joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10348bf
Capabilities:
Get token privileges

Disassembly:
push 0x14
mov eax, 0x1042040
call fcn.0103d87a
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push 0x28
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, ebx
je 0x10349a0
lea eax, [ebp - 0x10]
push eax
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
call fcn.010347dd
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
jne 0x1034923
push ebx
push ebx
push ebx
push ebx
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, ebx
jne 0x1034991
mov ebx, 0x80041003
jmp 0x1034991
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 3
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x14]
call fcn.0103d496
mov esi, eax
pop ecx
cmp esi, ebx
je 0x103498c
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 3
push dword [ebp - 0x10]
call edi
cmp eax, ebx
je 0x103497e
xor ecx, ecx
cmp dword [esi], ebx
jbe 0x103496c
lea eax, [esi + 0xc]
or dword [eax], 2
inc ecx
add eax, 0xc
cmp ecx, dword [esi]
jb 0x1034961
push ebx
push ebx
push ebx
push esi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, ebx
jne 0x1034983
mov ebx, 0x80041003
push esi
call fcn.0103d416
pop ecx
jmp 0x1034991
mov ebx, 0x80041006
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call fcn.01016ded
jmp 0x10349a5
mov ebx, 0x80041003
mov eax, ebx
call fcn.0103d966
ret 4

Function at 0x10349b4
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1042040
call fcn.0103d87a
and dword [ebp - 0x10], 0
push 0x20a
call fcn.0103d496
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10349eb
mov dword [ebp - 0x14], 0xbbef
push 0x1044b0c
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll__CxxThrowException
lea eax, [ebp - 0x10]
push eax
push 0x1016cef
lea eax, [ebp - 0x20]
push eax
call fcn.010347dd
and dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x105
push dword [ebp - 0x10]
call edi
mov esi, eax
test esi, esi
je 0x1034a59
cmp esi, 0x104
jbe 0x1034a6c
cmp dword [ebp - 0x10], 0
je 0x1034a32
push dword [ebp - 0x10]
call fcn.0103d416
and dword [ebp - 0x10], 0
pop ecx
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0103d496
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10349d6
push esi
push eax
call edi
test eax, eax
jne 0x1034a6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
push 0x1045960
jmp 0x10349e2
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x10349d6
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call fcn.01016ded
mov eax, esi
call fcn.0103d966
ret
Function at 0x1037893
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push 0x1037859
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
push edi
call esi
cmp eax, 0x102
jne 0x10378e7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push edi
call esi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop edi
pop esi
leave
ret 4
Function at 0x473610
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x47362d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x47361e
add dl, dl
jne 0x473638
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x473684
xor eax, eax
add dl, dl
jne 0x473645
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x473721
add dl, dl
jne 0x473654
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47365f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47366a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x473675
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x47367f
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x473624
mov eax, 1
add dl, dl
jne 0x473692
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x47369d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x473689
sub eax, 2
jne 0x4736cc
mov ecx, 1
add dl, dl
jne 0x4736b2
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4736bd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4736a9
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x473624
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4736e3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4736ee
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4736da
cmp eax, 0x7d00
jae 0x473711
cmp eax, 0x500
jb 0x47370c
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x473624
cmp eax, 0x7f
ja 0x473714
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x473624
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x47373d
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x473624
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425004]
jne 0x40100a
repz ret
jmp fcn.0040149a

