joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x405b32
pop dword [ebp - 0x1c]
mov eax, 0x49940871
add eax, 0xb6ac52c1
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xdef72fca
sub dword [ebp - 0x2c], 0x90a4ea7f
mov dword [ebp - 0x28], 0x975da94d
add dword [ebp - 0x28], 0x9ad5a2f8
mov dword [ebp - 0x24], 0xcaf43daa
sub dword [ebp - 0x24], 0x7ea7f97c
mov dword [ebp - 0x20], 0xc87474ba
add dword [ebp - 0x20], 0x378b8b46
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x7ab008db
add eax, 0x8590779d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x60dc29e6
sub dword [ebp - 0x2c], 0xec69c090
mov dword [ebp - 0x28], 0x56ff2982
add dword [ebp - 0x28], 0xea6d37f3
mov dword [ebp - 0x24], 0x7283abe9
add dword [ebp - 0x24], 0xf0ebc083
mov dword [ebp - 0x20], 0x7fe328e3
sub dword [ebp - 0x20], 0x7fe328e3
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x5ea147d0
add eax, 0xa19f38ac
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39310
push 0
call eax
mov ecx, 0x50ba
mov esi, eax
mov edx, 0x451400
add edx, dword [ebp - 0x1c]
mov edi, 0x75995762
add edi, 0xb500f281
mov dword [ebp - 0x10], 0x1829be
mov ebx, dword [edx]
mov dword [ebp - 0x18], 0xf20168e5
add ebx, edi
xor dword [ebp - 0x14], eax
mov dword [esi], ebx
add dword [ebp - 0x14], 0x2d316ec3
add esi, 0xcba2181c
sub esi, 0xcba21818
add edx, 0x41d4f22a
sub edx, 0x41d4f226
loop 0x405c48
add eax, 0xee2c7dd5
add eax, 0x11d4b7e6
mov ebx, eax
add eax, 0x884c58e1
add eax, 0x77b3a724
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x417e10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [edi + 8]
test eax, eax
jne 0x417e73
push 0
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
mov dword [edi], esi
je 0x417e60
mov ecx, dword [0x4c9afc]
push 0x4c97ec
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test esi, esi
je 0x417e73
push str.IsThemeActive
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44e1fd
Capabilities:
Encode data using xor

Disassembly:
jb 0x44e22e
leave
cmp eax, 0xb8ec1105
jns 0x44e219
ret
jnp 0x44e26d
std
mov esi, dword [ebx - 0xe]
adc bh, byte [ebp + 0x314d1d2c]
jp 0x44e235
pop esi
sbb esi, ecx
push ds

Function at 0x4734e9
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
loopne 0x47348a
and byte [0x2d297014], dl
Function at 0x47c2f5
Capabilities:
Encode data using xor

Disassembly:
sub edi, dword [edi]
invalid
xchg esi, eax
or dh, bl
xor al, 0x26
mov dword [0x53b17393], eax
mov ch, 0x29
fidivr word [0x32bb10b3]
sub esi, ebx
cmp eax, 0x32bb10b3
insb byte es:[edi], dx
cwde
jne 0x47c2b7
jb 0x47c27e
and eax, 0xd60c01ae
loopne 0x47c34b
push edi
jg 0x47c306
out dx, eax
and al, 0x1f
and ecx, dword [0x3673b806]
pop es
popal
int1
xor eax, 0xf4d1be63
push 0xc743b39d
cld
add ch, byte [eax - 0x61d2a6ae]
pop ecx
sub eax, 0x72278a9e
invalid
pop ecx
sub eax, 0x72278a9e
and dl, dl
and dl, dl
add ebx, eax
inc ecx
jno 0x47c2c5
lahf
sbb al, 0xf9
aaa
insb byte es:[edi], dx
rol dword [ebx], 0xd6
mov bh, byte [eax - 0x3ebd6472]
scasb al, byte es:[edi]
inc ecx
outsd dx, dword [esi]
aaa
invalid
mov esi, ss
int 0xf1
push cs
hlt
cmpsb byte [esi], byte es:[edi]
neg dword [eax + 0x18]
in al, 0x5e
mov esp, 0xe3bf14ae
or dh, byte [eax - 0x75]
jo 0x47c2c3
sbb ebp, ebp
adc ch, cl
jl 0x47c39a
sub dword [ebx - 0x2c77faa4], 0xffffffb7
pop esi
jno 0x47c38e
loop 0x47c336
or al, 0x4a
dec edx
sub byte [ecx + 0x3e], bh
pop edi
popal
out 0xbb, eax
dec edx
mov bl, 0xd1
mov edx, dword [edi + 0x7e82f046]
ja 0x47c311
aas
fiadd dword [eax + 0x21]
clc
mov ah, bl
mov fs, ebx
adc ebp, edi
outsb dx, byte [esi]
xchg ebx, eax
salc
xchg ebx, eax
mov ecx, 0xb6c4af64
push eax
inc ebp
lea esi, [bx + si - 0x5454]
leave
sbb eax, dword [edi]
test al, 0xc1
dec ecx
fadd qword [edx - 0x49d36cf3]
push ss
test dword [ebx + 0x3a], 0xf6480b61
invalid
not dh
xchg ecx, eax
das
pop es
jecxz 0x47c338
xchg esi, eax
imul ebx, dword [esi - 0x9ec1f35], 0x76
or dword [edx], 0xffffffee
adc esi, esi
jbe 0x47c321
or ch, dh
add eax, 0x83361730
inc ebx
inc ebx
cwde
out 0x98, al
call dword [ebx]
dec ebp
salc
add al, 0x43
mov eax, dword [0x92c67d37]
scasb al, byte es:[edi]
cdq
xor byte [eax], ch
mov dh, 0xe6
mov dword [0x18db30ee], eax
das
int1
cdq
mov word [ebp - 0x39], cs
cmp esp, edx
insb byte es:[edi], dx
push ecx
jg 0x47c372
mov edx, 0x6e435e6e
add ch, byte [esi - 0x57a7fae5]
add ebp, edi
push edx
push esp
push ebx
cmp dword [ebx], esi
sbb al, 0xc1
sal bl, 0xb
mov bl, byte [esi]
mov bl, 0x1b
jp 0x47c3eb
out dx, al
dec ebp
sar dword [edx + 0x1163c15a], cl
inc edx
pop edi
inc ebx
push ds
jno 0x47c3a5
pop ss
invalid
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401c66
pop dword [ebp - 0x30]
mov eax, 0xa897ae13
sub eax, 0xa85791ad
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x2b7901e
add dword [ebp - 0x40], 0x4b9ab52d
mov dword [ebp - 0x3c], 0x1ff0f5f3
sub dword [ebp - 0x3c], 0xedbda9ae
mov dword [ebp - 0x38], 0x3315abe3
add dword [ebp - 0x38], 0x1936984b
mov dword [ebp - 0x34], 0x69692099
add dword [ebp - 0x34], 0x9696df67
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x90baee18
add dword [ebp - 0x40], 0xe3b77b3e
mov dword [ebp - 0x3c], 0x8a05c98
sub dword [ebp - 0x3c], 0xc733fb23
mov dword [ebp - 0x38], 0xda508639
add dword [ebp - 0x38], 0x891ee633
mov dword [ebp - 0x34], 0xa87506c6
add dword [ebp - 0x34], 0x578af93a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37a1e
push 0
call eax
mov ecx, 0x4c9b
xor ebx, ebx
add ebx, eax
mov esi, 0x3490cda3
add esi, 0xcbafa25d
add esi, dword [ebp - 0x30]
mov edx, 0x7abe5918
sub edx, 0xd6f05931
mov dword [ebp - 0x24], 0x85c7ac35
mov edi, dword [esi]
add dword [ebp - 0x10], 0xaee4c9bd
sub edi, edx
add dword [ebp - 0x18], 0x1b7cbb4a
mov dword [ebx], edi
xor dword [ebp - 0xc], 0xcddd8b24
add ebx, 0x28c515df
sub ebx, 0x28c515db
add esi, 4
loop 0x401d7a
add eax, 0x9a347a73
sub eax, 0x9a335534
xor ebx, ebx
add ebx, eax
add eax, 0xe33c3bb7
add eax, 0x1cc3c44e
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4a071504
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x7ec6d5d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4019d1
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ced85
jg 0x4019f5
inc edi
cmp edi, 0x1f6502b1
jl 0x4019dd
cmp dword [0x2be13bc], 0x400
jne 0x401a3e
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call fcn.00401e31
push esi
push esi
call fcn.00401e31
push esi
call fcn.004020d4
push esi
call fcn.004020e3
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x401a4f
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
cmp edi, 0x3a37ee
jg 0x401a76
inc edi
cmp edi, 0xe52f
jl 0x401a40
mov eax, dword [0x422c24]
mov dword [0x2be13bc], eax
call fcn.00401728
mov edi, 0x3078f
cmp dword [0x2be13bc], 0x51f
jne 0x401aa2
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x401a8a
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x404dbe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422940]
jne 0x404dc8
repz ret
jmp fcn.004062ec
Function at 0x405c2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422940]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040311b
and dword [ebp - 0x14], 0
cmp dword [0x42d78c], 0
mov dword [ebp - 0x18], eax
jne 0x405cdf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405d87
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405d87
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d78c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d790], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d794], eax
call edi
push eax
call esi
mov dword [0x42d79c], eax
test eax, eax
je 0x405cdf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d798], eax
mov eax, dword [0x42d798]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405d38
cmp dword [0x42d79c], ecx
je 0x405d38
push eax
call esi
push dword [0x42d79c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405d38
test ebx, ebx
je 0x405d38
call edi
test eax, eax
je 0x405d2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405d2f
test byte [ebp - 8], 1
jne 0x405d38
or dword [ebp + 0x10], 0x200000
jmp 0x405d6b
mov eax, dword [0x42d790]
