joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e24
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x760]
add eax, 1
mov dword [ebp - 0x760], eax
mov ecx, dword [ebp - 0x75c]
mov edx, dword [ebp - 0x760]
cmp edx, dword [ecx + 0x18]
jae 0x408e5e
mov eax, dword [ebp - 0x760]
mov ecx, dword [ebp - 0x1978]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x764], edx
mov eax, dword [ebp - 0x760]
mov ecx, dword [ebp - 0x197c]
movzx edx, word [ecx + eax*2]
adc al, 0x41
mov eax, dword [ebp - 0x1980]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1d08], ecx
mov dword [ebp - 0x1c8], 0
jmp 0x408cc2
mov edx, dword [ebp - 0x1c8]
add edx, 1
mov dword [ebp - 0x1c8], edx
mov eax, dword [ebp - 0x764]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x408d74
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x89c]
test eax, eax
je 0x408d74
push esi
xor esi, 0xe40
jmp 0x408cfe
pop esi
push esi
and esi, 0x15445
pop esi
push edx
push esi
add esp, 4
or edx, 0x7b6
and edx, 0x1317
pop edx
push edi
sub edi, 0xf4d5
pop edi
mov ecx, dword [ebp - 0x764]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x89c]
cmp edx, ecx
je 0x408d66
mov edx, dword [ebp - 0x764]
add edx, dword [ebp - 0x1c8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1c8]
movsx edx, byte [ebp + ecx - 0x89c]
cmp eax, edx
jne 0x408d6d
jmp 0x408cb3
jmp 0x408d74
push ebx
jmp 0x408d7d
pop ebx
push edx
push ebx
add esp, 4
sub edx, 0x181c8
sub edx, 0x15269
and edx, 0x2ead
call 0x408da2
add byte [ebx + 0x32], cl
dec eax
inc ebp
inc esp
inc esp
push eax
add esp, 4
pop edx
mov eax, dword [ebp - 0x764]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x89c]
cmp ecx, eax
jne 0x408dd3
mov dword [ebp - 0xcb8], 0
jmp 0x408e42
push ebx
xor ebx, 0x15459
sub ebx, 0x10a27
sub ebx, 0xff13
sub ebx, 0x17440
pop ebx
push ebx
push eax
add esp, 4
add ebx, 0x2350
pop ebx
push edx
push esi
add esp, 4
sub edx, 0x158f5
pop edx
mov ecx, dword [ebp - 0x764]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x89c]
inc dword [ebx - 0x2ec4df37]
jge 0x408e38
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x408e42
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x408e59
mov edx, dword [ebp - 0x1d08]
mov dword [ebp - 0x3e0], edx
jmp 0x408e6a
jmp 0x408c43
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x3e0], eax
Function at 0x408ee3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov edx, dword [ebp - 0x1984]
mov dword [ebp - 0x1988], edx
lea eax, [ebp - 0x173c]
push eax
call dword [ebp - 0x1988]
test eax, eax
jne 0x408f45
push eax
push esi
add esp, 4
xor eax, 0x8107
pop eax
push ebx
push ecx
add esp, 4
sub ebx, 0xfeb7
jmp 0x408f20
pop ebx
push edi
xor edi, 0x619b
xor edi, 0xe1ce
jmp 0x408f35
pop edi
mov dword [ebp - 0x7a4], 0
jmp 0x409630

Function at 0x408f5c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
enter 0x3be3, 0
add byte [ecx + 0xd037f0], al
add byte [eax + 0x51], bl
les eax, [ecx + eax*4]
loope 0x408f4d
inc byte [eax]
add byte [ecx + 0x5885e1], al
add byte [ecx + 0xdc9ee9], al
add byte [ecx + 0x9f23c9], al
add byte [ecx + 0x64], bl
mov ecx, dword [0x18]
Function at 0x409554
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x770]
add eax, 1
mov dword [ebp - 0x770], eax
mov ecx, dword [ebp - 0x76c]
mov edx, dword [ebp - 0x770]
cmp edx, dword [ecx + 0x18]
jae 0x409618
mov eax, dword [ebp - 0x770]
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x774], edx
mov eax, dword [ebp - 0x770]
