joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x443350]
push ebx
push esi
push edi
mov dword [esp + 0x214], eax
mov esi, ecx
mov byte [esp + 0xc], 1
call fcn.004017b0
mov ecx, eax
call fcn.00401850
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
cmp ecx, eax
jne 0x417f0a
mov eax, dword [ebx + 4]
cmp eax, edx
jne 0x417f0a
mov al, byte [esi + 0x20]
test al, al
je 0x417f0a
mov byte [esp + 0xc], 0
mov eax, dword [esi + 0x2c]
xor edi, edi
cmp eax, edi
je 0x417fa4
mov ecx, dword [esi + 0x28]
cmp ecx, edi
je 0x418050
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
add eax, 1
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0xc]
push eax
adc edx, edi
mov dword [esi + 0x1c], edx
mov eax, dword [esi + 0x1c]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx]
push eax
call dword [edx + 0x2c]
mov edx, dword [ebx]
mov word [esp + 0x10], di
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 4]
push ecx
push edx
push str._I64d
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push 0x7f
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push ebx
lea ecx, [esi + 0xc]
call fcn.00417e60
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x28]
add eax, 1
mov dword [esi + 0x18], eax
lea eax, [esp + 0x10]
jmp 0x418038
mov ecx, dword [esi + 8]
cmp ecx, edi
je 0x418050
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
add eax, 1
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0xc]
push eax
adc edx, edi
mov dword [esi + 0x1c], edx
mov eax, dword [esi + 0x1c]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx]
push eax
call dword [edx + 0x20]
mov edx, dword [ebx]
mov word [esp + 0x110], di
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x112]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 4]
push ecx
push edx
push str._I64d
stosw word es:[edi], ax
lea eax, [esp + 0x11c]
push 0x7f
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push ebx
lea ecx, [esi + 0xc]
call fcn.00417e60
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 8]
add eax, 1
mov dword [esi + 0x18], eax
lea eax, [esp + 0x110]
mov ebx, dword [esi + 0x1c]
push eax
adc ebx, 0
push 1
mov eax, ebx
push eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], ebx
mov edx, dword [ecx]
push eax
call dword [edx + 0x34]
mov ecx, dword [esp + 0x214]
call fcn.00426448
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418110
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x381c
call fcn.00426470
mov eax, dword [0x443350]
push ebx
mov dword [esp + 0x381c], eax
push esi
push edi
mov ebx, ecx
xor eax, eax
mov word [esp + 0x18], 0
mov ecx, 0x3ff
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push 0x4360d8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [ebp + 8]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.00417ec0
push 0x2808
lea edx, [esp + 0x101c]
xor eax, eax
push edx
mov ecx, 0xa00
lea edi, [esp + 0x1024]
rep stosd dword es:[edi], eax
push 0x7ed
mov dword [esp + 0x1024], 7
mov dword [esp + 0x3828], 0x220
mov ecx, 0x88
lea edi, [esp + 0x1028]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004017b0
mov ecx, eax
call fcn.0040e760
mov ecx, dword [esp + 0x3824]
call fcn.00426448
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x418a10
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 8
mov esi, ecx
call fcn.00423bf9
add esp, 4
test eax, eax
je 0x418a58
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x418990
push 0
mov dword [eax + 4], edx
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x418a5f
xor eax, eax
pop esi
pop ecx
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret 8

Function at 0x418bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x418c09
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x418c1d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x418c3e
cmp esi, eax
jae 0x418c17
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x418c30
cmp esi, eax
jae 0x418c17
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x418d10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431efb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd80
mov eax, dword [0x443350]
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xd84], eax
mov dword [esp + 0xc], 0
call fcn.0040b580
mov cx, word [ebx + 0x30]
mov dx, word [ebx + 0x32]
mov eax, dword [ebx + 0xc]
mov word [esp + 0x24], cx
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebx + 0x94]
mov word [esp + 0x26], dx
mov dl, byte [ebx + 0x88]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x90]
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x30], dl
mov edx, dword [ebx + 0x98]
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], edx
lea esi, [ebx + 0x40]
mov ecx, 8
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x61]
mov ecx, 8
lea edi, [esp + 0x65]
rep movsd dword es:[edi], dword [esi]
push 0x200
lea eax, [ebx + 0x9c]
push eax
lea ecx, [esp + 0xf2]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCR71.dll_wcsncpy]
push ecx
call esi
push 0x40
lea edx, [ebx + 0x49e]
push edx
lea eax, [esp + 0x500]
push eax
call esi
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x520]
mov edx, dword [ebx + 0x524]
add esp, 0x18
test eax, eax
mov dword [esp + 0x570], ecx
mov dword [esp + 0x574], edx
je 0x418e3d
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x418e3d
call fcn.004189d0
mov dword [esp + 0x578], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [ebx + 0x528]
mov dword [esp + 0x580], edx
call fcn.0041e4e0
mov byte [esp + 0x580], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x581]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
push 0x800
lea ecx, [esp + 0x588]
push ecx
lea ecx, [esp + 0x1c]
stosb byte es:[edi], al
call fcn.0040f020
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0xd98], 0
call fcn.0040b5a0
lea ecx, [esp + 0x10]
call fcn.0040e5e0
push eax
lea eax, [esp + 0x584]
push eax
call fcn.0041d3f0
add esp, 8
test eax, eax
je 0x418ef9
mov ecx, eax
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x418eb0
mov ebx, dword [ebp + 0x10]
sub ecx, esi
mov edi, ecx
movzx ecx, word [ebx]
cmp edi, ecx
jge 0x418eef
cmp edi, 0x500
jg 0x418eef
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], 1
mov byte [edx], 0
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x418ee2
mov word [ebx], di
push eax
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0xd94], 0xffffffff
call fcn.00401010
mov ecx, dword [esp + 0xd8c]
mov eax, dword [esp + 0xc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xd84]
call fcn.00426448
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418ff0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x419035
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x419035
push esi
push edi
mov edi, dword [esp + 0x10]
xor dl, dl
jmp 0x419010
mov esi, dword [eax + 0xc]
movzx ecx, dl
shl ecx, 2
mov esi, dword [ecx + esi]
test esi, esi
je 0x41902c
mov esi, dword [esi]
inc dl
cmp dl, 0xa
mov dword [ecx + edi], esi
jb 0x419010
pop edi
movzx ax, dl
pop esi
ret 8
xor ax, ax
ret 8

Function at 0x4198b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
mov eax, dword [0x443350]
push esi
push edi
mov dword [esp + 0x40c], eax
mov edx, ecx
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0xff
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
add edx, 0x1848
push edx
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push str._sdataLoginError000.dat
push eax
call dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x14]
push 0x43622c
push ecx
call dword [sym.imp.MSVCR71.dll__wfopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x419952
push 2
push 0
push esi
call dword [sym.imp.MSVCR71.dll_fseek]
mov edx, dword [ebp + 8]
push esi
push 1
push 0x318
push edx
call dword [sym.imp.MSVCR71.dll_fwrite]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x20
mov eax, 1
mov ecx, dword [esp + 0x40c]
call fcn.00426448
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x40c]
xor eax, eax
call fcn.00426448
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41a690
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x431fab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x1c], eax
push edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x24], eax
push 6
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], eax
call fcn.00418700
add esp, 4
test al, al
je 0x41a6fa
push str.CLoginSessionImpl::ConnectFourBackupDomain___Begin_Connect_4_Backup_Domain__n
push 0x351
push str..LoginSessionImpl.cpp
push 6
call fcn.00418720
add esp, 0xc
push eax
call fcn.00418950
add esp, 8
lea esi, [edi + 0x530]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x1838], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
lea ebx, [ebx]
push 0x120
call fcn.00423bf9
mov ebx, eax
add esp, 4
mov dword [esp + 0x18], ebx
cmp ebx, ebp
mov dword [esp + 0x34], ebp
je 0x41a764
mov edi, ebx
mov ebp, 0xa
mov ecx, edi
call fcn.0040f530
add edi, 0x1c
dec ebp
jne 0x41a742
xor eax, eax
mov ecx, 0x48
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
mov eax, ebx
xor ebp, ebp
jmp 0x41a766
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push eax
push 0x41a580
push ebp
push ebp
mov dword [esp + 0x4c], 0xffffffff
mov word [eax + 0x11a], si
mov dword [eax + 0x11c], edi
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
mov dword [esp + esi*4 + 0x1c], eax
inc esi
cmp esi, 4
jl 0x41a720
push 0x1d4c0
push 1
lea edx, [esp + 0x24]
push edx
push 4
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ebx, ebx
lea esi, [edi + 0x1828]
cmp ebx, dword [edi + 0x1838]
je 0x41a7d6
mov ecx, dword [esi]
cmp ecx, ebp
je 0x41a7d6
mov eax, dword [ecx]
call dword [eax + 0x10]
push esi
call fcn.0042a860
add esp, 4
mov dword [esi], ebp
inc ebx
add esi, 4
cmp ebx, 4
jl 0x41a7b8
mov ecx, dword [edi + 0x28]
pop edi
xor eax, eax
pop esi
cmp ecx, 2
mov ecx, dword [esp + 0x24]
pop ebp
sete al
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x41b550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x724
mov eax, dword [0x443350]
push ebx
push esi
push edi
mov dword [esp + 0x72c], eax
mov edx, ecx
xor eax, eax
mov word [esp + 0x328], 0
mov ecx, 0xff
lea edi, [esp + 0x32a]
rep stosd dword es:[edi], eax
add edx, 0x1848
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x32c]
push str._sdataLoginError000.dat
push eax
call dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x334]
push 0x436758
push ecx
call dword [sym.imp.MSVCR71.dll__wfopen]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x41b660
push 0
push 0
push ebx
call dword [sym.imp.MSVCR71.dll_fseek]
push ebx
push 1
lea edx, [esp + 0x24]
xor eax, eax
push 0x318
mov ecx, 0xc6
lea edi, [esp + 0x28]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x1c
cmp eax, 1
jne 0x41b656
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x41b62e
cmp eax, 0x3e8
jge 0x41b62e
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
mov edx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push edx
push esi
call fcn.0041a300
mov ecx, dword [ebp + 8]
push 1
mov edi, eax
call fcn.0041a340
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
push ebx
xor eax, eax
mov ecx, 0xc6
lea edi, [esp + 0x14]
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push 0x318
push ecx
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x41b5f6
push ebx
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x72c]
mov eax, 1
call fcn.00426448
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d2c0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
lea edi, [ebp - 2]
xor ecx, ecx
test edi, edi
jle 0x41d353
push ebx
lea esp, [esp]
movzx edx, byte [esi + ecx]
mov ebx, dword [0x4431a8]
shr edx, 2
mov dl, byte [edx + ebx]
mov byte [eax], dl
movzx ebx, byte [esi + ecx + 1]
xor edx, edx
mov dl, byte [esi + ecx]
shr ebx, 4
inc eax
add ecx, 3
and edx, 3
shl edx, 4
or edx, ebx
mov ebx, dword [0x4431a8]
mov dl, byte [edx + ebx]
mov byte [eax], dl
movzx ebx, byte [esi + ecx - 1]
xor edx, edx
mov dl, byte [esi + ecx - 2]
shr ebx, 6
inc eax
and edx, 0xf
shl edx, 2
or edx, ebx
mov ebx, dword [0x4431a8]
mov dl, byte [edx + ebx]
mov byte [eax], dl
mov ebx, dword [0x4431a8]
xor edx, edx
mov dl, byte [esi + ecx - 1]
inc eax
and edx, 0x3f
mov dl, byte [edx + ebx]
mov byte [eax], dl
inc eax
cmp ecx, edi
jl 0x41d2e0
pop ebx
cmp ecx, ebp
jge 0x41d3d3
movzx edx, byte [ecx + esi]
mov edi, dword [0x4431a8]
shr edx, 2
mov dl, byte [edx + edi]
mov byte [eax], dl
inc eax
dec ebp
cmp ecx, ebp
jne 0x41d39b
movzx ecx, byte [ecx + esi]
mov edx, dword [0x4431a8]
and ecx, 3
shl ecx, 4
mov cl, byte [ecx + edx]
mov edx, dword [esp + 0x10]
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret
lea edx, [ecx + esi + 1]
movzx ecx, byte [ecx + esi]
movzx esi, byte [edx]
and ecx, 3
shl ecx, 4
shr esi, 4
or ecx, esi
mov esi, dword [0x4431a8]
mov cl, byte [ecx + esi]
mov byte [eax], cl
movzx edx, byte [edx]
mov ecx, dword [0x4431a8]
and edx, 0xf
mov dl, byte [ecx + edx*4]
inc eax
mov byte [eax], dl
inc eax
mov byte [eax], 0x3d
inc eax
mov edx, dword [esp + 0x10]
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret

Function at 0x41d860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x400
push esi
push edi
mov edx, ecx
xor eax, eax
mov dword [esp + 8], 0
mov ecx, 0xff
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov ecx, edx
call fcn.0041d7b0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
or eax, 0xffffffff
test edx, edx
je 0x41d8be
dec dword [ecx]
xor edx, edx
mov dl, byte [esi]
xor edx, eax
and edx, 0xff
mov edi, dword [esp + edx*4 + 8]
mov edx, dword [ecx]
shr eax, 8
xor eax, edi
inc esi
test edx, edx
jne 0x41d8a0
mov edx, dword [ecx]
dec edx
pop edi
mov dword [ecx], edx
not eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41d940
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x443350]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp], edx
mov edx, dword [ecx + 4]
mov dword [esp + 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push ebx
push esi
mov dword [esp + 0x14], ecx
lea ecx, [eax + 1]
push edi
mov dword [esp + 0x14], edx
mov eax, 0x436c35
mov esi, 4
lea esp, [esp]
movzx edi, byte [eax - 4]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax - 5]
mov dl, byte [esp + edx + 0xc]
xor dl, bl
movzx edi, byte [eax - 3]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax - 2]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax - 1]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 1]
xor dl, byte [esp + edi + 0xc]
movzx edi, byte [eax]
xor dl, byte [esp + edi + 0xc]
mov byte [ecx - 1], dl
movzx edi, byte [eax + 7]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax + 8]
mov dl, byte [esp + edx + 0xc]
movzx edi, byte [eax + 6]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 5]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 4]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 3]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 2]
xor dl, bl
xor dl, byte [esp + edi + 0xc]
mov byte [ecx], dl
movzx edi, byte [eax + 0xe]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax + 0xf]
mov dl, byte [esp + edx + 0xc]
movzx edi, byte [eax + 0xd]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0xc]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0xb]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0xa]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 9]
xor dl, bl
xor dl, byte [esp + edi + 0xc]
mov byte [ecx + 1], dl
movzx edi, byte [eax + 0x15]
mov bl, byte [esp + edi + 0xc]
movzx edx, byte [eax + 0x16]
mov dl, byte [esp + edx + 0xc]
movzx edi, byte [eax + 0x14]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x13]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x12]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x11]
xor dl, bl
mov bl, byte [esp + edi + 0xc]
movzx edi, byte [eax + 0x10]
xor dl, bl
xor dl, byte [esp + edi + 0xc]
mov byte [ecx + 2], dl
add ecx, 4
add eax, 0x1c
dec esi
jne 0x41d980
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
call fcn.00426448
add esp, 0x14
ret 4
Function at 0x41dab0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, edx
mov ebp, ebx
lea esi, [edx + 3]
sub edi, eax
sub ebp, eax
lea ecx, [ebx + 1]
sub edx, ebx
mov dword [esp + 0x10], 4
lea esp, [esp]
mov bl, byte [edi + eax]
xor bl, byte [eax]
add eax, 4
mov byte [eax + ebp - 4], bl
mov bl, byte [edx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
mov bl, byte [eax - 2]
xor bl, byte [esi - 1]
add esi, 4
mov byte [ecx - 3], bl
mov bl, byte [eax - 1]
xor bl, byte [esi - 4]
mov byte [ecx - 2], bl
dec dword [esp + 0x10]
jne 0x41dae0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41efb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43228b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc2c
mov eax, dword [0x443350]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
xor eax, eax
xor esi, esi
mov word [ebp - 0x414], si
mov ecx, 0xff
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esp
stosw word es:[edi], ax
mov eax, dword [ebp + 0xc]
push str.dataLgsInfocfg.dat
push eax
lea ecx, [ebp - 0x414]
push str._s_s
push ecx
call dword [sym.imp.MSVCR71.dll_swprintf]
lea edx, [ebp - 0x414]
push 0x436268
push edx
call dword [sym.imp.MSVCR71.dll__wfopen]
add esp, 0x18
cmp eax, esi
mov dword [ebp - 0xc1c], eax
je 0x41f19a
call fcn.00427560
cmp eax, esi
mov dword [ebp - 0xc18], eax
je 0x41f19a
mov edx, dword [eax]
push 0x10
push str.876B9304_359C_42E2
mov ecx, eax
call dword [edx + 4]
push 1
push 0x400
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0xc30]
mov dword [ebp + 0xc], 0x400
mov dword [ebp - 4], esi
call fcn.0040f020
mov byte [ebp - 4], 1
mov dword [ebp - 0xc20], 1
call fcn.004189d0
lea ecx, [ebp - 0xc20]
push ecx
lea ecx, [ebp - 0xc30]
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], edx
call fcn.0040f0a0
lea edx, [ebp - 0xc38]
push edx
lea ecx, [ebp - 0xc30]
call fcn.0040f150
mov ebx, dword [ebp + 8]
add ebx, 0x224
push ebx
lea ecx, [ebp - 0xc30]
call fcn.0040f100
xor edi, edi
cmp edi, dword [ebx]
jge 0x41f0f4
mov edx, dword [ebp + 8]
mov ecx, edi
imul ecx, ecx, 0x1c
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ecx + edx + 0x228]
call fcn.0040f560
inc edi
jmp 0x41f0d2
lea ecx, [ebp - 0xc30]
call fcn.0040e5e0
mov ecx, dword [ebp - 0xc18]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
lea edi, [ebp - 0x814]
push edi
push eax
lea eax, [ebp - 0xc14]
push eax
push 1
call dword [edx + 8]
test eax, eax
je 0x41f145
mov ecx, dword [ebp - 0xc1c]
movzx edx, word [ebp + 0xc]
push ecx
push 1
push edx
mov eax, edi
push eax
call dword [sym.imp.MSVCR71.dll_fwrite]
add esp, 0x10
mov esi, eax
dec esi
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0xc30]
mov byte [ebp - 4], 0
call fcn.00401010
jmp 0x41f166
mov ecx, dword [ebp - 0xc1c]
push ecx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCR71.dll_fclose]
mov eax, dword [ebp - 0xc18]
add esp, 4
test eax, eax
je 0x41f196
lea edx, [ebp - 0xc18]
push edx
call fcn.00426ed0
add esp, 4
mov eax, esi
jmp 0x41f19c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00426448
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8