cmp eax, dword [ebp - 0x18]
je 0x405d6b
push eax
call esi
test eax, eax
je 0x405d6b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405d6b
mov eax, dword [0x42d794]
cmp eax, dword [ebp - 0x18]
je 0x405d6b
push eax
call esi
test eax, eax
je 0x405d6b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d78c]
call esi
test eax, eax
je 0x405d87
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405d89
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404dbe
leave
ret
Function at 0x4041e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4cc1dc], 0
push ebx
push esi
push edi
mov esi, eax
jne 0x4041f6
call fcn.00404150
mov ebx, dword [ebp + 8]
test esi, esi
je 0x40421b
lea ecx, [ecx]
test bl, 7
je 0x40421b
movzx eax, byte [ebx]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x4cc1d8]
inc ebx
dec esi
jne 0x404200
cmp esi, 8
jb 0x4042ae
mov edi, esi
shr edi, 3
lea esp, [esp]
xor edx, dword [ebx]
add ebx, 8
movzx ecx, dl
mov eax, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x4cc1d8]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4cc1d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4cc1d8]
mov ecx, eax
movzx edx, cl
mov eax, dword [edx*4 + 0x4cc1d8]
xor eax, dword [ebx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4cc1d8]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4cc1d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4cc1d8]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4cc1d8]
dec edi
mov edx, eax
jne 0x404230
xor eax, eax
test esi, esi
je 0x4042cc
movzx ecx, byte [eax + ebx]
movzx edi, dl
xor ecx, edi
shr edx, 8
xor edx, dword [ecx*4 + 0x4cc1d8]
inc eax
cmp eax, esi
jb 0x4042b4
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x404b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [eax + 0x204]
push ebx
mov ebx, dword [eax + 0x20c]
push esi
mov esi, dword [eax + 0x208]
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + 1]
sub edi, ecx
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
sub edi, ecx
add edi, 2
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 8]
sub edi, ecx
mov dword [ebp - 4], ebx
mov ebx, dword [eax + 0x210]
add edi, 3
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp + 8], 4
nop
mov edi, dword [ebp - 0xc]
movzx edi, byte [edi + ecx]
xor edx, dword [edi*4 + 0x4cc1d8]
add ecx, 4
mov dword [eax + 0x204], edx
movzx edi, byte [ecx - 4]
xor esi, dword [edi*4 + 0x4cc1d8]
mov edi, dword [ebp - 0x10]
mov dword [eax + 0x208], esi
movzx ebx, byte [edi + ecx - 4]
mov edi, dword [ebp - 4]
xor edi, dword [ebx*4 + 0x4cc1d8]
mov dword [eax + 0x20c], edi
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0x14]
movzx ebx, byte [edi + ecx - 4]
mov edi, dword [ebp - 8]
xor edi, dword [ebx*4 + 0x4cc1d8]
dec dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [eax + 0x210], edi
jne 0x404bc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405430
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x4054d7
push ebx
nop
mov ecx, 0x1234
add word [eax + 0x214], cx
movzx ecx, word [eax + 0x214]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x4cc1d8]
xor word [eax + 0x216], dx
mov bx, word [eax + 0x21a]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x4cc1da]
sub word [eax + 0x218], dx
movzx edx, word [eax + 0x218]
xor edx, ecx
mov word [eax + 0x214], dx
mov edx, 1
mov ecx, edx
ror bx, cl
inc esi
xor bx, word [eax + 0x216]
ror bx, cl
movzx ecx, bx
xor word [eax + 0x214], cx
mov word [eax + 0x21a], cx
movzx ecx, word [eax + 0x214]
shr ecx, 8
xor byte [esi - 1], cl
dec edi
jne 0x405440
pop ebx
pop edi
pop esi
ret
Function at 0x4083f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49dbdb
mov eax, dword fs:[0]
push eax
mov eax, 0x24f4
call fcn.00494370
mov eax, dword [0x4c6184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
mov esi, edx
lea edi, [ebp - 0x18d8]
mov dword [ebp - 0x24fc], ebx
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xc90], eax
mov dword [ebp - 0xc60], eax
call fcn.00409a50
test al, al
je 0x4085ec
cmp byte [ebp - 0x18d8], 0
je 0x4085ec
