joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4401c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x44020c
mov eax, esi
call fcn.00456934
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44020c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x44020c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x44034b
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x44024c
cmp eax, 0x108
ja 0x44024c
mov eax, esi
call fcn.00456934
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x440342
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x44034b
jmp 0x440342
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x44032b
cmp eax, 0x20a
ja 0x44032b
test byte [esi + 0x50], 0x80
jne 0x44027e
sub eax, 0x203
je 0x44027b
sub eax, 3
je 0x44027b
sub eax, 3
jne 0x44027e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x440292
dec eax
je 0x4402a7
dec eax
je 0x4402c4
dec eax
je 0x4402a7
jmp 0x4402cb
mov ecx, ebx
mov eax, dword [0x485490]
mov eax, dword [eax]
mov edx, esi
call fcn.00460044
jmp 0x440342
cmp byte [esi + 0x5d], 1
jne 0x4402bd
mov eax, esi
mov si, 0xffed
call fcn.004036f0
jmp 0x44034b
or word [esi + 0x54], 1
jmp 0x440342
and word [esi + 0x54], 0xfffe
jmp 0x440342
mov eax, dword [0x486b9c]
cmp byte [eax + 0x20], 0
je 0x440342
mov eax, dword [0x486b9c]
cmp dword [eax + 0x1c], 0
je 0x440342
mov eax, dword [ebx]
mov edx, dword [0x486b9c]
cmp eax, dword [edx + 0x1c]
jne 0x440342
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.004567f0
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004036f0
jmp 0x44034b
cmp eax, 0xb00b
jne 0x440342
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0043ead4
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443800
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44381c
cmp dword [esi + 4], 0
je 0x443849
test byte [ebx + 0x55], 1
jne 0x44383b
mov eax, ebx
call fcn.00442458
test eax, eax
jne 0x44383b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x443959
mov edx, esi
mov eax, ebx
call fcn.00443320
jmp 0x443959
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x443952
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004455d0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004400f4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00443800
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004455d0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443959
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446ad8
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x4855ec]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x446c9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0043ef70
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00440198
mov eax, dword [esi]
call fcn.0045d1f8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x446b4a
mov eax, dword [esi]
call fcn.0045d1f8
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0045d204
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x446b6e
mov eax, dword [esi]
call fcn.0045d204
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045d1ec
cmp eax, dword [ebp - 0x18]
jle 0x446b84
mov eax, dword [esi]
call fcn.0045d1ec
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045d1e0
cmp eax, dword [ebp - 0xc]
jle 0x446b9a
mov eax, dword [esi]
call fcn.0045d1e0
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004455d0
push eax
call sub.user32.dll_SetWindowPos
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x446c61
mov eax, ebx
call fcn.0040454c
cmp eax, 0x64
jge 0x446c61
cmp dword [0x484b3c], 0
je 0x446c61
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x446c61
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x446c24
mov bl, 2
jmp 0x446c3f
lea edx, [ebp - 0x20]
mov eax, dword [0x486b9c]
call fcn.00449d28
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x446c3d
xor ebx, ebx
jmp 0x446c3f
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x484c44]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.004455d0
push eax
call dword [0x484b3c]
push 4
mov eax, dword [ebp - 4]
call fcn.004455d0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446ca6
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x449e38
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x485610]
cmp byte [eax + 0xc], 0
je 0x449fa5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449f9e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x486bf0], 0
jne 0x449e8c
push 0x449fac
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x449fb4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bf0], eax
cmp dword [0x484c6c], 0
jne 0x449f87
push 0x449fc4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x484c6c], eax
cmp dword [0x484c6c], 0
je 0x449f87
push 0x449fd0
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bf4], eax
push 0x449fe0
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bf8], eax
push 0x449ff4
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486bfc], eax
push 0x44a00c
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c00], eax
push 0x44a024
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c04], eax
push 0x44a038
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c08], eax
push 0x44a050
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c0c], eax
push 0x44a068
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c10], eax
push 0x44a084
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c14], eax
push 0x44a090
mov eax, dword [0x484c6c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x486c18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449fa5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44e6bc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404284
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44e70b
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x456760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4567b0]
test si, 4
je 0x456774
or bl, 1
test si, 8
je 0x45677e
or bl, 4
test si, 1
je 0x456788
or bl, 8
test si, 2
je 0x456792
or bl, 0x10
test si, 0x10
je 0x45679c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4567ab
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4567b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4567ec]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4567cd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4567dc
or bl, 4
test esi, 0x20000000
je 0x4567e7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45cfa8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45cfba
add esp, 0xfffffff0
call fcn.00403858
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422078
mov eax, dword [0x4852b8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d34c
mov eax, dword [0x4852c4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d358
mov eax, ebx
call fcn.0045d364
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417a48]
call fcn.004034c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45977c
push eax
push 0
push 0
mov eax, dword [0x485408]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423abc]
call fcn.004251d0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423abc]
call fcn.004251d0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423abc]
call fcn.004251d0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045d7cc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d6a8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d6a8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d6a8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d0f7
call fcn.004038b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45d48c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d637
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45d618
mov dl, 1
mov eax, dword [0x4180ac]
call fcn.004034c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404284
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45d607
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044a198
test al, al
je 0x45d5fa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45d648
lea eax, [ebp - 0x254]
call fcn.00409838
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45d5fa
xor eax, eax
push ebp
push 0x45d5f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45d680
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45d5dc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45d5dc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d5fa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45d4fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c65c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d63e
lea eax, [ebp - 0x260]
call fcn.00404284
ret

Function at 0x45df6c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x486c38]
cmp byte [eax + 0xa5], 0
jne 0x45dfdd
cmp dword [0x486c50], 0
jne 0x45df9e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45df28
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x486c50], eax
cmp dword [0x486c4c], 0
jne 0x45dfb9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x486c4c], eax
cmp dword [0x486c54], 0
jne 0x45dfdd
push esp
push 0
push 0
push 0x45decc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x486c54], eax
pop edx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403203
pop dword [ebp - 0x18]
mov eax, 0x507faf45
sub eax, 0x503f7d42
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x796f17f5
add dword [ebp - 0x28], 0xd4e32d56
mov dword [ebp - 0x24], 0xeaf65748
sub dword [ebp - 0x24], 0xb8c30b03
mov dword [ebp - 0x20], 0xc222971d
sub dword [ebp - 0x20], 0x75d652ef
mov dword [ebp - 0x1c], 0x9225e1d5
add dword [ebp - 0x1c], 0x6dda1e2b
lea eax, [ebp - 0x28]
push eax
mov eax, 0x2eb84f14
add eax, 0xd1883178
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xcb9d7c23
add dword [ebp - 0x28], 0xa8d4ed33
mov dword [ebp - 0x24], 0xeaa081c
sub dword [ebp - 0x24], 0xcd3da6a7
mov dword [ebp - 0x20], 0x2229b10a
sub dword [ebp - 0x20], 0xbeba449e
mov dword [ebp - 0x1c], 0x4a1e07e1
add dword [ebp - 0x1c], 0xb5e1f81f
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa54a5774
sub eax, 0xa509d6a0
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3abb1
push 0
call eax
mov ecx, 0xe6ae11de
add ecx, 0x195246ae
mov esi, eax
mov edx, 0x411000
add edx, dword [ebp - 0x18]
mov edi, 0xb6d9524d
sub dword [ebp - 0x14], 0xf111586a
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0x52401036
xor ebx, edi
add dword [ebp - 0x14], edx
mov dword [esi], ebx
add dword [ebp - 4], 0x19f53675
add esi, 0x4c492e38
add esi, 0xb3b6d1cc
add edx, 0x36a8ebf3
sub edx, 0x36a8ebef
loop 0x403319
add eax, 0x2797adce
sub eax, 0x279658cb
mov ebx, eax
add eax, 0x1a13cbb2
sub eax, 0x1a13cbad
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401bd7
pop dword [ebp - 0x40]
mov eax, 0xba4f6491
sub eax, 0xba0f48ba
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb08d2fba
sub dword [ebp - 0x50], 0x623aea6f
mov dword [ebp - 0x4c], 0x6ce78986
add dword [ebp - 0x4c], 0xc54bc2bf
mov dword [ebp - 0x48], 0x7931faac
add dword [ebp - 0x48], 0xd31a4982
mov dword [ebp - 0x44], 0x355d4e95
add dword [ebp - 0x44], 0xcaa2b16b
lea eax, [ebp - 0x50]
push eax
mov eax, 0x1984bf03
add eax, 0xe6bbb15d
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x6f8aa6cf
add dword [ebp - 0x50], 0x4e7c287
mov dword [ebp - 0x4c], 0x289fdd71
add dword [ebp - 0x4c], 0x18cc8404
mov dword [ebp - 0x48], 0x669acbb5
add dword [ebp - 0x48], 0xfcd4a0b7
mov dword [ebp - 0x44], 0x1956b5ba
sub dword [ebp - 0x44], 0x1956b5ba
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x32b77
push 0
call eax
mov ecx, 0x3891
mov edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x40]
mov ebx, 0x51bdde81
sub ebx, 0x9a42d2d4
add dword [ebp - 0x34], 0x61f7bd33
mov edx, dword [esi]
xor dword [ebp - 4], 0x776f634c
add edx, ebx
mov dword [ebp - 0x28], 0xf2a77eb8
mov dword [edi], edx
add edi, 0xf20fd1f8
sub edi, 0xf20fd1f4
add esi, 4
loop 0x401ce8
add eax, 0xd517
xor ebx, ebx
add ebx, eax
add eax, 0x99191199
add eax, 0x66e6ee6c
mov ecx, 0x2885ad7
add ecx, 0xfdb7a529
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10053080
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call fcn.10053080
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.10053080
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call fcn.10053080
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call fcn.10053080
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8