joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a2a2
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x47905b
call fcn.0045e821
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0
je 0x41a2be
xor al, al
jmp 0x41a3aa
lea esi, [ebx + 0x14]
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
cmp byte [ebx + 4], 0
mov dword [ebx + 0xc], 1
je 0x41a2e5
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x41a2b7
mov edi, dword [ebp + 0xc]
lea esi, [ebx + 0x2c]
mov byte [ebx + 4], 1
call fcn.00418b8a
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp dword [eax + 8], edi
jne 0x41a32a
push 0x130
call fcn.0045d68c
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 1
cmp eax, edi
je 0x41a31c
push eax
call fcn.00418d35
jmp 0x41a31e
xor eax, eax
mov byte [ebp - 4], 0
mov dword [ebx + 0x88], eax
jmp 0x41a367
push 0xf0
call fcn.0045d68c
mov esi, eax
pop ecx
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x41a35b
call fcn.00418524
mov dword [esi], vtable.CLocalScreenWatermarkPrinter.0
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
jmp 0x41a35d
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebx + 0x88], esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
push edi
push ebx
push 0x41a129
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push str.thread_handle:_d
mov dword [ebx + 8], eax
call fcn.00421281
pop ecx
pop ecx
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xffffffffffffffff
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebx + 0xc], edi
mov al, 1
call fcn.0045e8f9
ret 8

Function at 0x41a3f5
Capabilities:
Terminate thread

Disassembly:
push 4
mov eax, 0x478568
call fcn.0045e821
lea edi, [esi + 0x14]
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi + 4], bl
jne 0x41a432
push str.close_err1
call fcn.00421281
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
call fcn.0045e8f9
ret
mov eax, dword [esi + 0x84]
cmp eax, ebx
jne 0x41a452
push str.close_err2
call fcn.00421281
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x41a42c
push ebx
push ebx
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 8]
push str.wait_thread:_d
call fcn.00421281
pop ecx
pop ecx
push 0x1388
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41a496
push str.wait_time_out
call fcn.00421281
pop ecx
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov byte [esi + 4], bl
mov dword [esi + 0x88], ebx
mov bl, 1
jmp 0x41a447
Function at 0x41aefb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.0045f510
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0040bbad
cmp dword [ebp - 0x7c], 5
ja 0x41af57
test eax, eax
je 0x41af50
mov eax, 0x47def4
jmp 0x41af65
mov eax, 0x47dedc
jmp 0x41af65
test eax, eax
mov eax, 0x47df24
jne 0x41af65
mov eax, 0x47df0c
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0045d55f
add ebp, 0x98
leave
ret

Function at 0x41af7a
Capabilities:
Check if file exists
Create service

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
call fcn.0041aefb
mov ebx, eax
xor eax, eax
push 0x206
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.0045f510
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.0040ba85
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x41b009
cmp word [0x497c68], si
je 0x41affb
push 0x104
push 0x497c68
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x41b0a4
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x41b0a4
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
cmp ebx, esi
je 0x41b0a4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x47e3bc
push ebx
call edi
test eax, eax
jne 0x41b03e
xor edi, edi
inc edi
jmp 0x41b04d
push str..exe
push ebx
call edi
test eax, eax
jne 0x41b0a4
push 0x10
pop edi
push 0xf003f
push esi
push esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x80], eax
cmp eax, esi
je 0x41b09c
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
push 1
push 3
push edi
push 0xf01ff
mov eax, 0x480d84
push eax
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
call fcn.0040d0c9
xor eax, eax
cmp dword [ebp - 0x7c], esi
setne al
jmp 0x41b0a6
lea eax, [ebp - 0x80]
call fcn.0040d0c9
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
add ebp, 0x194
leave
ret

Function at 0x41b0be
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, 0x480d84
push esi
call fcn.0040d213
test eax, eax
je 0x41b0f3
push esi
call fcn.0040d1ac
test eax, eax
je 0x41b0dd
xor eax, eax
inc eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41b0ed
cmp eax, 3
jne 0x41b106
push esi
call fcn.0040d277
call fcn.0041af7a
test eax, eax
je 0x41b106
push esi
call fcn.0040d1ac
test eax, eax
jne 0x41b0d8
xor eax, eax
pop esi
ret
Function at 0x41b1ac
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor eax, eax
push eax
push eax
push 3
push eax
push 3
mov ebx, 0xc0000000
push ebx
mov edi, 0x480dc8
push edi
call esi
cmp eax, 0xffffffff
jne 0x41b2a2
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0045f510
add esp, 0xc
call fcn.0040bbad
test eax, eax
mov eax, 0x47df54
jne 0x41b219
mov eax, 0x47df3c
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.0040ba85
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41b273
cmp word [0x497e70], ax
je 0x41b273
push 0x497e70
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.0040bbad
test eax, eax
mov eax, 0x47df54
jne 0x41b265
mov eax, 0x47df3c
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x480de4
call fcn.0040d213
test eax, eax
lea eax, [ebp - 0x210]
push eax
call fcn.00421966
push 0x480de4
call fcn.0040d1ac
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push ebx
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
leave
ret
Function at 0x41d716
Capabilities:
Check if file exists
Create service

