joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408167
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004033ee
and dword [ebp - 4], 0
cmp dword [0x4447ac], 0
mov ebx, eax
jne 0x408218
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4082c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4082c9
push eax
call fcn.0040337c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4447ac], eax
call esi
push eax
call fcn.0040337c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4447b0], eax
call esi
push eax
call fcn.0040337c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4447b4], eax
call esi
push eax
call fcn.0040337c
pop ecx
mov dword [0x4447bc], eax
test eax, eax
je 0x408218
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040337c
pop ecx
mov dword [0x4447b8], eax
mov eax, dword [0x4447b8]
cmp eax, ebx
je 0x408270
cmp dword [0x4447bc], ebx
je 0x408270
push eax
call fcn.004033f7
push dword [0x4447bc]
mov esi, eax
call fcn.004033f7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408270
test edi, edi
je 0x408270
call esi
test eax, eax
je 0x408267
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408267
test byte [ebp - 0xc], 1
jne 0x408270
or dword [ebp + 0x10], 0x200000
jmp 0x4082a9
mov eax, dword [0x4447b0]
cmp eax, ebx
je 0x4082a9
push eax
call fcn.004033f7
pop ecx
test eax, eax
je 0x4082a9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4082a9
mov eax, dword [0x4447b4]
cmp eax, ebx
je 0x4082a9
push eax
call fcn.004033f7
pop ecx
test eax, eax
je 0x4082a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4447ac]
call fcn.004033f7
pop ecx
test eax, eax
je 0x4082c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4082cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4388f0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x440004]
xor eax, esp
mov dword [esp + 0x410], eax
cmp edi, 0x182
jne 0x438926
push 0
push 0
push 0
push str.rijetinibahelohahuluru
push str.mifehiduwacirutadalorimadiwim
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x438950
cmp edi, 0x19f
jne 0x438950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
xor esi, esi
test edi, edi
jle 0x4389d2
jmp 0x438960
lea ecx, [esp + 0xc]
mov dword [esp + 4], 5
mov dword [esp + 0xc], 0
call fcn.004388e0
mov eax, dword [esp + 0xc]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
movsx eax, byte [ebx + esi]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
xor dword [esp + 8], eax
mov cl, byte [esp + 8]
mov byte [ebx + esi], cl
cmp edi, 0xf
jne 0x4389cd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x438960
pop esi
cmp edi, 0x2d
jne 0x4389ec
mov dword [0x2b429c8], 0xa62e7790
mov dword [0x2b429cc], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x4021db
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x4021fb
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x402204
cmp byte [ebx], 0
jne 0x40220b
xor eax, eax
jmp 0x40228b
xor esi, esi
jmp 0x40224e
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x402235
cmp dword [ebp - 4], 0
je 0x402235
test esi, esi
jne 0x402235
cmp dword [ebp + 8], 0
je 0x402231
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x40224e
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402243
cmp ecx, 0xa
jne 0x40224b
cmp ecx, 0xd
jne 0x402253
inc ebx
jmp 0x402253
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x40220f
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402289
mov eax, dword [ebp - 4]
test esi, esi
mov byte [eax], 0
je 0x402289
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.0040d94c
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4024bc
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.0040d8cc
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.0040d9a0
test eax, eax
jne 0x402553
push 0x4121ec
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.0040d8cc
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.0040d84c
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x40260e
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x41205c], 0
je 0x402685
cmp byte [0x4138c8], 0
je 0x402685
lea edx, [esp + 8]
mov eax, 0x4138c8
call fcn.004025dd
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402685
mov eax, ebx
call fcn.0040d8cc
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x4027f8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402960
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x412760
push 1
push 0
push 0x412770
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402a5f
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x4029c3
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4029d5
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.0040d94c
lea eax, [ebp - 0x40c]
call fcn.00405908
cmp byte [ebp - 0x40c], 0
je 0x402a06
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x412790
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402a56
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402a4d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402bd4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x412810]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x412021], 0
jne 0x402c30
mov eax, dword [0x413cc8]
call fcn.00403fc4
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x412099
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x412021], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
and dword [esp + 8], 0xbfffffff
mov byte [esp + 0x19], 0
test bl, bl
je 0x402c7c
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
jmp 0x402c87
and dword [esp + 8], 0xfffffffe
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x40000001
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x4120c0
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x403624
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov ebx, 0x4134c0
mov eax, 0x418044
call fcn.0040e0ec
call sub.KERNEL32.DLL_GetCommandLineA
mov esi, eax
test esi, esi
je 0x40365b
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x40365b
lea eax, [esi + 1]
mov edx, 0x22
call fcn.0040d8dc
mov esi, eax
test esi, esi
je 0x4036c7
mov edx, 0x4120f6
mov eax, esi
call fcn.0040d920
mov esi, eax
test eax, eax
je 0x40367a
mov eax, ebx
mov edx, esi
call fcn.0040d94c
xor ecx, ecx
xor eax, eax
jmp 0x4036b9
and edx, 0xff
cmp edx, 0x20
je 0x40368d
mov cl, 1
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
je 0x40369c
cmp edx, 0x2f
jne 0x4036b8
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x4036ac
cmp edx, 0x53
jne 0x4036b8
mov dword [0x412058], 1
jmp 0x4036c0
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x403680
test cl, cl
jne 0x4036c7
mov byte [ebx], 0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x64
mov dword [0x41802c], ebx
mov dword [0x418028], ebx
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x4138c0], eax
push 0x65
push dword [0x418028]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x4138c4], eax
mov eax, esp
call fcn.00404f4c
push 0x400
push 0x4130c0
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edx, 0x4130c0
mov eax, 0x418030
call fcn.00404734
lea eax, [esp + 8]
call fcn.00403e7c
lea eax, [esp + 0x20]
call fcn.00403e7c
lea edx, [esp + 8]
mov dword [0x413cc8], edx
lea ecx, [esp + 0x20]
mov dword [0x413ccc], ecx
call fcn.0040100c
cmp dword [0x412054], 0
jle 0x403760
mov eax, dword [0x412048]
call fcn.0040d7d0
push dword [0x4138c0]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [0x4138c4]
test eax, eax
je 0x40377a
push eax
call sub.GDI32.DLL_DeleteObject
lea eax, [esp + 0x20]
mov edx, 2
call fcn.00403e9c
lea eax, [esp + 8]
mov edx, 2
call fcn.00403e9c
mov eax, esp
mov edx, 2
call fcn.00404fc8
cmp dword [0x41801c], 0
jne 0x4037c3
cmp dword [0x412818], 0
je 0x4037c3
mov eax, 0x41801c
mov edx, 0xff
call fcn.0040b458
mov dword [0x412818], 2
push dword [0x41801c]
call sub.KERNEL32.DLL_ExitProcess
add esp, 0x38
pop esi
pop ebx
ret
Function at 0x403ec4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x403ee5
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00403fd8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x403f2b
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x403f7c
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x403fba
mov eax, dword [ebx + 4]
test eax, eax
je 0x403f94
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.00404364
mov ebx, eax
test ebx, ebx
je 0x403fba
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.0040d7d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4041a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x40420a
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x40421b
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x40420a
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x4041c2
cmp dword [esp], 0
je 0x4041c2
xor ebx, ebx
cmp dword [esp], 0
je 0x404265
lea eax, [esp + 4]
push eax
push 0x4127a0
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404265
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x40425b
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x404c04
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00404e00
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x44]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
inc eax
sub eax, dword [ebp - 0x38]
test bl, bl
mov dword [ebp - 0x18], eax
je 0x404c9b
cmp byte [ebp + 8], 0
jne 0x404c9b
mov eax, dword [ebp - 0x3c]
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x10]
cdq
mov edi, 0x64
idiv edi
add ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x404cd9
push 0x400
lea eax, [ebp - 0x444]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x444]
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 4]
call fcn.00404a88
lea edx, [ebp - 0x444]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x18], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov edi, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
jmp 0x404de7
push 0x400
lea eax, [ebp - 0x844]
push eax
push edi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x844], 0
je 0x404d38
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x844]
lea edx, [ebp - 0x844]
mov eax, dword [ebp - 4]
call fcn.00404a88
lea edx, [ebp - 0x844]
push edx
push edi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x404dd7
lea ecx, [ebp - 0x854]
push ecx
push edi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x404d60
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x854]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x850]
inc eax
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ecx
push 0
push edi
call sub.USER32.DLL_SetWindowPos
push 2
push edi
call sub.USER32.DLL_GetWindow
mov edi, eax
cmp edi, dword [ebp - 0x1c]
je 0x404df7
inc esi
test edi, edi
je 0x404df7
cmp esi, 0x200
jl 0x404cf7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405d08
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.00404ea4
test eax, eax
je 0x405d2e
test ebx, ebx
je 0x405d2e
cmp word [ebx], 0
je 0x405d2e
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x405d36
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x405d49
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00405f2c
xor eax, eax
jmp 0x405d64
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x405d58
cmp eax, 3
jne 0x405d5f
mov eax, 2
jmp 0x405d64
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x405ecc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00404ea4
test eax, eax
je 0x405ef7
test ebx, ebx
je 0x405ef7
cmp word [ebx], 0
je 0x405ef7
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x405f2c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.00404ea4
test eax, eax
je 0x405f59
test ebx, ebx
je 0x405f59
cmp word [ebx], 0
je 0x405f59
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x405f68
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x4077c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x4140d8
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne 0x4077da
call fcn.00407788
mov eax, ebp
cmp edi, 8
jb 0x407865
xor ebx, dword [eax]
xor edx, edx
mov dl, bl
sub edi, 8
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
xor ebx, dword [eax + 4]
add eax, 8
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x4077e5
xor edx, edx
jmp 0x40787f
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp edi, edx
ja 0x407869
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x407e47
test esi, esi
jg 0x407e4e
xor eax, eax
jmp 0x407f00
mov edx, dword [ebp - 4]
add edx, 4
lea eax, [ebp - 0x2c]
mov ecx, 0x10
call fcn.0040d860
test esi, esi
jns 0x407e68
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x407ee7
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004081bc
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [eax]
xor dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 4]
xor dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
xor dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp - 0x10], eax
mov eax, edx
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jg 0x407e7a
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 0x10
call fcn.0040d860
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408124
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x416d9a]
lea ebx, [ebx*4 + 0x41699a]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x41719a]
lea edx, [edx*4 + 0x41759a]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x408136
inc eax
cmp eax, 4
jl 0x408134
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.0040d860
inc esi
cmp esi, 0xa
jl 0x408132
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4093dc
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret