joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fa38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [ebp + 0xc], 1
jne 0x1000faf9
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.1000e9b2
lea eax, [ebp - 0x114]
push eax
call fcn.1000fb76
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x75732074
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0x74726f
push eax
mov dword [ebp - 0xf], 0x6174736e
mov word [ebp - 6], 0x7070
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x6e
call fcn.1000ee7b
add esp, 0x18
test eax, eax
jne 0x1000fb2e
push sym.gphelper.dll__HookSetWindowPos_28
push 0x1005918c
call fcn.100103a0
pop ecx
pop ecx
test eax, eax
je 0x1000fb2e
push sym.gphelper.dll__HookSetForegroundWindow_4
push 0x10059118
call fcn.100103a0
pop ecx
pop ecx
test eax, eax
je 0x1000fb2e
push sym.gphelper.dll__HookSetActiveWindow_4
push 0x10059158
call fcn.100103a0
pop ecx
pop ecx
test eax, eax
je 0x1000fb2e
push sym.gphelper.dll__HookBringWindowToTop_4
push 0x10059150
call fcn.100103a0
pop ecx
jmp 0x1000fb2d
cmp dword [ebp + 0xc], 0
jne 0x1000fb2e
push 0x1005918c
call fcn.1001055b
mov dword [esp], 0x10059118
call fcn.1001055b
mov dword [esp], 0x10059158
call fcn.1001055b
mov dword [esp], 0x10059150
call fcn.1001055b
pop ecx
xor eax, eax
inc eax
leave
ret 0xc

Function at 0x100107e8
Capabilities:
Suspend thread

Disassembly:
sub esp, 0x2cc
push ebp
push esi
push edi
push dword [esp + 0x2dc]
push 0
push 0x1fffff
call fcn.1000ec94
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x1001089b
test esi, esi
je 0x1001089b
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10010892
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x10001
push eax
push esi
xor edi, edi
call fcn.1000ec41
pop ecx
pop ecx
test eax, eax
je 0x1001089b
mov ebp, dword [esp + 0x2e0]
cmp dword [esp + 0xc4], ebp
jb 0x1001089b
mov eax, dword [esp + 0x2e4]
add eax, ebp
cmp dword [esp + 0xc4], eax
jae 0x1001089b
push esi
call fcn.1000eb31
pop ecx
cmp edi, 3
jge 0x10010892
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [esp + 0xc]
inc edi
push eax
push esi
call fcn.1000ec41
pop ecx
pop ecx
test eax, eax
jne 0x10010848
jmp 0x1001089b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x2cc
ret