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.0045f510
add esp, 0xc
call fcn.0040bbad
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x41d7d0
call fcn.0040bbad
test eax, eax
mov ebx, str.swvv32.sys
mov eax, str.swvv64.sys
jne 0x41d778
mov eax, ebx
lea ecx, [ebp - 0x78]
push ecx
push eax
call fcn.0040ba85
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x41d7d0
cmp word [0x498080], si
je 0x41d7c2
push 0x104
push 0x498080
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.0040bbad
test eax, eax
je 0x41d7b7
mov ebx, str.swvv64.sys
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x41d86b
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x41d86b
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
cmp ebx, esi
je 0x41d86b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x47e3bc
push ebx
call edi
test eax, eax
jne 0x41d805
xor edi, edi
inc edi
jmp 0x41d814
push str..exe
push ebx
call edi
test eax, eax
jne 0x41d86b
push 0x10
pop edi
push 0xf003f
push esi
push esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x80], eax
cmp eax, esi
je 0x41d863
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
push 1
push 3
push edi
push 0xf01ff
mov eax, 0x480ec0
push eax
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
call fcn.0040d0c9
xor eax, eax
cmp dword [ebp - 0x7c], esi
setne al
jmp 0x41d86d
lea eax, [ebp - 0x80]
call fcn.0040d0c9
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
add ebp, 0x194
leave
ret
Function at 0x41e122
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push 0x110
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
xor edi, edi
mov dword [ebp - 0x64], 0x114
call fcn.0045f510
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp + 0xbc], 0x8000
jne 0x41e17a
mov edi, 0x100
jmp 0x41e1a3
cmp dword [ebp + 0xbc], 0x8004
je 0x41e19e
cmp dword [ebp - 0x60], 6
jb 0x41e1a3
cmp dword [ebp - 0x5c], 1
jb 0x41e1a3
cmp dword [ebp + 0xbc], 0x8003
jne 0x41e1a3
mov edi, 0x80
mov ecx, dword [ebp + 0xc0]
xor esi, esi
inc esi
shl esi, cl
cmp edi, ebx
je 0x41e1e5
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
test esi, eax
je 0x41e1df
mov al, bl
add al, 0x41
push 0
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x68]
push eax
push 5
push edi
mov byte [ebp - 0x67], 0x3a
mov byte [ebp - 0x66], 0x5c
mov byte [ebp - 0x65], 0
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
inc ebx
cmp ebx, 0x1a
jl 0x41e1b2
and dword [ebp - 0x78], 0
xor ecx, ecx
cmp dword [ebp - 0x60], 6
push 2
pop eax
mov word [ebp - 0x70], cx
mov dword [ebp - 0x80], 0x14
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], esi
mov ecx, 0x3e8
jb 0x41e20d
push 0x64
pop ecx
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea edx, [ebp - 0x6c]
push edx
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xbc]
mov ebx, 0x219
push ebx
mov edi, 0xffff
push edi
call esi
cmp dword [ebp - 0x60], 6
jae 0x41e258
mov eax, 0x8000
cmp dword [ebp + 0xbc], eax
jne 0x41e258
lea ecx, [ebp - 0x6c]
push ecx
push 0xc8
push 2
lea ecx, [ebp - 0x80]
push ecx
push eax
push ebx
push edi
call esi
mov ecx, dword [ebp + 0xb0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
add ebp, 0xb4
leave
ret 8
Function at 0x41eb4c
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, 0x480ec0
push esi
call fcn.0040d213
test eax, eax
je 0x41eb81
push esi
call fcn.0040d1ac
test eax, eax
je 0x41eb6b
xor eax, eax
inc eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41eb7b
cmp eax, 3
jne 0x41eb94
push esi
call fcn.0040d277
call fcn.0041d716
test eax, eax
je 0x41eb94
push esi
call fcn.0040d1ac
test eax, eax
jne 0x41eb66
xor eax, eax
pop esi
ret
Function at 0x420f7c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x128], 0
push esi
push edi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0xc]
push 0x3f
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0xab]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xac], 0
call fcn.0045f510
lea edi, [ebp - 0xac]
add esp, 0xc
movsd dword es:[edi], dword [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0xac]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x104], dl
mov byte [ebp + eax - 0x6c], cl
inc eax
cmp eax, 0x40
jb 0x420fcf
lea eax, [ebp - 0xc4]
call fcn.00422ab8
lea eax, [ebp - 0x104]
push eax
push 0x40
pop eax
lea esi, [ebp - 0xc4]
call fcn.00422adc
push dword [ebp - 0x124]
mov eax, dword [ebp + 0x10]
call fcn.00422adc
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00422b72
lea eax, [ebp - 0x11c]
call fcn.00422ab8
lea eax, [ebp - 0x6c]
push eax
push 0x40
pop eax
lea esi, [ebp - 0x11c]
call fcn.00422adc
lea eax, [ebp - 0x18]
push eax
push 0x10
pop eax
call fcn.00422adc
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00422b72
mov esi, dword [ebp - 0x120]
add esp, 0x18
push 0x10
lea eax, [ebp - 0x28]
push eax
call fcn.0040d8ba
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045d55f
leave
ret

Function at 0x421281
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.004690d0
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
call fcn.00421364
test al, al
je 0x421357
xor eax, eax
mov word [ebp - 0x80c], ax
mov word [ebp - 0x100c], ax
push str.__ls__ls
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4811ec
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2028]
push eax
call fcn.004211a4
cmp dword [eax + 0x18], 8
pop ecx
jb 0x4212f2
mov eax, dword [eax + 4]
jmp 0x4212f5
add eax, 4
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x100c]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
push 1
lea esi, [ebp - 0x2028]
call fcn.0040144b
xor eax, eax
mov word [ebp - 0x200c], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x800
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0045d55f
leave
ret
Function at 0x42143d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea eax, [ebp - 0x30]
push 0x481650
push eax
call fcn.0040af92
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.00413a3f
test al, al
jne 0x4214a2
call fcn.0041c996
cmp dword [eax + 0x18], 8
jb 0x42148e
mov eax, dword [eax + 4]
jmp 0x421491
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 8]
call fcn.00403152
jmp 0x421463
lea eax, [ebp - 0x30]
push eax
call fcn.00402d69
pop edi
pop esi
leave
ret
Function at 0x421805
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040be7e
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.0045f510
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x481674
lea eax, [ebp - 0x210]
push eax
call esi
lea ecx, [ebp - 0x210]
call fcn.0042143d
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4218bb
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x42194a
push edi
lea ecx, [ebp - 0x210]
call fcn.0040b7e4
test eax, eax
jne 0x421948
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call esi
test eax, eax
jne 0x421948
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00421417
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
pop ecx
pop ecx
jae 0x42190a
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x421935
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call esi
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x421938
push 9
pop edi
push ebx
push 1
lea esi, [ebp - 0x22c]
call fcn.0040144b
jmp 0x42194a
xor edi, edi
push dword [ebp - 0x230]
call fcn.0040bebe
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
leave
ret

Function at 0x421bb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x421bce
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x421bca
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421cf7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.00421ebd
mov bl, al
mov al, dl
call fcn.00421ebd
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.00421ebd
mov bl, al
mov al, byte [esi - 4]
call fcn.00421ebd
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.00421ebd
mov bl, al
mov al, byte [esi]
call fcn.00421ebd
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.00421ebd
mov bl, al
mov al, byte [esi - 0xc]
call fcn.00421ebd
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x421d1f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
leave
ret 4

Function at 0x421dac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.00421f39
push ebx
mov dl, al
call fcn.00421f12
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.00421ecd
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.00421eeb
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.00421ecd
push ebx
mov byte [ebp - 0x15], al
call fcn.00421eeb
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.00421f12
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.00421f39
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.00421f12
mov bl, al
mov al, byte [edi + 4]
call fcn.00421f39
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.00421eeb
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.00421ecd
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.00421eeb
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.00421ecd
xor bl, al
mov al, dl
call fcn.00421f39
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.00421f12
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x421dd8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d55f
leave
ret 4
Function at 0x422287
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x476a5f
call fcn.0045e88a
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, ebx
mov dword [ebp - 0x30], esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4222a6
sub eax, edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.004034a3
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
jbe 0x4223ac
jmp 0x4222d5
mov ebx, dword [ebp + 0xc]
movsx eax, byte [esi + ebx]
mov al, byte [eax + 0x480328]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x4222e9
cmp al, 0xff
je 0x4222d5
cmp al, 0xff
je 0x4223ac
movsx ecx, byte [esi + ebx]
mov cl, byte [ecx + 0x480328]
inc esi
mov byte [ebp - 0x31], cl
cmp esi, dword [ebp - 0x30]
jae 0x422309
cmp cl, 0xff
je 0x4222f1
cmp cl, 0xff
je 0x4223ac
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.0040df68
jmp 0x422330
mov ebx, dword [ebp + 0xc]
mov bl, byte [esi + ebx]
inc esi
cmp bl, 0x3d
je 0x4223ac
movsx eax, bl
mov bl, byte [eax + 0x480328]
cmp esi, dword [ebp - 0x30]
jae 0x42234c
cmp bl, 0xff
je 0x42232d
cmp bl, 0xff
je 0x4223ac
mov al, byte [ebp - 0x31]
mov cl, bl
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.0040df68
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x4223ac
movsx eax, al
mov al, byte [eax + 0x480328]
cmp esi, dword [ebp - 0x30]
jae 0x42238c
cmp al, 0xff
je 0x42236f
cmp al, 0xff
je 0x4223ac
shl bl, 6
or bl, al
movzx eax, bl
push eax
push 1
lea edi, [ebp - 0x2c]
call fcn.0040df68
cmp esi, dword [ebp - 0x30]
jb 0x4222d2
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.00402c8c
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403022
mov eax, dword [ebp - 0x38]
call fcn.0045e90d
ret

Function at 0x422ab8
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret