joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039dd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x403a08
mov eax, dword [0x430880]
test eax, eax
je 0x4039fc
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x430880], 0
jmp 0x403a77
cmp dword [0x430880], 0
je 0x403a20
mov dword [esp], 0
call fcn.004083b9
push edx
jmp 0x403a77
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x452b00]
jbe 0x403a77
mov eax, dword [0x452b48]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403928
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x430880], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret

Function at 0x403a79
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403aba
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x407394
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x451380], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x451380
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x407410
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x407662
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x40768d
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x407694
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
mov edx, 0
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4076f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x1c]
mov esi, 0x65
sub esp, 0x2c
mov ebx, dword [ebp + 8]
dec esi
je 0x407747
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
add byte [ebp - 0x1a], dl
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x407704
mov eax, ebx
jmp 0x40774c
mov byte [ebx], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407756
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea edx, [ebp - 0x14]
sub esp, 0x34
cmp dword [ebp + 0x18], 1
mov ebx, dword [ebp + 0x14]
mov byte [ebx], 0
mov dword [esp + 0x10], edx
sbb eax, eax
mov dword [esp + 8], 0
xor al, al
add eax, 0x20119
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4077f8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2000
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4077e1
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x4077e4
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x1fff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407d7c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x44d380
mov dword [esp + 4], eax
call fcn.004078d2
push ebx
push ebx
mov dword [esp], 0x44d380
call fcn.00407551
test eax, eax
push esi
mov ebx, eax
jne 0x407db0
xor eax, eax
jmp 0x407e26
mov dword [esp], eax
call fcn.00407955
test byte [0x452b04], 0x80
push ecx
je 0x407dcc
mov al, byte [ebx]
cmp al, 0x5c
je 0x407dac
test al, al
je 0x407dac
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x44d380
mov dword [esp], 0x44d380
call esi
push ecx
cmp eax, ebx
mov dword [esp], 0x44d380
jle 0x407e0b
call fcn.00407d44
test eax, eax
push edx
je 0x407dfc
test byte [eax], 0x10
je 0x407dac
mov dword [esp], 0x44d380
call fcn.004074ea
push eax
jmp 0x407dd8
call fcn.00407910
push eax
mov dword [esp], 0x44d380
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
push edx
setne al
movzx eax, al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x408408
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x451404], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x408425
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x408453
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x40842e
mov dword [ecx*4 + 0x451400], eax
inc ecx
cmp ecx, 0x100
jne 0x408427
jmp 0x408419
cmp edx, ebx
je 0x40846c
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x451400]
jmp 0x408453
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
mov ecx, 0x2b0c1b92
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
mov ecx, 0x74e37fdc
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4f6dd6
Capabilities:
Encode data using xor

Disassembly:
add esp, dword [0x605a8878]
sbb byte gs:[ebp + 0x3f], 0x12
mov ebp, 0x19dc07c8
mul byte [edx - 0x2a]
invalid
Function at 0x658e1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662480
cmp edx, dword [eax]
je 0x658e3e
add eax, 8
inc ecx
cmp eax, 0x662510
jl 0x658e2f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662480]
jne 0x658f6c
mov eax, dword [0xa65cf0]
cmp eax, 1
je 0x658f46
test eax, eax
jne 0x658e6f
cmp dword [0x6602c4], 1
je 0x658f46
cmp edx, 0xfc
je 0x658f6c
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658ea6
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00659f80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a070
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658ee9
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a070
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65cc14
push edi
call fcn.0065aa30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00659f80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00659f90
lea eax, [ebp - 0xa0]
push 0x65cbf4
push eax
call fcn.00659f90
push dword [esi + 0x662484]
lea eax, [ebp - 0xa0]
push eax
call fcn.00659f90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065a9a2
add esp, 0x2c
pop edi
jmp 0x658f6c
lea eax, [ebp + 8]
lea esi, [esi + 0x662484]
push 0
push eax
push dword [esi]
call fcn.0065a070
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x97efc0]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov esi, dword [esp + 0x84]
push edi
mov edi, dword [esp + 0x84]
push 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
call fcn.00461cb0
push 0x461c70
push 0x461250
push 0
mov dword [esp + 0x28], eax
call fcn.004621c0
mov dword [esp + 0x2c], eax
lea eax, [ebp + 0x18]
push edi
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], esi
call fcn.004056d0
push dword [ebp + 0x178]
push str.inputs:__u_n
push edi
call fcn.00401010
push dword [ebp + 0x180]
push str.outputs:__u_n
push edi
call fcn.00401010
push dword [ebp + 0x17c]
push str.uniforms:__u_n
push edi
call fcn.00401010
mov eax, dword [ebp + 0x188]
add esp, 0x3c
test eax, eax
je 0x401e90
push eax
push str.scratch:__u_n
push edi
call fcn.00401010
add esp, 0xc
mov eax, dword [ebp + 0x190]
test eax, eax
je 0x401ea9
push eax
push str.constants:__u_n
push edi
call fcn.00401010
add esp, 0xc
mov edi, 0x12
push ebx
mov ebx, 1
mov dword [esp + 0x10], edi
nop dword [eax + eax]
cmp ebx, 0x8000
je 0x401f99
cmp ebx, 4
je 0x401f1b
cmp ebx, 8
je 0x401f1b
mov esi, dword [ebp + 4]
cmp dword [esi], 0
je 0x401f99
test esi, esi
je 0x401f99
nop word [eax + eax]
mov eax, dword [esi + 0x10]
and eax, ebx
test eax, 0x3ffff
je 0x401f0a
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00406830
add esp, 8
mov esi, dword [esi]
cmp dword [esi], 0
je 0x401f99
test esi, esi
jne 0x401ef0
jmp 0x401f99
xor edi, edi
nop dword [eax]
push 0x40
lea eax, [esp + 0x40]
push 0
push eax
call fcn.004f03f0
mov eax, dword [ebp + 4]
add esp, 0xc
cmp dword [eax], 0
je 0x401f6a
test eax, eax
je 0x401f6a
nop dword [eax]
mov ecx, dword [eax + 0x10]
and ecx, ebx
test ecx, 0x3ffff
je 0x401f5f
cmp dword [eax + 0x2c], edi
jne 0x401f5f
mov ecx, dword [eax + 0x14]
shr ecx, 3
and ecx, 3
mov dword [esp + ecx*4 + 0x3c], eax
mov eax, dword [eax]
cmp dword [eax], 0
je 0x401f6a
test eax, eax
jne 0x401f40
xor esi, esi
nop dword [eax]
mov eax, dword [esp + esi*4 + 0x3c]
test eax, eax
je 0x401f86
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00406830
add esp, 8
inc esi
cmp esi, 0x10
jb 0x401f70
inc edi
cmp edi, 0x80
jb 0x401f20
mov edi, dword [esp + 0x10]
rol ebx, 1
sub edi, 1
mov dword [esp + 0x10], edi
jne 0x401ec0
mov esi, dword [ebp + 0x168]
xor eax, eax
pop ebx
cmp dword [esi], eax
cmove esi, eax
test esi, esi
je 0x401fd9
nop word [eax + eax]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00403750
mov esi, dword [esi]
add esp, 8
cmp dword [esi], 0
je 0x401fd9
test esi, esi
jne 0x401fc0
push 0
push dword [esp + 0x1c]
call fcn.004614e0
push 0
push dword [esp + 0x28]
call fcn.00462250
mov ecx, dword [esp + 0x88]
add esp, 0x10
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004eec95
add esp, 0x70
ret
Function at 0x41e4a0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
shr ecx, 0xf
xor ecx, dword [esp + 4]
imul ecx, ecx, 0x85ebca77
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret

Function at 0x41e4d0
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [esp + 0xc]
and eax, 0xf
jmp dword [eax*4 + 0x41e718]
Function at 0x422c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
push ebp
push 0x1b6
push esi
call fcn.0041d800
push ebp
push 0x1b7
push esi
mov dword [esp + 0x54], eax
call fcn.0041d800
mov edi, dword [esp + 0x64]
mov ebx, eax
push edi
push 0x1b6
push esi
mov dword [esp + 0x68], ebx
call fcn.0041d800
push edi
push 0x1b7
push esi
mov dword [esp + 0x40], eax
call fcn.0041d800
movzx ecx, byte [ebp + 0x10]
push 0x20
push ecx
push dword [esi + 0x10]
mov dword [esp + 0x68], eax
call fcn.00409bc0
mov edi, eax
push edi
push esi
call fcn.0041dbe0
add esp, 0x44
lea eax, [edi + 0x18]
mov dword [esp + 0x14], eax
movzx eax, byte [ebp + 0x10]
push 0x20
push eax
push dword [esi + 0x10]
call fcn.00409bc0
mov edi, eax
push edi
push esi
call fcn.0041dbe0
push dword [esp + 0x24]
lea ebp, [edi + 0x18]
mov dword [esp + 0x4c], ebx
push ebx
push 0x19a
push esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x5c], ebp
call fcn.0041d850
push 0
push 0
push dword [esp + 0x58]
mov edi, eax
push esi
call fcn.00410940
push edi
push eax
push 0x125
push esi
call fcn.0041d850
add esp, 0x44
mov edi, eax
mov dword [esp + 0x1c], edi
push 1
push 0
push 0
call fcn.0040fcf0
push 1
push 1
push dword [esi + 0x10]
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], edx
call fcn.00409bc0
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x422d47
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x24]
push ebx
push esi
mov dword [ebx + 0x34], eax
call fcn.0041dbe0
add esp, 8
add ebx, 0x18
movzx eax, byte [edi + 0x10]
movzx eax, byte [eax + 0x42330b]
jmp dword [eax*4 + 0x4232ec]
Function at 0x426e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42755b]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x427544]
Function at 0x428dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x4294c3]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x4294ac]
Function at 0x42b6a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42bd93]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42bd7c]
Function at 0x42d5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42dc9f]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42dc88]
Function at 0x42f630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42fd23]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42fd0c]
Function at 0x431530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x431c1f]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x431c08]
Function at 0x433630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x433d4b]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x433d34]
Function at 0x435650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x435d5f]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x435d48]
Function at 0x440e20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 8
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x10]
push edi
cmp ecx, 0x10
je 0x440f2c
cmp ecx, 0x20
je 0x440ebb
mov edi, dword [esp + 0x18]
xor ecx, ecx
test edi, edi
je 0x441008
movsd xmm1, qword [0x533e70]
test eax, 0x4000
jne 0x440e7e
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
movsd xmm0, qword [eax + ecx*8]
xorps xmm0, xmm1
movsd qword [esi + ecx*8], xmm0
inc ecx
cmp ecx, edi
jb 0x440e64
pop edi
pop esi
add esp, 8
ret
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
movsd xmm0, qword [eax + ecx*8]
xorps xmm0, xmm1
movsd qword [esi + ecx*8], xmm0
mov edx, dword [esi + ecx*8 + 4]
test edx, 0x7ff00000
jne 0x440eb0
and edx, 0x80000000
mov dword [esi + ecx*8], 0
mov dword [esi + ecx*8 + 4], edx
inc ecx
cmp ecx, edi
jb 0x440e80
pop edi
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x18]
xor ecx, ecx
test edx, edx
je 0x441008
mov edi, dword [esp + 0x20]
movss xmm1, dword [0x533e80]
test eax, 0x2000
jne 0x440efa
nop dword [eax]
mov eax, dword [edi]
movss xmm0, dword [eax + ecx*8]
xorps xmm0, xmm1
movss dword [esi + ecx*8], xmm0
inc ecx
cmp ecx, edx
jb 0x440ee0
pop edi
pop esi
add esp, 8
ret
xor ecx, ecx
nop dword [eax]
mov eax, dword [edi]
movss xmm0, dword [eax + ecx*8]
xorps xmm0, xmm1
movss dword [esi + ecx*8], xmm0
mov eax, dword [esi + ecx*8]
test eax, 0x7f800000
jne 0x440f21
and eax, 0x80000000
mov dword [esi + ecx*8], eax
inc ecx
cmp ecx, edx
jb 0x440f00
pop edi
pop esi
add esp, 8
ret
xor edi, edi
cmp dword [esp + 0x18], edi
jbe 0x441008
mov ecx, eax
and ecx, 0x1000
mov dword [esp + 0x1c], ecx
test eax, 0x40000
jne 0x440fae
nop dword [eax + eax]
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
movzx eax, word [eax + edi*8]
push eax
call fcn.00460e30
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
xorps xmm0, xmmword [0x533e80]
movss dword [esp], xmm0
call fcn.00460d70
add esp, 4
mov word [esi + edi*8], ax
cmp dword [esp + 0x1c], 0
je 0x440fa1
mov ecx, eax
xor edx, edx
and ecx, 0x7c00
cmp dx, cx
jne 0x440fa1
and eax, 0x8000
mov word [esi + edi*8], ax
inc edi
cmp edi, dword [esp + 0x18]
jb 0x440f50
pop edi
pop esi
add esp, 8
ret
xor edi, edi
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
movzx eax, word [eax + edi*8]
push eax
call fcn.00460e30
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
xorps xmm0, xmmword [0x533e80]
movss dword [esp], xmm0
call fcn.00460d50
add esp, 4
mov word [esi + edi*8], ax
cmp dword [esp + 0x1c], 0
je 0x441001
mov ecx, eax
xor edx, edx
and ecx, 0x7c00
cmp dx, cx
jne 0x441001
and eax, 0x8000
mov word [esi + edi*8], ax
inc edi
cmp edi, dword [esp + 0x18]
jb 0x440fb0
pop edi
pop esi
add esp, 8
ret

Function at 0x44ce60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
movzx eax, byte [eax + 0x44cfc7]
push esi
push edi
jmp dword [eax*4 + 0x44cfb0]
Function at 0x460e80
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi]
push ebx
call fcn.004ff077
mov ebp, eax
add esp, 4
test ebp, ebp
jle 0x460eca
lea ecx, [ebp + 1]
push esi
push ecx
call fcn.004f7590
push 0
push 0
push ebx
mov esi, eax
call fcn.004fe9e5
push ebx
push ebp
push 1
push esi
call fcn.004fe5b9
mov byte [esi + ebp], 0
add esp, 0x20
mov eax, dword [edi + 4]
mov dword [eax], esi
mov eax, dword [edi + 8]
pop esi
mov dword [eax], ebp
lea eax, [edi + 0xc]
push eax
call fcn.004ff0a7
push ebx
call fcn.004f34f4
add esp, 8
pop edi
pop ebp
pop ebx
ret

Function at 0x460ee0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x97efc0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 8]
push eax
push 0x104
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x102
ja 0x460f93
push edi
lea edi, [esi + 0xc]
push edi
push 0
push 0x5396ac
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x460f79
push 0x5396b8
push edi
call fcn.004f35db
mov ecx, eax
add esp, 8
test ecx, ecx
setne al
test ecx, ecx
je 0x460f61
mov dword [esi], ecx
mov ecx, dword [esp + 0x11c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x120]
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004eec95
add esp, 0x108
ret
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004eec95
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.004eec95
add esp, 0x108
ret
Function at 0x464f00
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp byte [0x97fb98], 0
jne 0x464f2a
push 0x97fb98
push 0x464d70
push 0x97fb9c
call fcn.00464d10
add esp, 0xc
mov byte [0x97fb98], 1
push 0x97fba0
call fcn.0046ada0
add esp, 4
cmp byte [0x97fb94], 0
je 0x464f75
mov ecx, dword [0x9825f8]
mov eax, dword fs:[0x2c]
push 0x7fff
mov eax, dword [eax + ecx*4]
lea esi, [eax + 0x18]
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
xor ecx, ecx
cmp eax, 0x7ffd
cmova esi, ecx
jmp 0x465000
mov eax, dword [0x97fbb8]
test eax, eax
jne 0x464fac
push 0x461c70
push 0x461250
push eax
call fcn.004613a0
add esp, 0xc
mov dword [0x97fbb8], eax
test eax, eax
je 0x465000
push 0x464e20
call fcn.004eff2a
mov eax, dword [0x97fbb8]
add esp, 4
push edi
mov edi, dword [esp + 0xc]
push edi
push eax
call fcn.00461990
add esp, 8
test eax, eax
je 0x464fc4
mov esi, dword [eax + 8]
jmp 0x464fff
push ebx
push edi
push dword [0x97fbb8]
call fcn.004606d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x464ffe
push edi
call fcn.00464eb0
push eax
push dword [0x97fbb8]
call fcn.004606d0
mov esi, eax
push esi
push ebx
push dword [0x97fbb8]
call fcn.00461610
add esp, 0x18
pop ebx
pop edi
cmp byte [0x97fb98], 0
jne 0x465027
push 0x97fb98
push 0x464d70
push 0x97fb9c
call fcn.00464d10
add esp, 0xc
mov byte [0x97fb98], 1
push 0x97fba0
call fcn.0046adb0
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x465040
Capabilities:
Print debug messages

Disassembly:
cmp dword [0x97fb90], 0
jne 0x465058
push 2
call fcn.004f3264
add esp, 4
mov dword [0x97fb90], eax
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x4650a1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4650a1
push 1
call fcn.004f3264
push eax
call fcn.004f6d48
push dword [0x97fb90]
push esi
call fcn.004f70ef
push dword [0x97fb90]
call fcn.004f6d48
add esp, 0x14
pop esi
ret
push 2
call fcn.004f3264
mov ecx, dword [0x97fb90]
add esp, 4
cmp ecx, eax
je 0x4650ca
push ecx
push esi
call fcn.004f70ef
push dword [0x97fb90]
call fcn.004f6d48
add esp, 0xc
pop esi
ret