joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c5c0
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x414fb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push str.IBMShare
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
lea ecx, [esp + 4]
push eax
call sub.MFC42u.DLL_CString::CString_3
push 0x4207bc
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42u.DLL_CString::CString_3
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
lea ecx, [esp + 8]
test eax, eax
sete bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
pop ebx
je 0x40c63b
push str.C:IBMSHARE
lea ecx, [esp + 4]
call fcn.00413e78
push esi
lea edx, [esp + 4]
push str._sysinfo.ini
lea eax, [esp + 0xc]
push edx
push eax
call sub.MFC42u.DLL_operator_1
mov eax, dword [eax]
push eax
push 0
push str.logging
push str.system_summary
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
test esi, esi
pop esi
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp]
je 0x40c697
call sub.MFC42u.DLL_CString::CString
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 8]
xor al, al
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40c6b0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x414fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x41e088
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
lea ecx, [esp]
push eax
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp]
mov dword [esp + 0x10], 0
call sub.MFC42u.DLL_CString::MakeUpper
push str.MININT
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::Find_2
cmp eax, 0xffffffff
jne 0x40c752
push str.I386
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::Find_2
cmp eax, 0xffffffff
jne 0x40c752
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push str._InPE
call fcn.00413dc4
call fcn.0040c2c0
add esp, 4
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor al, al
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push str.InPE
call fcn.00413dc4
call fcn.0040c2c0
add esp, 4
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 8]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d9f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x415260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x34]
push 0x4207b8
mov dword [esp + 0x30], 0
mov edi, 3
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
mov ebp, dword [esp + 0x44]
mov ebx, 1
mov byte [esp + 0x2c], bl
mov esi, 0x64
push esi
push str.BaseBackup
lea eax, [esp + 0x18]
push str._s_03d
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0x3c]
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call sub.MFC42u.DLL_CString::CString_2
lea eax, [esp + 0x20]
mov byte [esp + 0x34], 2
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Level
call fcn.00413dc4
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 3
call sub.MFC42u.DLL_CString::CString_2
mov byte [esp + 0x40], bl
call fcn.0040d140
add esp, 0x14
lea eax, [esp + 0x3c]
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 4
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Location
call fcn.00413dc4
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x44], 5
call sub.MFC42u.DLL_CString::CString_2
mov byte [esp + 0x40], bl
call fcn.0040d140
mov eax, dword [esp + 0x28]
add esp, 0x14
inc esi
cmp eax, 0xffffffff
je 0x40db12
test ebp, eax
je 0x40db12
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x40db20
cmp esi, 0xc8
jbe 0x40da42
jmp 0x40db3a
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00413dfa
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
xor edi, edi
mov dword [edx], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x40dd30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4152d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x30]
xor ebx, ebx
push eax
push str.BaseBackup
mov dword [esp + 0x2c], ebx
xor esi, esi
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x40dd79
mov esi, 0x64
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push esi
push ecx
lea edx, [esp + 0x1c]
push str._s_d
push edx
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebp
call fcn.00413dc4
lea eax, [esp + 0x18]
mov byte [esp + 0x2c], 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push edi
call fcn.00413dc4
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x3c], 2
call sub.MFC42u.DLL_CString::CString_2
mov byte [esp + 0x38], bl
call fcn.0040d140
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
add esp, 0x14
cmp ecx, eax
je 0x40de3d
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push ebp
mov dword [esp + 0x18], eax
call fcn.00413dc4
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x28], 3
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edi
call fcn.00413dc4
push ecx
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x38], 4
call sub.MFC42u.DLL_CString::CString_2
mov byte [esp + 0x34], bl
call fcn.0040d4e0
add esp, 0x10
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
inc esi
cmp ecx, eax
jne 0x40dd81
cmp esi, 0x64
jb 0x40de5b
cmp esi, 0xc8
jbe 0x40dd81
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x40e830
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4153e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
push esi
push edi
push 0x4207b8
mov ecx, ebp
call sub.MFC42u.DLL_CString::operator_2
lea eax, [esp + 0x18]
push 0x41c5ec
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea ecx, [esp + 0x10]
push 0x4207b8
call fcn.00413dc4
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ebx, ebx
mov dword [esp + 0xe8], ebx
mov esi, 0x43
lea ecx, [esp + 0x18]
mov word [esp + 0x18], si
push ecx
call edi
cmp eax, 5
jne 0x40e8f6
push str.tvt.txt
lea edx, [esp + 0x18]
push esi
push edx
call fcn.0040e960
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xec], 1
call fcn.00413dfa
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], bl
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebx
je 0x40e8f6
push 0x5c
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::ReverseFind
cmp eax, 0xffffffff
jne 0x40e8ff
inc esi
cmp si, 0x5a
jbe 0x40e897
jmp 0x40e92e
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Left
push eax
mov ecx, ebp
mov byte [esp + 0xec], 2
call fcn.00413dfa
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0xe8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xdc
ret
Function at 0x40e960
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x8b4
push ebx
push ebp
push esi
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x46c]
mov ebp, dword [sym.imp.MSVCRT.dll_swprintf]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x8cc]
mov eax, dword [esp + 0x8d0]
and edi, 0xffff
push eax
push edi
lea ecx, [esp + 0x1c]
push str._c:_s
push ecx
mov dword [esp + 0x20], 0
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 0x10
lea edx, [esp + 0x21c]
lea eax, [esp + 0x14]
push edx
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40e9eb
lea ecx, [esp + 0x14]
lea edx, [esp + 0x46c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40eade
push edi
lea eax, [esp + 0x18]
push str._c:.
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x21c]
lea edx, [esp + 0x14]
push ecx
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
je 0x40eade
lea eax, [esp + 0x248]
push 0x41c170
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x40ea91
lea ecx, [esp + 0x248]
push 0x41c168
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x40ea91
test byte [esp + 0x21c], 0x10
je 0x40ea91
mov edx, dword [esp + 0x8d0]
lea eax, [esp + 0x248]
push edx
push eax
push edi
lea ecx, [esp + 0x20]
push str._c:_s_s
push ecx
call ebp
add esp, 0x14
lea edx, [esp + 0x674]
lea eax, [esp + 0x14]
push edx
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40eaa9
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x21c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40ead5
jmp 0x40ea19
lea edx, [esp + 0x14]
lea eax, [esp + 0x46c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 8
push esi
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov esi, dword [esp + 0x10]
jmp 0x40eadb
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call edi
mov esi, dword [esp + 0x8c8]
lea edx, [esp + 0x46c]
push edx
mov ecx, esi
call fcn.00413dc4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8b4
ret
Function at 0x4113f0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x415968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor eax, eax
push esi
push edi
mov ecx, dword [ebp]
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x41151e
cmp ecx, 0xffffffff
je 0x41151e
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push esi
push eax
push ebx
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4114cf
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x3e5
jne 0x411533
mov eax, dword [esp + 0x34]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp]
lea edx, [esp + 0x10]
push 0
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4114cf
call edi
cmp eax, 0x6d
je 0x4114cf
call edi
cmp eax, 0xe8
je 0x4114cf
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SendData
call fcn.00413dc4
push ecx
mov dword [esp + 0x24], 0
mov ecx, esp
mov dword [esp + 0x38], esp
push str.GetOverlappedResult
call fcn.00413dc4
push 0
mov dword [esp + 0x28], 0xffffffff
call fcn.00406a10
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp ebx, eax
je 0x41151e
test eax, eax
je 0x41151e
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.SendData
call fcn.00413dc4
push ecx
mov dword [esp + 0x24], 2
mov ecx, esp
mov dword [esp + 0x38], esp
push str.WriteFile
call fcn.00413dc4
push 0x2706
mov dword [esp + 0x28], 0xffffffff
call fcn.00406a10
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x14
call edi
cmp eax, 0x6d
je 0x41156d
call edi
cmp eax, 0xe8
je 0x41156d
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4207bc
call sub.MFC42u.DLL_CString::CString_3
push ecx
mov dword [esp + 0x24], 1
mov ecx, esp
mov dword [esp + 0x38], esp
push str.WriteFile
jmp 0x4114b8
xor eax, eax
jmp 0x41151e
Function at 0x411580
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x415990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov eax, dword [edi]
test eax, eax
je 0x41166f
cmp eax, 0xffffffff
je 0x41166f
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push esi
mov dword [eax], 0
mov edx, dword [edi]
push ecx
push 0x10000
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41166f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3e5
jne 0x411687
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi]
lea edx, [esp + 0xc]
push 0
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x41166f
call ebx
cmp eax, 0x6d
je 0x41166f
call ebx
cmp eax, 0xe8
je 0x41166f
call ebx
cmp eax, 0x3e4
je 0x41166f
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.GetData
call fcn.00413dc4
push ecx
mov dword [esp + 0x20], 0
mov ecx, esp
mov dword [esp + 0x28], esp
push str.GetOverlappedResult
call fcn.00413dc4
push 0
mov dword [esp + 0x24], 0xffffffff
call fcn.00406a10
add esp, 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
call ebx
cmp eax, 0x6d
je 0x4116be
call ebx
cmp eax, 0xe8
je 0x4116be
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4202c4
call sub.MFC42u.DLL_CString::CString_3
push ecx
mov dword [esp + 0x20], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.ReadFile
jmp 0x411658
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x10
Function at 0x411ad0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415a30
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
cmp dword [esi], 0xffffffff
jne 0x411c13
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x416388
push 1
push 0
push 0x416458
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x411bd1
push str.rootcimv2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x411bb9
lea edx, [esi + 4]
mov ecx, dword [eax]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x411b77
mov ecx, esi
call fcn.004119d0
push edi
mov dword [esi], 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x18
ret
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov dword [esp + 0x28], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.ConnectServer_failed_A
call fcn.00413dc4
mov dword [esp + 0x28], 0xffffffff
call fcn.00406ff0
add esp, 0xc
mov dword [esi], 2
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x18
ret
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov dword [esp + 0x28], 1
mov ecx, esp
mov dword [esp + 0x18], esp
push str.initCIM_failed_B
call fcn.00413dc4
mov dword [esp + 0x28], 0xffffffff
call fcn.00406ff0
add esp, 0xc
mov dword [esi], 1
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret
Function at 0x412b30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x248
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x412cdd
mov esi, dword [esp + 0x270]
xor ebx, ebx
cmp eax, 0x1000
mov dword [esp + 0x10], ebx
jb 0x412c2b
xor ebp, ebp
mov ecx, 0x400
xor eax, eax
mov edi, 0x4218dc
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x26c]
lea ecx, [esp + 0x28]
push eax
push 0x100
push 0
push ecx
call fcn.00413bb0
mov edx, esi
mov ebx, dword [esp + 0x270]
push 0x4218dc
push 0x1000
mov ecx, dword [edx]
push 0x4218dc
mov byte [esp + 0x30], 2
mov edi, dword [edx + 4]
mov eax, dword [edx + 8]
mov dword [esp + 0x39], eax
mov eax, ebp
mov edx, dword [edx + 0xc]
mov dword [esp + 0x3d], edx
cdq
add eax, ebx
mov ebx, dword [esp + 0x280]
adc edx, ebx
xor ecx, eax
mov dword [esp + 0x31], ecx
lea eax, [esp + 0x44]
lea ecx, [esp + 0x30]
xor edi, edx
push eax
push ecx
mov dword [esp + 0x3d], edi
call fcn.00413cb0
mov edx, dword [esp + 0x280]
add esp, 0x24
xor eax, eax
lea ecx, [edx + ebp]
mov dl, byte [eax + 0x4218dc]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc eax
cmp eax, 0x1000
jl 0x412bef
mov eax, dword [esp + 0x268]
mov ebx, dword [esp + 0x10]
add ebp, 0x1000
mov ecx, eax
sub ecx, ebp
inc ebx
cmp ecx, 0x1000
mov dword [esp + 0x10], ebx
jae 0x412b60
and eax, 0xfff
mov ebp, eax
je 0x412cdd
mov edx, dword [esp + 0x26c]
mov ecx, 0x400
xor eax, eax
mov edi, 0x4218dc
push edx
push 0x100
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00413bb0
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov esi, dword [esp + 0x270]
mov dword [esp + 0x31], eax
shl ebx, 0xc
mov eax, ebx
mov dword [esp + 0x2d], edx
cdq
add eax, esi
mov esi, dword [esp + 0x274]
adc edx, esi
xor ecx, eax
mov dword [esp + 0x25], ecx
push 0x4218dc
xor edi, edx
push 0x1000
lea ecx, [esp + 0x40]
push 0x4218dc
lea edx, [esp + 0x30]
push ecx
push edx
mov byte [esp + 0x38], 2
mov dword [esp + 0x3d], edi
call fcn.00413cb0
add esp, 0x24
xor eax, eax
test ebp, ebp
jle 0x412cdd
mov ecx, dword [esp + 0x25c]
add ecx, ebx
mov dl, byte [eax + 0x4218dc]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc eax
cmp eax, ebp
jl 0x412cca
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret
Function at 0x412cf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x248
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x412e9d
mov esi, dword [esp + 0x270]
xor ebx, ebx
cmp eax, 0x1000
mov dword [esp + 0x10], ebx
jb 0x412deb
xor ebp, ebp
mov ecx, 0x400
xor eax, eax
mov edi, 0x4208dc
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x26c]
lea ecx, [esp + 0x28]
push eax
push 0x100
push 0
push ecx
call fcn.00413bb0
mov edx, esi
mov ebx, dword [esp + 0x270]
push 0x4208dc
push 0x1000
mov ecx, dword [edx]
push 0x4208dc
mov byte [esp + 0x30], 2
mov edi, dword [edx + 4]
mov eax, dword [edx + 8]
mov dword [esp + 0x39], eax
mov eax, ebp
mov edx, dword [edx + 0xc]
mov dword [esp + 0x3d], edx
cdq
add eax, ebx
mov ebx, dword [esp + 0x280]
adc edx, ebx
xor ecx, eax
mov dword [esp + 0x31], ecx
lea eax, [esp + 0x44]
lea ecx, [esp + 0x30]
xor edi, edx
push eax
push ecx
mov dword [esp + 0x3d], edi
call fcn.00413cb0
mov edx, dword [esp + 0x280]
add esp, 0x24
xor eax, eax
lea ecx, [edx + ebp]
mov dl, byte [eax + 0x4208dc]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc eax
cmp eax, 0x1000
jl 0x412daf
mov eax, dword [esp + 0x268]
mov ebx, dword [esp + 0x10]
add ebp, 0x1000
mov ecx, eax
sub ecx, ebp
inc ebx
cmp ecx, 0x1000
mov dword [esp + 0x10], ebx
jae 0x412d20
and eax, 0xfff
mov ebp, eax
je 0x412e9d
mov edx, dword [esp + 0x26c]
mov ecx, 0x400
xor eax, eax
mov edi, 0x4208dc
push edx
push 0x100
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00413bb0
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov esi, dword [esp + 0x270]
mov dword [esp + 0x31], eax
shl ebx, 0xc
mov eax, ebx
mov dword [esp + 0x2d], edx
cdq
add eax, esi
mov esi, dword [esp + 0x274]
adc edx, esi
xor ecx, eax
mov dword [esp + 0x25], ecx
push 0x4208dc
xor edi, edx
push 0x1000
lea ecx, [esp + 0x40]
push 0x4208dc
lea edx, [esp + 0x30]
push ecx
push edx
mov byte [esp + 0x38], 2
mov dword [esp + 0x3d], edi
call fcn.00413cb0
add esp, 0x24
xor eax, eax
test ebp, ebp
jle 0x412e9d
mov ecx, dword [esp + 0x25c]
add ecx, ebx
mov dl, byte [eax + 0x4208dc]
mov bl, byte [ecx + eax]
xor bl, dl
mov byte [ecx + eax], bl
inc eax
cmp eax, ebp
jl 0x412e8a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret
Function at 0x40430a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004044ba
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x404408
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4043ab
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4043ee
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4043c2
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4043dd
test al, 0x40
je 0x4043d4
mov ecx, dword [edi + 0x20]
jmp 0x4043db
test al, 0x80
je 0x4043ee
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4043ee
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40437a
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret