joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473240
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x300
push ebx
push ebp
mov ebp, dword [esp + 0x310]
push edi
mov edi, ecx
mov ebx, eax
call fcn.00472950
cmp esi, ebp
jae 0x47325f
mov ebp, esi
push 0xff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call sub.msvcrt.dll_memset
push 0xff
lea ecx, [esp + 0x11d]
push 0
push ecx
mov byte [esp + 0x124], 0
call sub.msvcrt.dll_memset
push 0xff
lea edx, [esp + 0x229]
push 0
push edx
mov byte [esp + 0x230], 0
call sub.msvcrt.dll_memset
push ebp
lea eax, [esp + 0x34]
push ebx
push eax
call sub.msvcrt.dll_memcpy
push ebp
lea ecx, [esp + 0x140]
push ebx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0x3c
xor eax, eax
test esi, esi
jbe 0x4732f4
jmp 0x4732e0
xor byte [esp + eax + 0xc], 0x5c
xor byte [esp + eax + 0x10c], 0x36
add eax, 1
cmp eax, esi
jb 0x4732e0
mov eax, dword [esp + 0x31c]
mov ecx, dword [esp + 0x318]
mov ebx, dword [esp + 0x310]
lea edx, [esp + 0x20c]
push edx
push eax
push ecx
push esi
lea edx, [esp + 0x11c]
push edx
push ebx
mov eax, edi
call fcn.00472be0
cmp ebx, 0x8003
jne 0x473333
mov eax, 0x10
jmp 0x473363
cmp ebx, 0x8002
je 0x47332c
cmp ebx, 0x8004
je 0x47335e
cmp ebx, 0x8009
je 0x47335e
xor eax, eax
cmp ebx, 0x800e
setne al
sub eax, 1
and eax, 0x40
jmp 0x473363
mov eax, 0x14
mov ecx, dword [esp + 0x320]
push ecx
push eax
lea edx, [esp + 0x214]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
mov eax, edi
call fcn.00472be0
pop edi
pop ebp
pop ebx
add esp, 0x300
ret 0x14
Function at 0x473560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
push ebp
push esi
push edi
mov edi, eax
call fcn.00472950
push 0x3f
lea eax, [esp + 0x59]
push 0
push eax
mov dword [esp + 0x18], 0
mov byte [esp + 0x60], 0
call sub.msvcrt.dll_memset
push 0x3f
lea ecx, [esp + 0x25]
push 0
push ecx
mov byte [esp + 0x2c], 0
call sub.msvcrt.dll_memset
add esp, 0x18
cmp ebx, 0x8003
jne 0x4735b0
mov ebp, 0x10
jmp 0x4735e9
cmp ebx, 0x8002
jne 0x4735bf
mov ebp, 0x10
jmp 0x4735e9
cmp ebx, 0x8004
je 0x4735e4
cmp ebx, 0x8009
je 0x4735e4
xor edx, edx
cmp ebx, 0x800e
setne dl
sub edx, 1
and edx, 0x40
mov ebp, edx
jmp 0x4735e9
mov ebp, 0x14
cmp ebx, 0x800e
mov esi, 0x40
jne 0x4735fb
mov esi, 0x80
mov ecx, dword [esp + 0x9c]
lea eax, [esp + 0x54]
push eax
mov eax, dword [esp + 0x9c]
push 0x14
push ecx
push 0x14
push ebx
mov ecx, edi
call fcn.00473240
cmp dword [esp + 0xa0], 1
jne 0x473638
push ebp
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x1c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xa0]
add eax, 0xffffffff
je 0x4736a9
mov dword [esp + 0x10], eax
jmp 0x473650
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x5c]
push edx
push 0x14
push ebx
mov ecx, edi
call fcn.00473240
mov dword [esp + 0xc], eax
xor eax, eax
test ebp, ebp
jbe 0x47368f
jmp 0x473680
mov cl, byte [esp + eax + 0x54]
xor byte [esp + eax + 0x14], cl
add eax, 1
cmp eax, ebp
jb 0x473680
push ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x5c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
sub dword [esp + 0x10], 1
jne 0x473650
mov edx, dword [esp + 0xa4]
push ebp
lea ecx, [esp + 0x18]
push ecx
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x18]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x88
ret 0x10
Function at 0x475470
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi], 0
jne 0x47551c
push ebx
push edi
mov ebx, 0x47c978
call fcn.00468060
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.CryptAcquireContextW
push eax
mov dword [esi], eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.CryptReleaseContext
push eax
call edi
mov ecx, dword [esi]
push str.CryptCreateHash
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.CryptGetHashParam
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.CryptHashData
push eax
call edi
mov ecx, dword [esi]
push str.CryptDestroyHash
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.CryptDecrypt
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.CryptDeriveKey
push eax
call edi
mov ecx, dword [esi]
push str.CryptImportKey
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.CryptDestroyKey
push edx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi]
push str.CryptDuplicateKey
push eax
call edi
pop edi
mov dword [esi + 0x24], eax
pop ebx
ret

Function at 0x475900
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x300
cmp dword [ebx], 0
push ebp
push esi
mov ebp, 0x14
jne 0x47593d
mov esi, 0x48d184
call fcn.00475470
mov eax, dword [0x48d188]
test eax, eax
je 0x475937
push 0xf0000000
push 1
push 0
push 0
push ebx
call eax
test eax, eax
jne 0x47593d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp edi, ebp
jae 0x475943
mov ebp, edi
push 0xff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call sub.msvcrt.dll_memset
push 0xff
lea ecx, [esp + 0x119]
push 0
push ecx
mov byte [esp + 0x120], 0
call sub.msvcrt.dll_memset
push 0xff
lea edx, [esp + 0x225]
push 0
push edx
mov byte [esp + 0x22c], 0
call sub.msvcrt.dll_memset
mov esi, dword [esp + 0x330]
push ebp
lea eax, [esp + 0x30]
push esi
push eax
call sub.msvcrt.dll_memcpy
push ebp
lea ecx, [esp + 0x13c]
push esi
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0x3c
xor eax, eax
test edi, edi
pop esi
pop ebp
jbe 0x4759d3
mov edi, edi
xor byte [esp + eax], 0x5c
xor byte [esp + eax + 0x100], 0x36
add eax, 1
cmp eax, edi
jb 0x4759c0
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
lea edx, [esp + 0x200]
push edx
push eax
push ecx
push edi
lea edx, [esp + 0x110]
push edx
mov eax, ebx
call fcn.004757b0
mov eax, dword [esp + 0x310]
push eax
push 0x14
lea ecx, [esp + 0x208]
push ecx
push edi
lea edx, [esp + 0x10]
push edx
mov eax, ebx
call fcn.004757b0
add esp, 0x300
ret 0x10
Function at 0x4779d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
push edi
push 0x208
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push str.Web_Data
lea eax, [esp + 0xc]
mov ecx, esi
call fcn.00468830
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
add esp, 8
lea ecx, [esp + 4]
push ecx
call edi
cmp eax, 0xffffffff
je 0x477a27
lea edx, [esp + 4]
push edx
push ebx
call fcn.00477290
push 0x104
push str.Login_Data
lea eax, [esp + 0xc]
mov ecx, esi
call fcn.00468830
add esp, 8
lea eax, [esp + 4]
push eax
call edi
cmp eax, 0xffffffff
je 0x477a56
lea ecx, [esp + 4]
push ecx
push ebx
call fcn.00477290
pop edi
add esp, 0x210
ret
Function at 0x478d90
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, eax
xor ebp, ebp
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x478da0
sub eax, edx
add eax, 0xfffffffd
mov dword [esp + 0x18], eax
js 0x478f60
mov eax, 0xfffffffe
sub eax, esi
lea edi, [esi + 2]
mov dword [esp + 0x14], eax
mov cl, byte [edi - 2]
mov al, cl
sub al, 0x41
cmp al, 0x19
jbe 0x478e0c
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x478de2
sub cl, 0x47
mov byte [esp + 0x12], cl
jmp 0x478e10
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x478df5
add cl, 4
mov byte [esp + 0x12], cl
jmp 0x478e10
cmp cl, 0x2b
jne 0x478e01
mov byte [esp + 0x12], 0x3e
jmp 0x478e10
cmp cl, 0x2f
setne al
sub al, 1
and eax, 0x3f
mov byte [esp + 0x12], al
mov cl, byte [edi - 1]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x478e1f
mov bl, al
jmp 0x478e58
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x478e2e
sub cl, 0x47
mov bl, cl
jmp 0x478e58
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x478e43
add cl, 4
mov bl, cl
mov byte [esp + 0x13], cl
jmp 0x478e5c
cmp cl, 0x2b
jne 0x478e4c
mov bl, 0x3e
jmp 0x478e58
cmp cl, 0x2f
setne bl
sub bl, 1
and ebx, 0x3f
mov byte [esp + 0x13], bl
mov cl, byte [edi]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x478e6a
mov cl, al
jmp 0x478e9b
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x478e77
sub cl, 0x47
jmp 0x478e9b
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x478e86
add cl, 4
jmp 0x478e9b
cmp cl, 0x2b
jne 0x478e8f
mov cl, 0x3e
jmp 0x478e9b
cmp cl, 0x2f
setne cl
sub cl, 1
and ecx, 0x3f
mov dl, byte [edi + 1]
mov al, dl
sub al, 0x41
cmp al, 0x19
ja 0x478eaa
mov dl, al
jmp 0x478ed9
mov al, dl
sub al, 0x61
cmp al, 0x19
ja 0x478eb7
sub dl, 0x47
jmp 0x478ed9
mov al, dl
sub al, 0x30
cmp al, 9
ja 0x478ec4
add dl, 4
jmp 0x478ed9
cmp dl, 0x2b
jne 0x478ecd
mov dl, 0x3e
jmp 0x478ed9
cmp dl, 0x2f
setne dl
sub dl, 1
and edx, 0x3f
mov al, byte [esp + 0x12]
mov esi, dword [esp + 0x20]
add al, al
shr bl, 4
add al, al
or bl, al
mov byte [esi + ebp], bl
cmp byte [edi], 0x3d
je 0x478f40
mov al, byte [esp + 0x13]
mov bl, cl
shr bl, 2
shl al, 4
or bl, al
mov byte [esi + ebp + 1], bl
cmp byte [edi + 1], 0x3d
je 0x478f50
shl cl, 6
or cl, dl
mov byte [esi + ebp + 2], cl
add ebp, 3
lea ecx, [ebp + 5]
add edi, 4
cmp ecx, dword [esp + 0x24]
jge 0x478f64
mov edx, dword [esp + 0x14]
add edx, edi
cmp edx, dword [esp + 0x18]
jle 0x478dc6
pop edi
mov byte [esi + ebp], 0
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov byte [esi + ebp + 1], 0
pop esi
lea eax, [ebp + 1]
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov byte [esi + ebp + 2], 0
pop esi
lea eax, [ebp + 2]
pop ebp
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
pop edi
mov byte [esi + ebp], 0
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x478fa0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
xor esi, esi
mov word [edi], si
mov al, byte [ebx]
test al, al
je 0x478fe2
lea ecx, [ecx]
xor al, 0x42
movzx ax, al
mov ecx, 0xf2
sub ecx, esi
xor ax, cx
movzx edx, ax
push 1
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], edx
call sub.msvcrt.dll_wcsncat
mov al, byte [esi + ebx + 1]
add esi, 1
add esp, 0xc
test al, al
jne 0x478fb0
pop esi
pop ecx
ret
Function at 0x47a700
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47a790
push esi
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 5]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
mov edi, eax
push edi
push ebp
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov byte [edi + esi], 0
mov byte [edi + esi + 1], 0
mov byte [edi + esi + 2], 0
push 0xffffffffffffffff
push edi
lea esi, [ebx + 0x20]
mov dword [ebx + 0x34], 0
call fcn.00466a10
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
je 0x47a786
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x401760
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
lea eax, [ebp - 0xc]
sub esp, 0x30
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.ThreadFunc
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
call dbg.install
mov ebx, eax
mov eax, dword [0x404224]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], eax
call sym._SendMessageA_16
sub esp, 0x10
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0x10

Function at 0x401850
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___argv
mov esi, dword [eax]
call sym.__get_initial_narrow_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x401910
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40198e
cmp al, 9
je 0x401980
cmp al, 0x20
je 0x401980
xor edi, edi
xor esi, esi
cmp al, 0x5c
je 0x4019f5
cmp al, 0x22
je 0x4019e4
xor esi, esi
add ebx, 1
movzx eax, byte [ebx]
test al, al
je 0x40198e
cmp al, 9
sete cl
cmp al, 0x20
sete dl
or cl, dl
je 0x401944
test edi, 1
jne 0x401944
lea esi, [esi]
lea edi, [edi]
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401980
cmp al, 0x20
je 0x401980
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x4019a9
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
and esi, 1
jne 0x401954
xor edi, 1
jmp 0x401956
add esi, 1
jmp 0x401956
Function at 0x41eaf6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
and edx, 0xfffffffe
mov esi, edi
lea ebx, [edi - 4]
add ebx, edx
cmp esi, ebx
ja 0x41eb68
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 3]
xor edx, 8
and eax, edx
add esi, 2
cmp eax, 0xf8
jb 0x41eb05
movzx ecx, byte [esi - 2]
movzx eax, byte [esi + 1]
and eax, 7
shl edx, 8
add ecx, edx
lea ecx, [eax + ecx*8]
movzx eax, byte [esi]
add esi, 2
shl ecx, 8
add ecx, eax
mov eax, esi
sub eax, edi
shr eax, 1
sub ecx, eax
mov eax, ecx
mov byte [esi - 2], cl
shr eax, 0xb
mov byte [esi - 4], al
mov eax, ecx
shr eax, 0x13
and al, 7
shr ecx, 8
or al, 0xf0
or cl, 0xf8
mov byte [esi - 3], al
mov byte [esi - 1], cl
jmp 0x41eb05
sub esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x41ec19
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 4], eax
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x41ec3b
xor eax, eax
jmp UuidCreateSequential
add edx, 0xfffffffc
add edx, eax
mov dword [ebp - 8], edx
push edi
lea edi, [ebx + eax]
cmp edi, edx
jae 0x41ec5b
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41ec58
inc edi
cmp edi, edx
jb 0x41ec4b
mov eax, dword [ebp - 4]
mov ecx, edi
sub ecx, ebx
mov ebx, edi
sub ecx, eax
sub ebx, eax
cmp edi, edx
jae 0x41ed27
cmp ecx, 2
jbe 0x41ece6
xor esi, esi
movzx edx, byte [edi + 4]
lea eax, [edx + 1]
test al, 0xfe
jne 0x41ed16
movzx eax, byte [edi + 3]
add ebx, 5
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
sub edx, ebx
test esi, esi
je 0x41ecc6
and esi, 6
mov eax, edx
shl esi, 2
mov ecx, esi
shr eax, cl
inc eax
test al, 0xfe
jne 0x41ecc4
mov eax, pe_nt_image_headers32
shl eax, cl
dec eax
xor edx, eax
sub edx, ebx
xor esi, esi
mov eax, edx
mov byte [edi + 1], dl
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
and dl, 1
neg dl
mov byte [edi + 3], al
mov byte [edi + 4], dl
jmp 0x41ed1c
shr esi, cl
test esi, esi
je 0x41ec74
cmp esi, 4
ja 0x41ed0b
cmp esi, 3
je 0x41ed0b
mov eax, esi
shr eax, 1
movzx eax, byte [eax + edi + 1]
inc eax
test al, 0xfe
jne 0x41ec74
mov eax, dword [ebp - 4]
or esi, 8
shr esi, 1
inc ebx
jmp 0x41ec44
or esi, 8
shr esi, 1
inc ebx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
jmp 0x41ec44
push 2
shr esi, cl
pop eax
cmp eax, ecx
mov eax, dword [ebp + 0xc]
pop edi
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x113f7bb8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x113f7bc2
pushal
call 0x113f7bc8
pop ebp
sub ebp, 0x10
sub ebp, 0x13f7bb8
mov al, byte [esp + 0x28]
cmp al, 1
je 0x113f7bec
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x113f7bf5
mov eax, 0x13f7bb8
add eax, ebp
add eax, 0x63
mov ecx, 0x5a6
mov edx, 0xc3039245
xor byte [eax], dl
inc eax
dec ecx
jne 0x113f7c0c
jmp 0x113f7c1f
into
mov dh, cl
int3
Function at 0x41a530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c39c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x474390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi + 0x28], 0x4699e0
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.0044070f
mov dword [edi], vtable.boost::bad_lexical_cast.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ebx, [esi + 0x14]
mov dword [ebp - 4], 1
lea esi, [edi + 0x14]
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x41a5bd
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.2.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.0
push ebx
mov eax, dword [eax + 4]
push esi
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.1.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
call fcn.00412da0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42af90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45dfd0
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
mov eax, dword [0x474390]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x469d20
mov dword [esp + 0x24], 0x469d5c
mov dword [esp + 0x7c], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0xd4], 0
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 1
call fcn.0041f400
mov dword [esp + 0xd0], 1
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x14], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x10], eax
lea ecx, [esp + 0x2c]
call fcn.00418510
mov dword [esp + 0x2c], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
push dword [ebp + 8]
lea eax, [esp + 0x28]
mov dword [esp + 0xd4], 3
push eax
call fcn.00422050
add esp, 8
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x42b0a8
push dword [ebp + 0xc]
lea ecx, [esp + 0x18]
call fcn.0042b510
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x42b0a8
lea eax, [esp + 0x14]
push eax
call fcn.0041a710
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 1
je 0x42b0a8
mov bl, 1
jmp 0x42b0aa
xor bl, bl
lea ecx, [esp + 0x7c]
mov dword [esp + 0xd0], 0xffffffff
call fcn.0041f1e0
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], vtable.std::ios_base.0
push eax
call fcn.0043ac4e
add esp, 4
mov al, bl
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42b0f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45dfd0
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
mov eax, dword [0x474390]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x469d20
mov dword [esp + 0x24], 0x469d5c
mov dword [esp + 0x7c], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0xd4], 0
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 1
call fcn.0041f400
mov dword [esp + 0xd0], 1
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x14], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x10], eax
lea ecx, [esp + 0x2c]
call fcn.00418510
mov dword [esp + 0x2c], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0xd0], 3
push dword [eax]
call fcn.00429df0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x42b20a
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
push eax
call fcn.00422a20
add esp, 8
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x42b20a
lea eax, [esp + 0x14]
push eax
call fcn.0041a710
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 1
je 0x42b20a
mov bl, 1
jmp 0x42b20c
xor bl, bl
lea ecx, [esp + 0x7c]
mov dword [esp + 0xd0], 0xffffffff
call fcn.0041f1e0
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], vtable.std::ios_base.0
push eax
call fcn.0043ac4e
add esp, 4
mov al, bl
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8