]
push ecx
push 2
lea ecx, [ebp - 0x404]
push ecx
push eax
mov dword [ebp - 0x404], 0xfeff
call esi
mov dword [ebp - 0x3f0], ebx
cmp dword [edi], ebx
je 0x41141d
mov dword [ebp - 0x3f4], ebx
mov eax, dword [edi]
add eax, dword [ebp - 0x3f4]
cmp dword [eax], ebx
je 0x4113c0
push ebx
lea ecx, [ebp - 0x3fc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x3f4]
add eax, eax
push eax
mov eax, dword [edi]
push dword [eax + ecx]
push dword [ebp - 0x3f8]
call esi
push ebx
lea eax, [ebp - 0x3fc]
push eax
push 2
push 0x5319c0
push dword [ebp - 0x3f8]
call esi
add dword [ebp - 0x3f4], 4
cmp dword [ebp - 0x3f4], 0x4c
jl 0x41138e
push ebx
lea eax, [ebp - 0x3fc]
push eax
push 4
push 0x5319f8
push dword [ebp - 0x3f8]
call esi
inc dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0x3f0]
lea edi, [eax + ecx*4]
cmp dword [edi], ebx
jne 0x411388
mov edi, eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x3f0], 1
mov ebx, edi
call fcn.00401915
jmp 0x411452
mov eax, dword [ebp - 0x3f0]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004f7824
leave
ret

Function at 0x411b8b
Capabilities:
Create thread

Disassembly:
push 8
push 0x53c870
call fcn.00501e80
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], 0xa42a
jl 0x411c09
cmp dword [ebp + 0xc], 0xabfa
jg 0x411c09
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x44]
add eax, 0x3fc
push esi
push 0x1f4
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetMenuStringA]
push esi
push esi
push 0x10001
push 0x411acf
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x411c12
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.00501ec5
ret
Function at 0x41a3e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [0x54c250], 0
push esi
je 0x41a43d
mov eax, dword [0x55ba68]
test eax, eax
je 0x41a40d
push eax
call dword [0x54c2a4]
add esp, 4
lea ebx, [ebp - 4]
mov eax, 0x14
call fcn.00417da0
mov eax, dword [0x55ba68]
test eax, eax
je 0x41a42d
push eax
call dword [0x54c2ac]
add esp, 4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x41a44c
lea eax, [esi + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call dword [0x54c274]
add esp, 4
mov esi, eax
jmp 0x41a430
cmp dword [0x54c254], 0
je 0x41a47c
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x41a3b0
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
call fcn.004fcdfb
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x41a48c
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x41a4a5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c360
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x41c38d
push esi
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x5341d8]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x41c370
pop esi
ret
Function at 0x41c3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x41c40e
mov esi, 0x80
cmp esi, dword [edi]
jne 0x41c41a
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x55b908]
test eax, eax
je 0x41c425
call eax
lea ecx, [esi*8]
push 0
push ecx
call fcn.00417e80
mov esi, eax
mov eax, dword [0x55b90c]
add esp, 8
mov dword [ebp - 4], esi
test eax, eax
je 0x41c447
call eax
test esi, esi
je 0x41c412
mov edx, dword [edi + 0xc]
push edx
call fcn.00418180
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x54c280]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 8], ebx
mov dword [edi], ebx
call fcn.004f8f00
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x41c529
mov esi, dword [ecx + 0xc]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x41c4bd
movzx edx, dl
movzx edx, byte [edx + 0x5341d8]
lea ebx, [eax*8]
xor edx, ebx
inc esi
xor eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x41c49e
mov ebx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x41c505
mov esi, dword [eax]
test esi, esi
je 0x41c4db
mov edx, dword [eax + 4]
jmp 0x41c4dd
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x41c505
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x41c4fd
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x41c51e
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x41c51e
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x41c514
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x41c493
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x41c589
mov edx, dword [ebp + 8]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x41c57c
jmp 0x41c560
movzx ecx, cl
movzx ecx, byte [ecx + 0x5341d8]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x41c560
xor edx, edx
div dword [ebx]
mov esi, dword [edi + edx*8 + 4]
mov edi, dword [edi + edx*8]
jmp 0x41c591
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 4]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
test edi, edi
je 0x41c5bb
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0xc]
push ecx
push edx
dec edi
call fcn.0041af90
add esp, 8
test eax, eax
je 0x41c5c1
mov esi, dword [esi]
test edi, edi
jne 0x41c5a0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x43b290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov edi, dword [ebx]
mov eax, edi
call fcn.0042e060
mov esi, dword [edi + 0x10]
mov edi, dword [edi + 0x14]
mov eax, esi
add eax, 0xffffffff
adc edi, 0xffffffff
test edi, edi
ja 0x43b351
jb 0x43b2c4
cmp eax, 0x7ffffffe
ja 0x43b351
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebx]
mov word [ebp - 0x24], ax
mov dword [ebp - 0x14], eax
movsx eax, byte [ecx + 0x44]
mov eax, dword [ecx + eax*4 + 0x78]
mov edx, dword [ecx + 0x18]
mov eax, dword [eax + 0x3c]
movzx edi, word [ecx + 0x20]
sub eax, edx
cmp edi, eax
jae 0x43b2ef
mov eax, edi
cmp esi, eax
ja 0x43b304
mov ecx, 0x1010
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x24], cx
mov dword [ebp - 0x20], esi
jmp 0x43b317
push 1
push 0
lea eax, [ebp - 0x2c]
call fcn.00436450
add esp, 8
test eax, eax
jne 0x43b378
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push 0
push edx
push eax
push ecx
call fcn.0043a820
mov edx, dword [ebp + 0x10]
add esp, 0x10
test dword [ebp - 0x24], 0x2460
mov dword [edx], eax
jne 0x43b341
cmp dword [ebp - 0x14], 0
je 0x43b349
lea eax, [ebp - 0x2c]
call fcn.00435ab0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
push 0x55279c
push 0x1118f
push 0x552cc4
push 0xb
mov dword [eax], 0
call fcn.0041a1c0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x490470
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5115c3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5498f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x20], 0x55bac4
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], eax
lea edi, [ebx + 0x34]
mov dword [ebx], vtable.TiXmlDocument.0
mov dword [edi], 0x55bac4
mov byte [ebp - 4], 1
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x3c], ecx
push 0x531992
xor esi, esi
mov dword [ebx + 0x38], 4
mov byte [ebx + 0x44], al
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x30], eax
call fcn.00493510
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x490720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x490777
cmp byte [ebx + 0x2c], 0
jne 0x49076d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490750
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.00493510
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x490791
mov edi, edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x490780
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
push edi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.004fab99
push edi
call fcn.004faaaa
push 0
mov esi, eax
push 0
push edi
mov dword [ebp - 4], esi
call fcn.004fab99
add esp, 0x1c
test esi, esi
jg 0x4907ef
cmp byte [ebx + 0x2c], 0
jne 0x49076d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4907e3
jmp 0x490757
lea eax, [esi + 1]
push eax
call fcn.004f88c1
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edi, eax
push esi
push edi
mov byte [edi], 0
call fcn.004fa22f
add esp, 0x14
cmp eax, 1
je 0x49084c
push edi
call fcn.004f84d4
add esp, 4
cmp byte [ebx + 0x2c], 0
jne 0x49076d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
jmp 0x490840
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490840
jmp 0x490757
mov edx, dword [ebp - 4]
mov byte [edi + edx], 0
cmp byte [edi], 0
mov eax, edi
mov esi, edi
je 0x49087c
lea esp, [esp]
mov cl, byte [eax]
cmp cl, 0xd
jne 0x490873
mov byte [esi], 0xa
inc eax
inc esi
cmp byte [eax], 0xa
jne 0x490877
jmp 0x490876
mov byte [esi], cl
inc esi
inc eax
cmp byte [eax], 0
jne 0x490860
push 0
mov byte [esi], 0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0
push edi
mov ecx, ebx
call edx
push edi
call fcn.004f84d4
add esp, 4
xor eax, eax
cmp byte [ebx + 0x2c], al
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x498b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, edx
shr ecx, 5
mov eax, edx
xor eax, dword [ebp + 8]
inc ecx
cmp edx, ecx
jb 0x498b51
push ebx
push edi
movzx edi, byte [esi + edx - 1]
mov ebx, eax
shl ebx, 5
add edi, ebx
mov ebx, eax
shr ebx, 2
add edi, ebx
sub edx, ecx
xor eax, edi
cmp edx, ecx
jae 0x498b34
pop edi
pop ebx
pop ebp
ret