Function at 0x1001d107
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001d00c
Function at 0x106f7058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106f71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106f707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106f706a
add dl, dl
jne 0x106f7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106f70dc
xor eax, eax
add dl, dl
jne 0x106f7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106f717d
add dl, dl
jne 0x106f70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106f70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106f7075
mov eax, 1
add dl, dl
jne 0x106f70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106f70e1
sub eax, ebx
mov ebx, 1
jne 0x106f7128
mov ecx, 1
add dl, dl
jne 0x106f710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106f7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106f7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106f7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106f713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106f714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106f7136
cmp eax, 0x7d00
jae 0x106f716d
cmp eax, 0x500
jb 0x106f7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106f7075
cmp eax, 0x7f
ja 0x106f7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106f7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106f719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106f7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40225f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 4
mov eax, 0x56e365
call fcn.0053fc6d
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x40227c
xor al, al
jmp 0x402360
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [eax + 0x10], ebx
jne 0x402304
push 0x18
call fcn.0041286d
pop ecx
test eax, eax
je 0x40229d
mov ecx, eax
call fcn.00401add
mov esi, eax
jmp 0x40229f
mov esi, ebx
mov dword [ebp + 0xc], esi
test esi, esi
je 0x4022a9
inc dword [esi + 4]
push 0x10
mov dword [ebp - 4], ebx
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x4022c5
push edi
push dword [ebp + 8]
mov ecx, eax
call fcn.00401a3e
jmp 0x4022c7
mov eax, ebx
mov dword [esi + 0xc], eax
test eax, eax
je 0x4022f7
lea edx, [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.00403098
mov ecx, dword [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00403052
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4022f5
call fcn.004030e5
mov bl, 1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004030e5
jmp 0x40235e
cmp dword [eax + 0x14], 8
jb 0x40230c
mov eax, dword [eax]
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x402275
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x402275
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x10]
push eax
push esi
call fcn.004021d9
push dword [ebp + 0xc]
mov bl, al
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, bl
call fcn.0053fc3b
ret 0xc
Function at 0x40398c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5d0c2c], 2
push esi
mov esi, ecx
jne 0x403a09
push edi
call fcn.004056c1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x403a08
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
mov edx, edi
lea ecx, [ebp - 8]
call fcn.00406363
mov esi, dword [ebp - 8]
pop ecx
pop ecx
cmp esi, dword [edi + 4]
je 0x403a08
push dword [esi]
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push esi
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00405798
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jne 0x403a08
mov ecx, edi
call fcn.00405cf9
push edi
call fcn.005363a4
pop ecx
call fcn.004056c1
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403e09
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xc
mov eax, 0x56e49f
call fcn.0053fc6d
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 8]
mov ebx, eax
mov dword [ebp - 0x10], ebx
call fcn.004056eb
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x403e6c
push 8
call fcn.0041286d
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x403e58
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.004062bf
mov dword [esi], eax
jmp 0x403e5a
mov esi, eax
or dword [ebp - 4], 0xffffffff
call fcn.004056eb
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405aa2
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi]
je 0x403e86
xor al, al
jmp 0x403eb1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.00406632
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0040665e
push ebx
call dword [sym.imp.USER32.dll_SetCapture]
mov al, 1
call fcn.0053fc3b
ret
Function at 0x403eb7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5d0c34], 2
push edi
mov edi, ecx
je 0x403ed0
xor al, al
jmp 0x403f54
push esi
call fcn.004056eb
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x403f09
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [ebp - 4], eax
mov ecx, esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00405aa2
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
je 0x403f09
cmp dword [eax + 0x14], edi
je 0x403f0d
xor al, al
jmp 0x403f53
push eax
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0040585d
cmp dword [esi + 4], 0
jne 0x403f3c
mov ecx, esi
call fcn.00405824
push esi
call fcn.005363a4
pop ecx
call fcn.004056eb
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp byte [ebp + 8], 0
je 0x403f47
xor eax, eax
inc eax
jmp 0x403f53
call dword [sym.imp.USER32.dll_ReleaseCapture]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x403f75
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x5d0c34], 2
mov dword [ebp - 4], ecx
je 0x403f8a
xor eax, eax
jmp 0x403fbc
push esi
call fcn.004056eb
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x403fb4
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00405aa2
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
jne 0x403fb8
xor eax, eax
jmp 0x403fbb
mov eax, dword [eax + 0x14]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405be5
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 1
push 0x5d0c2c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x405c2d
push esi
push 4
call fcn.0041286d
mov esi, eax
pop ecx
test esi, esi
je 0x405c11
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
jmp 0x405c13
xor esi, esi
mov dword [0x5d0c30], esi
mov dword [0x5d0c2c], 2
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x5d0c2c], 2
jne 0x405c25
ret

Function at 0x405c37
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 1
push 0x5d0c34
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x405c7f
push esi
push 4
call fcn.0041286d
mov esi, eax
pop ecx
test esi, esi
je 0x405c63
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
jmp 0x405c65
xor esi, esi
mov dword [0x5d0c38], esi
mov dword [0x5d0c34], 2
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x5d0c34], 2
jne 0x405c77
ret
Function at 0x407056
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c8910]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x110
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00538910
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4070a6
cmp dword [ebp - 0x114], 6
jb 0x4070a6
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0053bd6c
mov esp, ebp
pop ebp
ret

Function at 0x4089e3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5c8910]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x5c
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call fcn.00538910
add esp, 0xc
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push esi
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x118
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.00538910
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x11c], 6
jne 0x408a59
cmp byte [ebp - 6], cl
jne 0x408a66
mov bl, cl
cmp dword [ebp - 0x11c], 6
movzx ebx, bl
cmova ebx, ecx
mov ecx, str.Tahoma
test bl, bl
mov eax, 0x594318
cmove eax, ecx
push eax
lea eax, [esi + 0x1c]
push 0x20
push eax
call fcn.005393dd
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.0053bd6c
mov esp, ebp
pop ebp
ret

Function at 0x40cbae
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0040cf4e
test al, al
jne 0x40cbc2
mov ecx, esi
pop esi
jmp fcn.0040398c
pop esi
ret
Function at 0x40cf4e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56eb3e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5c8910]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x5c8910]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x94]
xor ebx, ebx
inc ebx
cmp eax, 2
je 0x40d02d
cmp eax, ebx
je 0x40d02f
cmp eax, 4
je 0x40cfb6
cmp eax, 3
je 0x40cfb6
xor bl, bl
jmp 0x40d116
and dword [esp + 0x10], 0
and dword [esp + 0x50], 0
lea ecx, [esp + 0x10]
cmp eax, 3
jne 0x40cfd2
mov byte [esp + 0x14], bl
lea eax, [edi + 0x68]
jmp 0x40cfda
mov byte [esp + 0x14], 0
lea eax, [edi + 0x64]
push eax
call fcn.0040d2e1
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40d012
mov al, byte [esi + 0x2f]
test al, al
je 0x40d012
mov al, byte [esi + 0x2e]
test al, al
je 0x40d014
push dword [esp + 0x14]
mov ecx, edi
call fcn.0040ce6f
mov ecx, edi
call fcn.0040cf37
neg al
sbb al, al
inc al
mov bl, al
jmp 0x40d014
xor bl, bl
or dword [esp + 0x50], 0xffffffff
test esi, esi
je 0x40d112
mov ecx, esi
call fcn.00406598
jmp 0x40d112
cmp eax, ebx
sete byte [esp + 0x10]
cmp byte [edi + 0x2f], 0
je 0x40d110
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
and dword [esp + 0x1c], 0
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x18]
mov ecx, edi
push eax
mov eax, dword [edi]
call dword [eax + 8]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.00403b3f
push dword [esp + 0x1c]
lea esi, [edi + 0x98]
push dword [esp + 0x1c]
lea edi, [esp + 0x38]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x38]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40d11d
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x6c]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov esi, eax
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
cmp byte [edi + 0x84], 0
je 0x40d0d5
cmp byte [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
je 0x40d0cf
cmp eax, dword [esp + 0x24]
jmp 0x40d0e4
cmp eax, dword [esp + 0x2c]
jmp 0x40d0ed
cmp byte [esp + 0x10], 0
mov eax, dword [esp + 0x18]
je 0x40d0e9
cmp eax, dword [esp + 0x20]
setl al
jmp 0x40d0f0
cmp eax, dword [esp + 0x28]
setge al
test al, al
je 0x40d11d
push dword [esp + 0x10]
mov ecx, edi
call fcn.0040ce90
mov ecx, edi
call fcn.0040cf37
neg al
sbb al, al
inc al
mov bl, al
jmp 0x40d112
xor bl, bl
test bl, bl
jne 0x40d11d
and dword [edi + 0x94], 0
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0053bd6c
mov esp, ebp
pop ebp
ret
Function at 0x414f5d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
dec esi
jne 0x414f65
mov dword [edx*4 + 0x5e68e0], ecx
inc edx
cmp edx, 0x100
jb 0x414f60
mov esi, 0x800
jmp 0x414fac
mov ecx, dword [edx*4 + 0x5e64e0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x5e68e0]
mov dword [edx*4 + 0x5e68e0], ecx
inc edx
cmp edx, esi
jb 0x414f90
mov dword [0x5d22c0], 0x41ad6e
call fcn.0041af35
mov ecx, dword [0x5d22c0]
test eax, eax
mov edx, 0x41ae0b
cmove ecx, edx
mov dword [0x5d22c0], ecx
pop esi
ret

Function at 0x417e8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x100
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
or esi, edi
mov eax, esi
add ebx, ebx
shr eax, 7
mov ecx, edi
and eax, 1
and ecx, ebx
push eax
mov eax, esi
add ecx, edi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
lea edx, [edx + eax*2]
call fcn.00417dfa
mov edx, dword [ebp - 8]
add esi, esi
mov eax, esi
xor eax, ebx
not eax
and edi, eax
pop ecx
cmp esi, 0x10000
jb 0x417ea5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417f28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
or esi, 0x100
mov ecx, esi
mov eax, esi
shr ecx, 7
add esi, esi
shr eax, 8
and ecx, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx edx, word [ebx + eax*2]
mov eax, dword [ebp + 8]
shr edx, 4
xor edx, ecx
add edi, dword [eax + edx*4]
cmp esi, 0x10000
jb 0x417f3a
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x417f6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x100
mov dword [ebp - 4], ecx
xor edi, edi
or edx, esi
add ebx, ebx
mov ecx, esi
and ecx, ebx
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add edi, dword [eax + ecx*4]
mov ecx, edx
xor ecx, ebx
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x417f85
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41805b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
inc eax
mov ecx, edx
shl eax, cl
push edi
or esi, eax
xor edi, edi
cmp esi, 1
je 0x41809b
mov eax, dword [ebp + 0xc]
mov edx, esi
and esi, 1
shr edx, 1
neg esi
sar esi, 4
and esi, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, esi
mov esi, edx
add edi, dword [eax + ecx*4]
cmp esi, 1
jne 0x418079
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4180a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor esi, esi
inc edi
test ebx, ebx
je 0x4180e7
mov eax, dword [ebp + 8]
mov edx, eax
movzx ecx, word [ecx + edi*2]
and edx, 1
shr eax, 1
add edi, edi
mov dword [ebp + 8], eax
or edi, edx
mov eax, edx
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
dec ebx
jne 0x4180b7
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bca3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
push edi
sub eax, 3
je 0x41bd5e
sub eax, 3
je 0x41bd4d
dec eax
je 0x41bcfd
dec eax
dec eax
je 0x41bce8
dec eax
je 0x41bcd4
dec eax
je 0x41bcd4
dec eax
jne 0x41bd86
mov eax, dword [ebp + 0x14]
push 0x40
pop ecx
mov word [eax], cx
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
jmp 0x41bd86
mov eax, dword [ebp + 0x14]
push 0x13
pop ecx
mov word [eax], cx
mov dword [eax + 8], 0x80
jmp 0x41bd86
mov esi, dword [ebp + 0x14]
push 0x15
pop eax
push ebx
mov word [esi], ax
mov eax, dword [ebp + 8]
push 0x80
push 3
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
push 1
push SysReAllocString
push dword [ecx + eax*4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41bd46
lea eax, [esi + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41bd86
mov ebx, 0x80004005
jmp 0x41bd86
mov eax, dword [ebp + 0x14]
push 0xb
pop ecx
mov word [eax], cx
xor ecx, ecx
mov word [eax + 8], cx
jmp 0x41bd86
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 8
pop eax
mov word [edi], ax
mov edx, dword [esi + 0xc]
mov edx, dword [edx + ecx*4]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx - 0xc]
lea ecx, [edx + ecx*2]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi + 8], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x41d84c
Capabilities:
Delete file
Move file

Disassembly:
push 8
mov eax, 0x56f5c0
call fcn.0053fc6d
mov edi, ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
xor ebx, ebx
call fcn.0041cba3
mov dword [ebp - 4], ebx
mov ecx, edi
push dword [ebp + 8]
call fcn.0041d989
test eax, eax
jne 0x41d971
push ebx
push dword [ebp + 8]
call fcn.0053bf52
pop ecx
pop ecx
test eax, eax
jne 0x41d974
call fcn.0040adc8
push eax
lea ecx, [ebp - 0x10]
call fcn.0040a3ab
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str._s.tmp
push eax
call fcn.004210bd
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push dword [ebp + 8]
call fcn.0053c006
pop ecx
pop ecx
test eax, eax
je 0x41d8f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x59fbd4
lea edx, [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.0041bec7
pop ecx
mov byte [ebp - 4], 2
jmp 0x41d922
lea ecx, [esi - 0x10]
call fcn.0040b4b8
jmp 0x41d974
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp + 8]
mov ecx, edi
call fcn.0041d989
test eax, eax
jne 0x41d969
push 0x59fbd4
lea edx, [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.0041bec7
pop ecx
mov byte [ebp - 4], 3
push dword [eax]
mov ecx, edi
call fcn.0041d989
mov byte [ebp - 4], 1
mov edi, eax
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040b4b8
test edi, edi
je 0x41d8eb
push 0x59fbd4
lea edx, [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.0041bec7
pop ecx
push 5
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040b4b8
lea ecx, [esi - 0x10]
call fcn.0040b4b8
xor ebx, ebx
inc ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040b4b8
mov eax, ebx
call fcn.0053fc3b
ret 4