mov ecx, dword [ebp - 0x1998]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x199c]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19a0], ecx
mov dword [ebp - 0x1cc], 0
jmp 0x40947c
mov edx, dword [ebp - 0x1cc]
add edx, 1
mov dword [ebp - 0x1cc], edx
mov eax, dword [ebp - 0x774]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40952e
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x880]
test eax, eax
je 0x40952e
push edi
push ebx
add esp, 4
and edi, 0xf1de
and edi, 0xe07d
pop edi
push edi
push edi
add esp, 4
xor edi, 0x1071b
or edi, 0xcc04
and edi, 0xba5c
jmp 0x4094da
pop edi
mov ecx, dword [ebp - 0x774]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x880]
cmp edx, ecx
je 0x409520
mov edx, dword [ebp - 0x774]
add edx, dword [ebp - 0x1cc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1cc]
movsx edx, byte [ebp + ecx - 0x880]
cmp eax, edx
jne 0x409527
jmp 0x40946d
jmp 0x40952e
push ecx
push eax
add esp, 4
sub ecx, 0xa427
or ecx, 0x5efb
pop ecx
push ecx
push eax
add esp, 4
and ecx, 0x4600
pop ecx
push ebx
or ebx, 0x10895
pop ebx
push edx
push ebx
add esp, 4
and edx, 0x2549
pop edx
mov eax, dword [ebp - 0x774]
add eax, dword [ebp - 0x1cc]
xor al, 0xfe
invalid
dec dword [edi]
mov esi, 0x34958b08
invalid
invalid
dec dword [edi]
mov esi, 0xf7801584
adc eax, 0xfffff780
cmp ecx, eax
jne 0x40958d
mov dword [ebp - 0xcc8], 0
jmp 0x4095fc
push ebx
push edi
add esp, 4
les eax, [ecx + eax*4]
jecxz 0x40960e
add byte [eax], 0
cmp dword [ebp - 0xcc8], 0
jne 0x409613
mov edx, dword [ebp - 0x19a0]
mov dword [ebp - 0x50c], edx
jmp 0x409624
jmp 0x4093fd
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x7a4], ecx
Function at 0x409958
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ebx, 0x157ea
xor ebx, 0x90c5
pop ebx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x104e]
mov word [ebp - 0x238], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1050], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1050]
mov word [ebp - 0x4c], ax
push ebx
add ebx, 0x12d0
add ebx, 0x5829
pop ebx
push esi
push esi
add esp, 4
or esi, 0xacf6
and esi, 0x3ac7
pop esi
push edi
push ebx
add esp, 4
and edi, 0xf4be
sub edi, 0x7c12
pop edi
movzx ecx, word [ebp - 0x4c]
test ecx, ecx
jne 0x409a0b
movzx edx, word [ebp - 0x238]
movzx eax, word [ebp - 0x4c]
sub edx, eax
mov dword [ebp - 0x1618], edx
jmp 0x409a65
movzx ecx, word [ebp - 0x238]
movzx edx, word [ebp - 0x4c]
cmp ecx, edx
je 0x409933
movzx eax, word [ebp - 0x238]
xor eax, 0x20
movzx ecx, word [ebp - 0x4c]
cmp eax, ecx
je 0x409933
movzx edx, word [ebp - 0x238]
movzx eax, word [ebp - 0x4c]
cmp edx, eax
jge 0x409a4f
mov dword [ebp - 0x1614], 0xffffffff
jmp 0x409a59
mov dword [ebp - 0x1614], 1
mov ecx, dword [ebp - 0x1614]
mov dword [ebp - 0x1618], ecx
cmp dword [ebp - 0x1618], 0
jne 0x409aae
push edx
push esi
add esp, 4
sub edx, 0xcf09
pop edx
push ecx
xor ecx, 0x9d90
xor ecx, 0x14a48
call 0x409a96
add byte [ebx + 0x45], al
inc eax
dec ecx
inc edi
cmp dh, byte [ecx + ecx*2]
inc esi
add esp, 4
sub ecx, 0xfbed
pop ecx
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x409b16
push edi
push ebx
add esp, 4
and edi, 0x12ce7
sub edi, 0xd746
xor edi, 0x647c
pop edi
push ecx
push edi
add esp, 4
jmp 0x409ad0
or ecx, 0x44a7
jmp 0x409adf
pop ecx
mov eax, dword [ebp - 0x510]
mov ecx, dword [eax]
mov dword [ebp - 0x510], ecx
mov edx, dword [ebp - 0x510]
cmp edx, dword [ebp - 0xcd4]
je 0x409b0c
mov eax, dword [ebp - 0x510]
cmp dword [eax + 0x30], 0
jne 0x4098d7
mov dword [ebp - 0x300], 0
Function at 0x409a96
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ebx, 0x157ea
