joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10010cd0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10010c8c
cmp dword [ebp - 4], 0x50000000
jb 0x10010c0c
cmp dword [ebp - 4], 0x80000000
ja 0x10010c0c
mov dword [ebp - 4], 0x80010000
jmp 0x10010be5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10010c32
jmp 0x10010c8c
cmp dword [ebp - 0x14], 0x10000
jne 0x10010c75
cmp dword [ebp - 0x18], 0x10000
jb 0x10010c75
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10010c68
mov eax, dword [ebp - 8]
jmp 0x10010c8e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10010c87
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10010cd0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10010be5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10011400
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10011415
xor eax, eax
jmp 0x1001148a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10011442
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10011485
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10011483
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1001147f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10011483
xor eax, eax
jmp 0x1001148a
jmp 0x10011439
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10011650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10123ce0]
mov dword [ebp - 4], eax
jmp 0x10011669
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10011686
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10011660
mov esp, ebp
pop ebp
ret
Function at 0x10011ad0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10123cf0], eax
je 0x10011aee
mov eax, 0x10dd
jmp 0x10011bcf
mov eax, dword [0x10123d00]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10011b6c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10011b4a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10011b4a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10011170
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10011af6
mov dword [0x10123d00], 0
call fcn.10011490
mov ecx, dword [0x10123cfc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10011bb9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10011b84
mov dword [0x10123cfc], 0
mov dword [0x10123cf0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100120c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10123cf4], 0
je 0x100120d9
mov eax, dword [0x10123cf4]
jmp 0x10012179
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x100120eb
xor eax, eax
jmp 0x10012179
push 8
call fcn.10012bfa
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10012141
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1001212a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10123cf4], eax
mov dword [0x10123cf8], 0
mov eax, dword [ebp - 8]
jmp 0x10012179
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1001215b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1001210b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10123cfc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10123cfc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10012ae6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e018]
jne 0x10012af0
repz ret
jmp fcn.10013029
Function at 0x40168e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4314a8]
test eax, eax
je 0x4016a9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
push 0x33
mov esi, str._n_nThis_file_appears_to_be_corrupted._Please_try_downloading_it_again._If_the_problem_persists_then_please_contact_Reflexive_Entertainment_for_assistance__see_www.reflexivearcade.com_for_contact_details_.
pop ecx
lea edi, [ebp - 0xcc]
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
call fcn.0041d340
mov esi, eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0041d340
lea eax, [esi + eax + 1]
push eax
call fcn.0041d330
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0041d240
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.0041d250
add esp, 0x1c
push 0
push str.Error
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0041cd80
pop ecx
pop edi
pop esi
leave
ret

Function at 0x401978
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp dword [ebp + 8], 0
je 0x40199f
push str._nPress_Return_to_continue
call fcn.0041d507
lea eax, [ebp - 0x400]
push eax
call fcn.0041d4bd
pop ecx
pop ecx
push dword [ebp + 8]
call fcn.0041d3e8
Function at 0x402ac5
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x431460
jmp 0x402ab9
mov eax, 0x427219
call fcn.0041d214
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
call fcn.00404b30
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
call fcn.00404b30
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.00404b30
or dword [esi + 8], 0xffffffff
mov edi, 0x4314c4
push edi
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.00406830
or dword [esi + 0x10], 0xffffffff
push edi
lea ecx, [esi + 0x14]
call fcn.00406830
fldz
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], 0xbb8
fstp dword [esi + 0x50]
fldz
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
fstp dword [esi + 0x54]
fldz
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 5
fstp dword [esi + 0x58]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0xffffff
mov byte [esi + 0x34], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x1e0
mov dword [esi + 0x44], 0x168
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x5c], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x402f6b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x42726f
call fcn.0041d214
sub esp, 0x114
push ebx
xor ebx, ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
call fcn.00404b30
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 0x20019
push ebx
inc esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402fec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x120]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402fe3
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.00406830
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00404b80
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00404dc0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406e10
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x454
push edi
push eax
lea ecx, [esp + 0x5c]
push str.__s_
push ecx
call fcn.0041eaaf
mov eax, dword [esp + 0x46c]
add esp, 0xc
test eax, eax
je 0x406e5a
push eax
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0x5c]
push 0x42b83c
push edx
call fcn.0041eaaf
add esp, 0xc
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x44
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x464]
mov eax, 1
cmp ecx, eax
mov word [esp + 0x44], ax
mov dword [esp + 0x40], eax
pop edi
jne 0x406e90
mov word [esp + 0x40], 0
mov edx, dword [esp + 0x468]
lea eax, [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x464]
test eax, eax
setne al
test ecx, ecx
je 0x406ecf
mov edx, dword [esp]
mov dword [ecx], edx
add esp, 0x454
ret

Function at 0x407560
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push ecx
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
jne 0x4075b9
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4075aa
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x4075fd
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4075fd
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
mov eax, dword [esp + 0x20]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4075f2
mov bl, 1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x407610
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x14]
push eax
push esi
push 0x80000002
xor bl, bl
call edi
test eax, eax
mov ebp, dword [esp + 0x18]
jne 0x407661
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x407652
mov bl, 1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x407699
lea ecx, [esp + 0x14]
push ecx
push esi
push 0x80000001
call edi
test eax, eax
jne 0x407699
push 4
lea edx, [esp + 0x20]
push edx
push 4
push eax
mov eax, dword [esp + 0x24]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40768e
mov bl, 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret

Function at 0x4076a0
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x14]
push eax
push esi
push 0x80000002
xor bl, bl
call edi
test eax, eax
mov ebp, dword [esp + 0x18]
jne 0x4076f1
mov edx, dword [esp + 0x14]
push 8
lea ecx, [esp + 0x20]
push ecx
push 3
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4076e2
mov bl, 1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x407729
lea ecx, [esp + 0x14]
push ecx
push esi
push 0x80000001
call edi
test eax, eax
jne 0x407729
push 8
lea edx, [esp + 0x20]
push edx
push 3
push eax
mov eax, dword [esp + 0x24]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40771e
mov bl, 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret

Function at 0x407900
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebp
mov ebp, dword [esp + 0x110]
push esi
lea esi, [esp + 0xc]
push edi
sub esi, ebp
lea ecx, [ecx]
mov eax, ebp
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x407922
xor eax, eax
lea edi, [esp + 0x10]
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x407951
mov al, byte [esp + ecx + 0xf]
cmp al, 0x2f
lea ecx, [esp + ecx + 0xf]
je 0x40794e
cmp al, 0x5c
jne 0x407951
mov byte [ecx], 0
push 0
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jne 0x4079a5
mov edi, edi
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.0041ec60
add esp, 8
test eax, eax
jne 0x407986
lea edx, [esp + 0x10]
push 0x2f
push edx
call fcn.0041ec60
add esp, 8
test eax, eax
je 0x407998
mov byte [eax], 0
push 0
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x407960
jmp 0x407920
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x104
ret
Function at 0x407ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407ad3
xor al, al
ret
and eax, 1
dec al
neg al
sbb eax, eax
inc eax
ret

Function at 0x407ae0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407b07
mov cl, byte [esp + 0xc]
and eax, 0xfffffffe
test cl, cl
je 0x407aff
or eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret
Function at 0x408ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x408f01
mov ecx, dword [esp + 0xc]
push edi
xor edx, edx
mov dl, byte [ecx]
mov edi, eax
and edi, 0xff
shr eax, 8
xor edx, edi
mov edx, dword [edx*4 + 0x42b8e0]
xor eax, edx
inc ecx
dec esi
jne 0x408ee2
pop edi
pop esi
ret

Function at 0x40b8b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x40b8e3
push esi
call fcn.0040f1d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x40b8dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x40b969
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x40b952
lea ebx, [ebx]
mov eax, dword [esi + 8]
test eax, eax
je 0x40b90d
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x40b94e
cmp eax, 2
je 0x40b952
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40b900
cmp eax, 3
je 0x40b933
cmp eax, 1
jne 0x40b900
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x40b900
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x40b900
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0040b9a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x40b989
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x12
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0040b9a0
add esp, 4
pop esi
ret
Function at 0x401963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
push esi
push edi
push dword [ebp + 8]
pop ebx
mov al, byte [ebx]
mov byte [ebp - 3], al
mov al, byte [ebx + 1]
mov byte [ebp - 4], al
mov edi, ebx
inc edi
inc edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
jecxz reloc.gdi32.dll_SetWorldTransform
inc byte [ebp - 3]
movzx eax, byte [ebp - 3]
movzx edx, byte [eax + edi]
mov byte [ebp - 1], dl
add byte [ebp - 4], dl
movzx eax, byte [ebp - 4]
mov dl, byte [eax + edi]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 3]
mov byte [eax + edi], dl
movzx eax, byte [ebp - 4]
mov dl, byte [ebp - 1]
mov byte [eax + edi], dl
mov dl, byte [ebp - 1]
add dl, byte [ebp - 2]
mov dl, byte [edx + edi]
mov eax, dword [ebp - 8]
xor byte [eax + esi], dl
inc dword [ebp - 8]
loop reloc.gdi32.dll_SetWorldTransform
mov al, byte [ebp - 3]
mov byte [ebx], al
mov al, byte [ebp - 4]
mov byte [ebx + 1], al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x401d7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
not eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je reloc.gdi32.dll_SetWorldTransform
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
mov eax, dword [eax*4 + 0x419c00]
xor eax, edx
inc edi
loop reloc.gdi32.dll_SetWorldTransform
not eax
pop edi
leave
ret 0xc

Function at 0x402e7e
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push eax
push ebx
push ecx
push edx
push edi
push esi
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x80]
lea edx, [eax*8]
mov ebx, eax
mov ecx, eax
shr eax, 6
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
add edi, ecx
mov byte [edi], reloc.shlwapi.dll_StrCSpnW
and ebx, 0x3f
sub edi, ebx
cmp ebx, 0x38
jb reloc.gdi32.dll_SetWorldTransform
add edi, ebx
mov eax, reloc.shlwapi.dll_PathStripPathA
sub eax, ebx
add edi, eax
inc dword [ebp - 0x14]
mov dword [edi + 0x38], edx
lea esi, [ebp - 0x10]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
push dword [ebp - 0x14]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402f09
cld
mov ecx, 4
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0xc
Function at 0x40351c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push edi
push esi
push ebx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
pop dword [ebp - 8]
mov dword [0x41a000], 0x67452301
mov dword [0x41a004], 0xefcdab89
mov dword [0x41a008], 0x98badcfe
mov dword [0x41a00c], 0x10325476
mov dword [0x41a010], 0xc3d2e1f0
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push reloc.shlwapi.dll_PathStripPathA
push 0x41a014
push eax
call fcn.004018bf
add dword [ebp - 4], 0x40
call fcn.0040364e
sub dword [ebp - 8], 0x40
jae reloc.gdi32.dll_SetWorldTransform
mov ebx, dword [ebp - 8]
add ebx, 0x40
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push ebx
push 0x41a014
push eax
call fcn.004018bf
add dword [ebp - 4], ebx
mov byte [ebx + 0x41a014], 0x80
sub ebx, 0x37
jbe reloc.gdi32.dll_SetWorldTransform
sub ebx, 8
je reloc.gdi32.dll_SetWorldTransform
and byte [ebx + 0x41a054], 0
inc ebx
js reloc.gdi32.dll_SetWorldTransform
call fcn.0040364e
mov ebx, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
and byte [ebx + 0x41a04c], 0
inc ebx
js reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0xc]
mov ecx, 8
xor edx, edx
mul ecx
bswap eax
bswap edx
mov dword [0x41a050], eax
mov dword [0x41a04c], edx
call fcn.0040364e
mov eax, dword [0x41a000]
mov edx, dword [0x41a004]
mov ecx, dword [0x41a008]
bswap eax
bswap edx
bswap ecx
mov dword [0x41a000], eax
mov dword [0x41a004], edx
mov dword [0x41a008], ecx
mov eax, dword [0x41a00c]
mov edx, dword [0x41a010]
bswap eax
bswap edx
mov dword [0x41a00c], eax
mov dword [0x41a010], edx
push reloc.opengl32.dll_glDrawBuffer
push dword [ebp + 0x10]
push 0x41a000
call fcn.004018bf
pop ebx
pop esi
pop edi
leave
ret 0xc