cmp byte [ebp - 0xc30], 0
je 0x4085ec
call fcn.0040a8a0
push eax
lea ecx, [ebp - 0xc30]
call fcn.0040fb20
add esp, 4
test eax, eax
je 0x4085ec
mov edi, ebx
call fcn.0040a8a0
push eax
lea ecx, [ebp - 0xc30]
call fcn.0040fb20
add esp, 4
test eax, eax
jne 0x4085ec
xor ebx, ebx
mov eax, dword [ebp - 0x24fc]
push 0x3ff
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.00487470
add esp, 0xc
push ebx
push str.rtmp_d
lea edi, [ebp - 0x410]
mov byte [ebp - 0x11], 0
call fcn.0040a8a0
push eax
call fcn.00486f30
add esp, 0xc
xor esi, esi
call fcn.00409660
test al, al
je 0x4084f8
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x4084a9
xor esi, esi
lea edi, [ebp - 0x410]
call fcn.00409660
test al, al
jne 0x4085ec
mov edx, dword [ebp - 0x24fc]
push 0x3ff
push edx
lea eax, [ebp - 0x810]
push eax
call fcn.00487470
add esp, 0xc
lea edi, [ebp - 0x18d8]
mov byte [ebp - 0x411], 0
call fcn.0040a8a0
lea edi, [ebp - 0x810]
mov esi, eax
call fcn.0040a8a0
sub eax, esi
lea esp, [esp]
mov cl, byte [esi]
mov byte [eax + esi], cl
inc esi
test cl, cl
jne 0x408550
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4085ec
lea eax, [ebp - 0x24f8]
call fcn.00408610
mov edi, dword [ebp - 0x24fc]
xor esi, esi
mov dword [ebp - 4], 0
xor bl, bl
call fcn.00409660
test al, al
jne 0x4085ac
mov ebx, dword [ebp - 0x24fc]
xor edi, edi
lea esi, [ebp - 0x24f8]
call fcn.00408990
mov bl, al
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test bl, bl
je 0x4085d6
lea esi, [ebp - 0x24f8]
call fcn.00408ae0
mov eax, esi
call fcn.00408b60
lea ecx, [ebp - 0x24f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
mov al, 1
jmp 0x4085ee
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486a8b
mov esp, ebp
pop ebp
ret
Function at 0x408790
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4c6184]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0x16], 0
mov al, byte [ebp + 0xc]
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x120], ecx
mov dword [esi + 0xc18], 0
je 0x4087c7
mov al, 1
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x11c], VariantClear
je 0x4087e1
mov dword [ebp - 0x11c], 0xc0000000
push ebx
push edi
mov ebx, 1
test al, al
je 0x4087f1
mov ebx, 3
mov eax, dword [0x4c7898]
xor edx, edx
cmp byte [esi + 0x15], dl
setne dl
lea edi, [edx - 1]
and edi, 0x8000000
cmp eax, 0xffffffff
jne 0x408840
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x108]
mov dword [0x4d06a0], ecx
mov ecx, dword [ebp - 0x120]
mov dword [0x4c7898], eax
xor edx, edx
cmp eax, 2
setne dl
dec edx
test dword [0x4d06a0], edx
je 0x408873
test ecx, ecx
je 0x408873
cmp word [ecx], 0
je 0x408873
mov edx, dword [ebp - 0x11c]
push 0
push edi
push 3
push 0
push ebx
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x40888f
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x124]
push 0
push edi
push 3
push 0
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4088ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4088ab
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne bl
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
test bl, bl
je 0x40896d
mov ecx, dword [ebp - 0x120]
mov dword [esi + 4], edi
test ecx, ecx
je 0x4088f8
mov edx, esi
mov eax, ecx
sub edx, ecx
jmp 0x4088e0
movzx edi, word [eax]
mov word [edx + eax + 0x418], di
movzx edi, word [eax]
add eax, 2
test di, di
jne 0x4088e0
jmp 0x408901
xor eax, eax
mov word [esi + 0x418], ax
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x40891d
mov edx, esi
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax + 0x17], cl
inc eax
test cl, cl
jne 0x408910
jmp 0x408937
push 0
push 0
push 0x1000000
lea edx, [esi + 0x17]
push edx
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [esi + 4], 0xffffffff
je 0x40896d
xor eax, eax
nop
cmp dword [eax*4 + 0x4cc5d8], 0
je 0x408966
inc eax
cmp eax, 0x100
jb 0x408940
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486a8b
mov esp, ebp
pop ebp
ret 0xc
mov dword [eax*4 + 0x4cc5d8], esi
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00486a8b
mov esp, ebp
pop ebp
ret 0xc