Function at 0x406db3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403b51
and dword [ebp - 0x14], 0
cmp dword [0x427d88], 0
mov dword [ebp - 0x18], eax
jne 0x406e66
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406f0e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406f0e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427d88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427d8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427d90], eax
call edi
push eax
call esi
mov dword [0x427d98], eax
test eax, eax
je 0x406e66
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427d94], eax
mov eax, dword [0x427d94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406ebf
cmp dword [0x427d98], ecx
je 0x406ebf
push eax
call esi
push dword [0x427d98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406ebf
test ebx, ebx
je 0x406ebf
call edi
test eax, eax
je 0x406eb6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406eb6
test byte [ebp - 8], 1
jne 0x406ebf
or dword [ebp + 0x10], 0x200000
jmp 0x406ef2
mov eax, dword [0x427d8c]
cmp eax, dword [ebp - 0x18]
je 0x406ef2
push eax
call esi
test eax, eax
je 0x406ef2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406ef2
mov eax, dword [0x427d90]
cmp eax, dword [ebp - 0x18]
je 0x406ef2
push eax
call esi
test eax, eax
je 0x406ef2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427d88]
call esi
test eax, eax
je 0x406f0e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406f10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x40c2f0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4261f0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1ef9f38]
push edi
mov edi, dword [0x1efa214]
push eax
call fcn.0040c200
add esp, 4
cmp dword [0x1efa214], 0x2f
jne 0x40c34d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0040c250
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c5d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
xor edi, edi
cmp dword [0x1efa214], 0x8cf
jne 0x40c606
push 0
push 0
call ebx
cmp edi, 0x845013
jne 0x40c61d
mov eax, dword [0x427010]
add eax, 0xa231
mov dword [0x1efa214], eax
cmp dword [0x1efa214], 0x141
jne 0x40c64b
push str.fifavejefibil_cisusahetohijeyimak_yehuwaganobanibama_samiwejafi_herizacowamodusuguhax
lea ecx, [ebp - 0x804]
push ecx
call esi
mov dword [0x4282b0], 0xec58acac
mov dword [0x4282b4], 0xffffffff
inc edi
cmp edi, 0xbbe2a98
jl 0x40c5f4
call fcn.0040c360
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov word [0x430750], 0
mov dword [esp + 0xc], 0
push edi
jmp 0x409ae0
movzx edi, word [0x430750]
movzx eax, word [0x5096ea]
add eax, edi
mov cx, word [eax*2 + 0x5052a0]
lea eax, [eax*2 + 0x5052a0]
and cx, 0x3fff
mov word [0x43074c], cx
mov word [eax], cx
mov byte [0x5044a4], 0
mov word [0x430754], 1
je 0x409c93
test cl, 1
je 0x409c6b
movzx eax, byte [0x5044a4]
mov dl, byte [eax + 0x505530]
cmp dl, 0xff
je 0x409b48
cmp byte [eax + 0x5045d0], 0
jne 0x409b55
cmp byte [eax + 0x509390], 0
je 0x409c6b
cmp byte [eax + 0x509390], 0
je 0x409b6c
mov dl, byte [eax + 0x504830]
mov bl, byte [eax + 0x504820]
jmp 0x409b72
mov bl, byte [eax + 0x5045b0]
cmp dl, byte [edi + 0x506e0d]
mov byte [0x50a8e1], bl
mov byte [0x50a8e0], dl
jae 0x409b8c
mov byte [edi + 0x506e0d], dl
cmp bl, byte [edi + 0x506e35]
jbe 0x409b9a
mov byte [edi + 0x506e35], bl
movzx eax, word [0x5096ea]
mov si, word [0x430754]
mov ebp, dword [0x5048e4]
lea ecx, [edi + eax]
xor word [ecx*2 + 0x5052a0], si
movzx esi, dl
lea ecx, [esi + esi*4]
lea ecx, [edi + ecx*8]
add ecx, eax
mov eax, dword [0x5048d4]
lea eax, [eax + ecx*8 + 6]
mov dword [0x5080e0], eax
mov eax, dword [0x5048c4]
lea eax, [eax + ecx*8 + 6]
lea ecx, [ecx + ebp + 6]
mov dword [0x503aac], ecx
mov cl, bl
sub cl, dl
mov dword [0x503ba4], eax
mov byte [0x503bf4], cl
je 0x409c6b
test byte [0x507892], 2
je 0x409c46
cmp byte [0x5045c8], 0
je 0x409c3f
movsx edx, word [0x503bc0]
cmp esi, edx
jg 0x409c3f
mov eax, dword [esp + 0x10]
cmp ax, word [0x5053f0]
jg 0x409c3f
movzx ecx, bl
cmp cx, word [0x503d50]
jl 0x409c3f
add eax, 8
cmp ax, word [0x505bf0]
jl 0x409c3f
call fcn.00409440
jmp 0x409c6b
call fcn.004093e0
jmp 0x409c6b
movzx esi, cl
xor edx, edx
test esi, esi
jle 0x409c6b
nop
xor ecx, ecx
mov dword [eax], ecx
add edx, 1
mov dword [eax + 4], ecx
movsx ecx, dx
add eax, 0x140
cmp ecx, esi
jl 0x409c50
mov dword [0x503ba4], eax
mov cx, word [0x43074c]
add byte [0x5044a4], 1
shl word [0x430754], 1
shr cx, 1
test cx, cx
mov word [0x43074c], cx
jne 0x409b24
mov eax, dword [esp + 0x10]
add word [0x430750], 1
add eax, 8
cmp ax, 0x140
mov dword [esp + 0x10], eax
jb 0x409ae0
pop edi
xor eax, eax
pop esi
pop ebp
mov dword [0x509390], eax
mov dword [0x509394], eax
mov dword [0x509398], eax
mov byte [0x50939c], al
mov word [0x430750], 0xd
pop ebx
pop ecx
ret

Function at 0x412f90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [0x505728]
push edi
mov ecx, 8
lea ecx, [ecx]
mov eax, esi
shr eax, 0x1e
mov edx, esi
shr edx, 0x1d
xor al, dl
and eax, 1
sub ecx, 1
movsx eax, ax
lea esi, [eax + esi*2]
jne 0x412fa0
mov eax, dword [0x509388]
mov dword [0x505728], esi
lea edi, [ecx + 0xd]
mov ecx, eax
shr ecx, 0x1e
mov edx, eax
shr edx, 0x1d
xor cl, dl
and ecx, 1
sub edi, 1
movsx ecx, cx
lea eax, [ecx + eax*2]
jne 0x412fc8
movsx edx, word [esp + 0xc]
add esi, eax
mov dword [0x509388], eax
movzx eax, si
add edx, 1
imul eax, edx
pop edi
sar eax, 0x10
pop esi
ret
Function at 0x413230
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
mov cx, word [0x507668]
push esi
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4132f4
push ebx
movsx ecx, cx
push ebp
push edi
mov dword [esp + 0x10], ecx
jmp 0x413257
mov eax, dword [esp + 0x18]
cmp eax, 0xfde8
movzx edi, ax
jle 0x413266
mov edi, 0xfde8
mov edx, dword [esp + 0x10]
mov eax, dword [edx*4 + 0x440188]
cmp eax, 0x4f235c
movzx ebp, di
jne 0x4132ac
mov ecx, dword [0x4f235c]
mov eax, dword [ecx + 8]
mov edx, dword [0x4f2360]
sub eax, edx
cmp ebp, eax
mov ebx, ebp
jbe 0x413294
mov ebx, eax
mov eax, dword [ecx + 4]
push ebx
add eax, edx
push eax
push esi
call sub.msvcr80.dll_memcpy
add esp, 0xc
add dword [0x4f2360], ebx
jmp 0x4132ba
push eax
push ebp
push 1
push esi
call dword [sym.imp.msvcr80.dll_fread]
add esp, 0x10
sub dword [esp + 0x18], ebp
test di, di
je 0x4132e6
jmp 0x4132d0
mov cl, byte [0x506de8]
xor byte [esi], cl
add edi, 0xffff
add esi, 1
test di, di
jne 0x4132d0
cmp dword [esp + 0x18], 0
jne 0x413253
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret

Function at 0x413300
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, eax
test edi, edi
mov ax, word [0x507668]
mov ebx, ecx
je 0x413347
push ebp
push esi
movsx ebp, ax
cmp edi, 0xffff
movzx eax, di
jle 0x413325
mov eax, 0xffff
movzx esi, ax
mov eax, dword [ebp*4 + 0x440188]
push eax
push esi
push 1
push ebx
call dword [sym.imp.msvcr80.dll_fwrite]
sub edi, esi
add esp, 0x10
add ebx, esi
test edi, edi
jne 0x413315
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x413350
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ax, word [0x507da0]
test ax, ax
push esi
mov esi, dword [sym.imp.msvcr80.dll_fwrite]
jne 0x4133a2
movsx ecx, word [0x507668]
mov al, byte [0x506de8]
mov edx, dword [ecx*4 + 0x440188]
push edx
xor al, bl
push 1
mov byte [esp + 0xc], al
lea eax, [esp + 0xc]
push 1
push eax
call esi
sub eax, 1
add esp, 0x10
neg eax
sbb eax, eax
neg eax
add word [0x50a662], 1
mov word [0x507da0], ax
test ax, ax
mov cl, bh
jne 0x4133e7
xor cl, byte [0x506de8]
lea eax, [esp + 4]
mov byte [esp + 4], cl
movsx ecx, word [0x507668]
mov edx, dword [ecx*4 + 0x440188]
push edx
push 1
push 1
push eax
call esi
sub eax, 1
add esp, 0x10
neg eax
sbb eax, eax
neg eax
add word [0x50a662], 1
mov word [0x507da0], ax
pop esi
pop ecx
ret

Function at 0x4133f0
Capabilities:
Read file on windows

Disassembly:
push ecx
movsx eax, word [0x507668]
mov eax, dword [eax*4 + 0x440188]
cmp eax, 0x4f235c
jne 0x413446
mov ecx, dword [0x4f235c]
mov eax, dword [ecx + 8]
push esi
push edi
mov edi, dword [0x4f2360]
mov esi, 1
sub eax, edi
cmp eax, esi
jae 0x413424
mov esi, eax
mov ecx, dword [ecx + 4]
push esi
add ecx, edi
push ecx
lea edx, [esp + 0x13]
push edx
call sub.msvcr80.dll_memcpy
add esp, 0xc
add edi, esi
mov dword [0x4f2360], edi
pop edi
mov eax, esi
pop esi
jmp 0x413459
push eax
push 1
lea eax, [esp + 0xb]
push 1
push eax
call dword [sym.imp.msvcr80.dll_fread]
add esp, 0x10
movzx edx, byte [esp + 3]
xor ecx, ecx
cmp eax, 1
movzx eax, byte [0x506de8]
setne cl
xor eax, edx
mov word [0x507da0], cx
pop ecx
ret
Function at 0x417430
Capabilities:
Write file on windows

Disassembly:
movzx eax, byte [0x50a660]
sub eax, 1
mov word [0x42dad4], 0xe
je 0x417469
sub eax, 1
je 0x417458
sub eax, 1
jne 0x417478
add byte [0x50a661], 0x28
jmp 0x417478
mov eax, 0x28
mov ecx, 0x509da0
call fcn.00413300
jmp 0x417478
push 0x28
mov eax, 0x509da0
call fcn.00413230
add esp, 4
movzx eax, byte [0x50a660]
sub eax, 1
je 0x4174a5
sub eax, 1
je 0x417496
sub eax, 1
jne 0x4174b2
add byte [0x50a661], 2
ret
mov eax, 2
mov ecx, 0x42dad4
jmp fcn.00413300
push 2
mov eax, 0x42dad4
call fcn.00413230
pop ecx
ret
Function at 0x41d060
Capabilities:
Encode data using xor

Disassembly:
push ecx
test eax, eax
push edi
mov edi, dword [esp + 0x10]
jle 0x41d104
push ebp
mov dword [esp + 8], eax
push esi
test edi, edi
mov esi, dword [esp + 0x14]
jle 0x41d0e8
mov edx, dword [esp + 0x1c]
add edi, 0xffffffff
shr edi, 2
add edx, 4
add edi, 1
lea esp, [esp]
mov eax, dword [esi]
mov ecx, eax
shl ecx, 8
xor ecx, eax
and ecx, 0xffff
mov ebp, eax
shl ebp, 8
xor ecx, ebp
shl ecx, 8
movzx ebp, al
or ecx, ebp
mov dword [edx - 4], ecx
mov dword [ebx + edx - 4], ecx
shr eax, 0x10
mov ecx, eax
shl ecx, 8
xor ecx, eax
and ecx, 0xffff
mov ebp, eax
shl ebp, 8
xor ecx, ebp
movzx eax, al
shl ecx, 8
or ecx, eax
mov dword [edx], ecx
mov dword [edx + ebx], ecx
add esi, 4
add edx, 8
sub edi, 1
jne 0x41d090
mov edi, dword [esp + 0x18]
add dword [esp + 0x14], 0x140
lea eax, [ebx + ebx]
add dword [esp + 0x1c], eax
sub dword [esp + 0xc], 1
jne 0x41d074
pop esi
pop ebp
pop edi
pop ecx
ret

Function at 0x41d440
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push edi
xor edi, edi
cmp dword [esp + 0x1c], edi
mov dword [esp + 8], edi
jle 0x41d5ad
push ebx
mov edi, edi
mov ebx, dword [esp + 0x18]
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
mov eax, edi
sub eax, edx
cmp eax, 4
ja case.default.0x41d484
jmp dword [eax*4 + 0x41d5b4]
test ebp, ebp
jle 0x41d500
lea edi, [ebp - 1]
shr edi, 2
lea edx, [ecx + 4]
add edi, 1
jmp 0x41d4a0
mov eax, dword [ebx]
mov ecx, eax
shl ecx, 8
xor ecx, eax
and ecx, 0xffff
mov ebp, eax
shl ebp, 8
xor ecx, ebp
shl ecx, 8
movzx ebp, al
or ecx, ebp
mov dword [edx - 4], ecx
mov dword [esi + edx - 4], ecx
shr eax, 0x10
mov ecx, eax
shl ecx, 8
xor ecx, eax
and ecx, 0xffff
mov ebp, eax
shl ebp, 8
xor ecx, ebp
movzx eax, al
shl ecx, 8
or ecx, eax
mov dword [edx], ecx
mov dword [edx + esi], ecx
add ebx, 4
add edx, 8
sub edi, 1
jne 0x41d4a0
mov edi, dword [esp + 0xc]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
lea ecx, [ecx + esi*2]
jmp 0x41d58f
test ebp, ebp
jle 0x41d589
lea eax, [ebp - 1]
shr eax, 2
add eax, 1
lea edi, [ecx + esi + 4]
lea edx, [ecx + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [ebx]
mov eax, ecx
shl eax, 8
xor eax, ecx
and eax, 0xffff
mov ebp, ecx
shl ebp, 8
xor eax, ebp
shl eax, 8
movzx ebp, cl
or eax, ebp
mov dword [edx - 4], eax
mov dword [edx + esi - 4], eax
mov dword [edi + esi - 4], eax
shr ecx, 0x10
mov eax, ecx
shl eax, 8
xor eax, ecx
and eax, 0xffff
mov ebp, ecx
shl ebp, 8
xor eax, ebp
movzx ecx, cl
shl eax, 8
or eax, ecx
mov dword [edx], eax
mov dword [edi], eax
mov dword [edi + esi], eax
add ebx, 4
add edx, 8
add edi, 8
sub dword [esp + 0x10], 1
jne 0x41d520
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0xc]
lea edx, [esi + ecx]
lea ecx, [edx + esi*2]
add dword [esp + 0x18], 0x140
mov dword [esp + 0x24], ecx
add edi, 1
cmp edi, dword [esp + 0x20]
mov dword [esp + 0xc], edi
jl 0x41d460
pop ebx
pop edi
pop ebp
add esp, 8
ret
Function at 0x420900
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
cmp dword [0x503a8c], esi
push edi
jne 0x420940
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
jns 0x420936
push str.___.___
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x503a88], eax
mov dword [0x503a8c], 1
mov eax, dword [0x503a88]
test eax, eax
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
je 0x420959
push ebp
push eax
call edi
mov esi, eax
test esi, esi
jne 0x420994
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x42098a
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
jns 0x420977
mov ecx, dword [ebx + 8]
mov edx, dword [ebx]
push ecx
call edx
jmp 0x420980
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
push eax
call ecx
test eax, eax
je 0x420994
mov edx, dword [esp + 0x10]
mov dword [edx], eax
push ebp
push eax
call edi
pop edi
pop esi
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x421220
Capabilities:
Suspend thread

Disassembly:
call fcn.00420e70
push 0x7f02
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
push eax
call dword [sym.imp.user32.dll_SetCursor]
call fcn.00421330
call fcn.00421500
call fcn.00421750
test eax, eax
nop
nop
call fcn.00421890
test eax, eax
jne 0x421289
call fcn.00421a90
test eax, eax
jne 0x421289
push edi
mov edi, str.GAMELoom
call fcn.00424b50
push eax
call fcn.00421b70
add esp, 4
test eax, eax
pop edi
jne 0x421289
call fcn.00421e10
test eax, eax
jne 0x421289
call fcn.004212d0
test eax, eax
je 0x421296
call fcn.004231f0
mov eax, 1
ret 0x10
mov eax, dword [0x443664]
test eax, eax
je 0x4212b8
push eax
call dword [sym.imp.kernel32.dll_SuspendThread]
push 1
mov dword [0x443664], 0
call dword [sym.imp.winmm.dll_timeEndPeriod]
call fcn.00421ef0
call fcn.00421f30
xor eax, eax
ret 0x10