xor ebx, 0x90c5
pop ebx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x104e]
mov word [ebp - 0x238], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1050], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1050]
mov word [ebp - 0x4c], ax
push ebx
add ebx, 0x12d0
add ebx, 0x5829
pop ebx
push esi
push esi
add esp, 4
or esi, 0xacf6
and esi, 0x3ac7
pop esi
push edi
push ebx
add esp, 4
and edi, 0xf4be
sub edi, 0x7c12
pop edi
movzx ecx, word [ebp - 0x4c]
test ecx, ecx
jne 0x409a0b
movzx edx, word [ebp - 0x238]
movzx eax, word [ebp - 0x4c]
sub edx, eax
mov dword [ebp - 0x1618], edx
jmp 0x409a65
movzx ecx, word [ebp - 0x238]
movzx edx, word [ebp - 0x4c]
cmp ecx, edx
je 0x409933
movzx eax, word [ebp - 0x238]
xor eax, 0x20
movzx ecx, word [ebp - 0x4c]
cmp eax, ecx
je 0x409933
movzx edx, word [ebp - 0x238]
movzx eax, word [ebp - 0x4c]
cmp edx, eax
jge 0x409a4f
mov dword [ebp - 0x1614], 0xffffffff
jmp 0x409a59
mov dword [ebp - 0x1614], 1
mov ecx, dword [ebp - 0x1614]
mov dword [ebp - 0x1618], ecx
cmp dword [ebp - 0x1618], 0
jne 0x409aae
push edx
push esi
add esp, 4
sub edx, 0xcf09
pop edx
push ecx
xor ecx, 0x9d90
xor ecx, 0x14a48
call 0x409a96
add byte [ebx + 0x45], al
inc eax
dec ecx
inc edi
cmp dh, byte [ecx + ecx*2]
inc esi
add esp, 4
sub ecx, 0xfbed
pop ecx
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x409b16
push edi
push ebx
add esp, 4
and edi, 0x12ce7
sub edi, 0xd746
xor edi, 0x647c
pop edi
push ecx
push edi
add esp, 4
jmp 0x409ad0
or ecx, 0x44a7
jmp 0x409adf
pop ecx
mov eax, dword [ebp - 0x510]
mov ecx, dword [eax]
mov dword [ebp - 0x510], ecx
mov edx, dword [ebp - 0x510]
cmp edx, dword [ebp - 0xcd4]
je 0x409b0c
mov eax, dword [ebp - 0x510]
cmp dword [eax + 0x30], 0
jne 0x4098d7
mov dword [ebp - 0x300], 0
Function at 0x409c0c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edi], dh
cmp dword [edx], edi
xor esi, dword [esi]
inc ebx
xor eax, 0xc4834944
add al, 0x81
mul ch
pushal
add byte [eax], al
pop esi
mov byte [ebp - 0x8ac], 0x4c
mov byte [ebp - 0x8ab], 0x6f
invalid
invalid

Function at 0x409c16
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edi], dh
cmp dword [edx], edi
xor esi, dword [esi]
inc ebx
xor eax, 0xc4834944
add al, 0x81
mul ch
pushal
add byte [eax], al
pop esi
mov byte [ebp - 0x8ac], 0x4c
mov byte [ebp - 0x8ab], 0x6f
invalid
invalid

Function at 0x409d24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and ecx, 0x13bf7
and ecx, 0x43a4
pop ecx
cmp dword [ebp - 0xce0], 0
jne 0x409d49
mov dword [ebp - 0x77c], 0
jmp 0x409f94
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x514], eax

Function at 0x409d68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
add esp, 4
or ecx, 0x12baa
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x109e9
pop ecx
push ecx
and ecx, 0x55f3
pop ecx
lea ecx, [ebp - 0x1794]
mov dword [ebp - 0xcdc], ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcd8], eax
xor ecx, ecx

Function at 0x409da4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push edi
add esp, 4
and edx, 0x11e7d
and edx, 0x10a97
pop edx
push ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push edi
push ebx
add esp, 4
les eax, [ecx + eax*4]
not esp
daa
add byte [eax], al
sub edi, 0xcfcb
pop edi
push edx
add edx, 0xad13
call 0x409dd9
add byte [ebx], dh
aaa
aaa
inc esi
dec edi
push eax
dec ebx
dec esp
dec ebx
add esp, 4
and edx, 0x137ed
pop edx
mov eax, dword [ebp - 0xcd8]
mov cx, word [eax]
mov word [ebp - 0x1052], cx
mov edx, dword [ebp - 0xcd8]
add edx, 2
mov dword [ebp - 0xcd8], edx
mov ax, word [ebp - 0x1052]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xcdc]
mov dx, word [ecx]
mov word [ebp - 0x1054], dx
mov eax, dword [ebp - 0xcdc]
add eax, 2
mov dword [ebp - 0xcdc], eax
mov cx, word [ebp - 0x1054]
mov word [ebp - 0x50], cx
push ecx
push edi
add esp, 4
add ecx, 0x1ded
and ecx, 0xe31
xor ecx, 0x5b11
pop ecx
push esi
add esi, 0x4624
sub esi, 0x15cb6
pop esi
push ecx
push ecx
add esp, 4
xor ecx, 0xc8b9
pop ecx
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x409e89
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1624], eax
jmp 0x409ee3
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x409db1
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x409db1
invalid
mov bh, 0x85
invalid
std
invalid
Function at 0x409db4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push edi
add esp, 4
and edx, 0x11e7d
and edx, 0x10a97
pop edx
push ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push edi
push ebx
add esp, 4
les eax, [ecx + eax*4]
not esp
daa
add byte [eax], al
sub edi, 0xcfcb
pop edi
push edx
add edx, 0xad13
call 0x409dd9
add byte [ebx], dh
aaa
aaa
inc esi
dec edi
push eax
dec ebx
dec esp
dec ebx
add esp, 4
and edx, 0x137ed
pop edx
mov eax, dword [ebp - 0xcd8]
mov cx, word [eax]
mov word [ebp - 0x1052], cx
mov edx, dword [ebp - 0xcd8]
add edx, 2
mov dword [ebp - 0xcd8], edx
mov ax, word [ebp - 0x1052]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xcdc]
mov dx, word [ecx]
mov word [ebp - 0x1054], dx
mov eax, dword [ebp - 0xcdc]
add eax, 2
mov dword [ebp - 0xcdc], eax
mov cx, word [ebp - 0x1054]
mov word [ebp - 0x50], cx
push ecx
push edi
add esp, 4
add ecx, 0x1ded
and ecx, 0xe31
xor ecx, 0x5b11
pop ecx
push esi
add esi, 0x4624
sub esi, 0x15cb6
pop esi
push ecx
push ecx
add esp, 4
xor ecx, 0xc8b9
pop ecx
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x409e89
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1624], eax
jmp 0x409ee3
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x409db1
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x409db1
invalid
mov bh, 0x85
invalid
std
invalid

Function at 0x409dd9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push edi
add esp, 4
and edx, 0x11e7d
and edx, 0x10a97
pop edx
push ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push edi
push ebx
add esp, 4
les eax, [ecx + eax*4]
not esp
daa
add byte [eax], al
sub edi, 0xcfcb
pop edi
push edx
add edx, 0xad13
call 0x409dd9
add byte [ebx], dh
aaa
aaa
inc esi
dec edi
push eax
dec ebx
dec esp
dec ebx
add esp, 4
and edx, 0x137ed
pop edx
mov eax, dword [ebp - 0xcd8]
mov cx, word [eax]
mov word [ebp - 0x1052], cx
mov edx, dword [ebp - 0xcd8]
add edx, 2
mov dword [ebp - 0xcd8], edx
mov ax, word [ebp - 0x1052]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xcdc]
mov dx, word [ecx]
mov word [ebp - 0x1054], dx
mov eax, dword [ebp - 0xcdc]
add eax, 2
mov dword [ebp - 0xcdc], eax
mov cx, word [ebp - 0x1054]
mov word [ebp - 0x50], cx
push ecx
push edi
add esp, 4
add ecx, 0x1ded
and ecx, 0xe31
xor ecx, 0x5b11
pop ecx
push esi
add esi, 0x4624
sub esi, 0x15cb6
pop esi
push ecx
push ecx
add esp, 4
xor ecx, 0xc8b9
pop ecx
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x409e89
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1624], eax
jmp 0x409ee3
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x409db1
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x409db1
invalid
mov bh, 0x85
invalid
std
invalid
Function at 0x419e70
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x530000f7
mov dword [esi + 0xf71e], 0x1f86c777

Function at 0x42459c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x4245b8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4245ba
shr eax, 1
dec edx
jne 0x4245ab
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4245a4
pop esi
ret

Function at 0x4245d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x4245fa
call fcn.0042459c
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x424624
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424600
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x467434
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46743c
mov eax, edx
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40288e
pop dword [ebp - 8]
mov eax, 0x40288e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xcef7fd1e
add dword [ebp - 0x18], 0x7f5a482d
mov dword [ebp - 0x14], 0xee32ea95
sub dword [ebp - 0x14], 0xbbff9e50
mov dword [ebp - 0x10], 0xf04ce2b
sub dword [ebp - 0x10], 0xc2b889fd
mov dword [ebp - 0xc], 0x519e1bd0
add dword [ebp - 0xc], 0xae61e430
lea eax, [ebp - 0x18]
push eax
mov eax, 0x4162e363
add eax, 0xbedd9d29
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x2d927d94
add dword [ebp - 0x18], 0x46dfebc2
mov dword [ebp - 0x14], 0xb6612326
sub dword [ebp - 0x14], 0x74f4c1b1
mov dword [ebp - 0x10], 0x13b9bff6
add dword [ebp - 0x10], 0x4fb5ac76
mov dword [ebp - 0xc], 0x34f6d8b
add dword [ebp - 0xc], 0xfcb09275
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xb2d93489
add eax, 0x4d674c4b
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3710e
push 0
call eax
mov ecx, 0x49e1
mov edx, eax
mov edi, 0x411000
add edi, dword [ebp - 8]
mov esi, 0xc7382afa
add esi, 0x1ad74ac5
sub dword [ebp - 4], 0xa5d2255d
mov ebx, dword [edi]
sub dword [ebp - 4], edi
add ebx, esi
add dword [ebp - 4], ebx
mov dword [edx], ebx
xor dword [ebp - 4], ebx
add edx, 4
add edi, 0x57dd4a17
sub edi, 0x57dd4a13
loop 0x40299f
add eax, 0x11a57
mov ebx, eax
add eax, 5
mov ecx, 0xe2bdd17b
add ecx, 0x1d822e85
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40288e
pop dword [ebp - 0x3c]
mov eax, 0xd279f06f
sub eax, 0xd239c7e1
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x836d7f12
add dword [ebp - 0x4c], 0xcae4c639
mov dword [ebp - 0x48], 0x1c7e8c91
sub dword [ebp - 0x48], 0xea4b404c
mov dword [ebp - 0x44], 0xabd9a9b5
add dword [ebp - 0x44], 0xa0729a79
mov dword [ebp - 0x40], 0xd1711662
sub dword [ebp - 0x40], 0xd1711662
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x51449d73
sub dword [ebp - 0x4c], 0xdcd2341d
mov dword [ebp - 0x48], 0xe062a9de
add dword [ebp - 0x48], 0x6109b797
mov dword [ebp - 0x44], 0xf4d6c8ba
sub dword [ebp - 0x44], 0x91675c4e
mov dword [ebp - 0x40], 0xc8feb4fc
sub dword [ebp - 0x40], 0xc8feb4fc
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x6fe63d5b
add eax, 0x905a334d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5b2
push 0
call eax
mov ecx, 0xbec949bb
add ecx, 0x4137114f
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x3c]
mov ebx, 0xb0eff1b7
add ebx, 0x4f80e394
add dword [ebp - 0x14], eax
mov edx, dword [esi]
sub dword [ebp - 0x10], esi
add edx, ebx
xor dword [ebp - 0x20], esi
mov dword [edi], edx
xor dword [ebp - 4], 0x281e0282
add edi, 4
add esi, 0x31b90762
add esi, 0xce46f8a2
loop 0x4029a7
add eax, 0xe40bc37c
add eax, 0x1bf59b7f
xor ebx, ebx
add ebx, eax
add eax, 0x7b3e5c37
add eax, 0x84c1a3ce
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret