joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12a2acaf
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x12a2acfc
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x12a2acd3
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x12a2aef4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x12a2af41
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x12a2af18
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x12a3013a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.12a300b9
test eax, eax
je 0x12a3017b
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push 0x12a036ec
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8
Function at 0x401200
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
call fcn.004010e0
mov eax, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 0
add eax, 0xc
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x40137e
push ebp
push esi
push edi
mov ecx, 0x8be
call fcn.0040d3a0
mov ebp, eax
mov ecx, 0x22f
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 1
mov edx, 0x20
mov word [ebp + 2], ax
mov word [ebp + 4], ax
mov byte [ebp + 6], dl
mov byte [ebp + 7], dl
mov dword [ebp + 0xe], 0x8a8
mov dword [ebp + 0x12], 0x16
mov dword [ebp + 0x16], 0x28
mov dword [ebp + 0x1a], edx
mov dword [ebp + 0x1e], 0x40
mov word [ebp + 0x22], ax
mov word [ebp + 0x24], 8
mov dword [ebp + 0x2a], 0x400
mov eax, dword [0x437118]
mov ecx, 0xff
lea edi, [ebp + 0x42]
lea esi, [eax + 0x2c]
lea eax, [ebp + 0x43e]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx]
mov ecx, 0x100
mov edi, eax
mov esi, dword [esi + 0x14]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x400]
mov edi, 0x80
mov bl, byte [eax]
xor cl, cl
test bl, bl
jne 0x4012d7
mov cl, 0x80
mov bl, byte [eax + 1]
test bl, bl
jne 0x4012e1
or cl, 0x40
mov bl, byte [eax + 2]
test bl, bl
jne 0x4012ea
or cl, dl
mov bl, byte [eax + 3]
test bl, bl
jne 0x4012f4
or cl, 0x10
mov bl, byte [eax + 4]
test bl, bl
jne 0x4012fe
or cl, 8
mov bl, byte [eax + 5]
test bl, bl
jne 0x401308
or cl, 4
mov bl, byte [eax + 6]
test bl, bl
jne 0x401312
or cl, 2
mov bl, byte [eax + 7]
test bl, bl
jne 0x40131c
or cl, 1
add eax, 8
mov byte [esi], cl
inc esi
dec edi
jne 0x4012cd
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0x8be
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebp
call fcn.0040d410
pop edi
test esi, esi
pop esi
pop ebp
je 0x401370
cmp dword [esp + 8], 0x8be
jne 0x401370
lea ecx, [esp + 0x10]
call fcn.00406610
mov al, 1
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
call fcn.00406610
xor al, al
pop ebx
add esp, 8
ret 4

Function at 0x401391
Capabilities:
Delete file

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401411
lea ecx, [esp + 4]
call fcn.004064c0
lea ecx, [esp + 4]
call fcn.00406d50
push ecx
lea edx, [esp + 8]
mov ecx, esp
push edx
call fcn.00401020
mov ecx, esi
call fcn.00401200
test al, al
je 0x401400
mov eax, dword [esp + 4]
mov ecx, dword [0x437268]
add eax, 0xc
push 0
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ExtractIconA]
mov edx, dword [esi]
mov dword [edx + 8], eax
mov eax, dword [esi]
cmp dword [eax + 8], 1
jne 0x4013f2
mov dword [eax + 8], 0
mov eax, dword [esp + 4]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
call fcn.00406610
mov ecx, dword [esi]
mov eax, dword [ecx + 8]
pop esi
pop ecx
ret
mov edx, dword [esi]
pop esi
mov eax, dword [edx + 8]
pop ecx
ret
Function at 0x406d50
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, 0x100
call fcn.0040d3a0
mov ecx, 0x200
mov esi, eax
call fcn.0040d3a0
mov edi, eax
push esi
mov byte [esi], 0
push 0xff
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push 0
push 0x436188
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, edi
mov ecx, ebx
call fcn.00407cf0
mov ecx, esi
call fcn.0040d410
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.0040d410

Function at 0x406e30
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x406e45
mov ecx, dword [edi]
call fcn.0040d410
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jge 0x406e58
xor esi, esi
lea ecx, [esi + 0xd]
call fcn.0040d3a0
mov dword [edi], eax
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov byte [eax + esi + 0xc], 0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add eax, 0xc
inc ecx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop esi
pop ebx
ret 4

Function at 0x406ea0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x406f11
mov eax, dword [edi]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x406eca
mov ecx, dword [edi]
call fcn.0040d410
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jge 0x406eda
xor esi, esi
lea ecx, [esi + 0xd]
call fcn.0040d3a0
mov dword [edi], eax
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov byte [eax + esi + 0xc], 0
mov eax, dword [edi]
mov edx, dword [eax + 4]
add eax, 0xc
inc edx
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop esi
pop edi
pop ebx
ret 8
mov ecx, edi
call fcn.00406ad0
pop edi
pop ebx
ret 8

Function at 0x406f50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
lea eax, [esp + 8]
push edi
push eax
mov ebp, ecx
push 0x104
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
test esi, esi
jge 0x406f7a
xor esi, esi
jmp 0x406f87
cmp esi, 0x104
jle 0x406f87
mov esi, 0x104
mov eax, dword [ebp]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x406f99
mov ecx, dword [ebp]
call fcn.0040d410
test esi, esi
mov edi, esi
jge 0x406fa1
xor edi, edi
lea ecx, [edi + 0xd]
call fcn.0040d3a0
mov dword [ebp], eax
mov dword [eax], 1
mov dword [eax + 4], edi
mov dword [eax + 8], 0xffffffff
mov ecx, esi
mov byte [eax + edi + 0xc], 0
mov edi, dword [ebp]
mov edx, ecx
lea esi, [esp + 0xc]
add edi, 0xc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x104
ret
Function at 0x40a300
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
lea ecx, [esp + 4]
call fcn.00406c70
lea ecx, [esp + 4]
call fcn.00406cc0
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40a348
cmp byte [eax + ecx + 0xb], 0x5c
jne 0x40a348
dec eax
push 0x7fffffff
push eax
lea ecx, [esp + 0xc]
call fcn.00406c00
lea ecx, [esp + 4]
call fcn.00406cc0
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40a31d
add ecx, 0xc
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40a367
lea ecx, [esp + 4]
call fcn.00406610
mov eax, 1
ret
mov eax, dword [esp + 4]
push esi
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a391
test al, 0x10
je 0x40a391
lea ecx, [esp + 8]
mov esi, 1
call fcn.00406610
mov eax, esi
pop esi
ret
lea ecx, [esp + 8]
xor esi, esi
call fcn.00406610
mov eax, esi
pop esi
ret

Function at 0x40b230
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [0x437314]
sub esp, 0x20
push ebx
mov bl, byte [esp + 0x28]
cmp bl, al
je 0x40b31b
mov ecx, dword [0x437308]
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
push ecx
mov byte [0x437314], bl
call esi
mov eax, dword [0x437310]
lea edx, [esp + 0x18]
push edx
push eax
call esi
test bl, bl
je 0x40b2c7
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub ecx, esi
mov edx, dword [esp + 0x10]
add eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
sub eax, ecx
push 1
push eax
mov eax, dword [esp + 0x10]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [0x437308]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x437310]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x437238]
call fcn.00418a80
pop esi
pop ebx
add esp, 0x20
ret
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov eax, dword [0x437310]
sub edx, esi
push 0
add ecx, edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, eax
push 1
push ecx
mov ecx, dword [esp + 0x10]
sub edx, ecx
push edx
push eax
mov eax, dword [0x437308]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x437238]
call fcn.00418a80
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x40b320
Capabilities:
Set console window title

Disassembly:
mov al, byte [0x4377e8]
test al, al
je 0x40b338
mov eax, dword [0x4372e0]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
ret
Function at 0x4172c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov al, byte [0x4377e8]
push esi
test al, al
je 0x417373
push ebx
push edi
mov ecx, 0x2000
mov dword [esp + 0xc], 0
call fcn.0040d3a0
mov ecx, dword [0x436904]
mov edi, eax
lea eax, [esp + 0xc]
push 0
push eax
push 0x1fff
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0xc]
lea ecx, [edx + 1]
call fcn.0040d3a0
mov ebx, eax
mov eax, dword [esp + 0xc]
push eax
push ebx
push edi
call dword [sym.imp.USER32.dll_OemToCharBuffA]
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.00406610
mov ecx, dword [esp + 0xc]
push ecx
push ebx
mov ecx, esi
call fcn.00406650
mov ecx, ebx
call fcn.0040d410
mov ecx, edi
call fcn.0040d410
mov ecx, dword [esi]
pop edi
pop ebx
mov eax, dword [ecx + 4]
test eax, eax
je 0x41737c
mov cl, byte [eax + ecx + 0xb]
cmp cl, 0xd
je 0x417359
cmp cl, 0xa
jne 0x41737c
dec eax
push 0x7fffffff
push eax
mov ecx, esi
call fcn.00406c00
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x41734b
pop esi
pop ecx
ret
mov ecx, dword [esp + 0xc]
call fcn.00406ad0
pop esi
pop ecx
ret

Function at 0x4180c0
Capabilities:
Read file on windows

Disassembly:
push ecx
call fcn.00417de0
test al, al
je 0x41819d
mov ecx, dword [0x4377a8]
mov edx, dword [0x4377b0]
mov eax, ecx
sub eax, edx
mov edx, dword [0x4377b4]
cmp eax, edx
jae 0x4180fa
inc ecx
mov dword [0x4377a8], ecx
mov ecx, dword [0x4377ac]
mov al, byte [ecx + eax]
pop ecx
ret
lea eax, [ecx - 0x3c00]
mov dword [0x4377b4], 0
test eax, eax
mov dword [0x4377b0], eax
jge 0x41811a
xor eax, eax
mov dword [0x4377b0], eax
mov edx, dword [0x4377a4]
push 0
push 0
push eax
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41815d
mov ecx, dword [0x4377ac]
mov edx, dword [0x4377a4]
lea eax, [esp]
push 0
push eax
push 0xf000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418164
mov byte [0x437798], 1
mov edx, dword [0x4377a8]
mov ecx, dword [esp]
push esi
mov esi, dword [0x4377b0]
mov eax, edx
mov dword [0x4377b4], ecx
sub eax, esi
inc edx
cmp eax, ecx
mov dword [0x4377a8], edx
pop esi
jae 0x418196
mov ecx, dword [0x4377ac]
mov al, byte [ecx + eax]
pop ecx
ret
mov byte [0x437798], 1
xor al, al
pop ecx
ret
Function at 0x4181b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00417de0
test al, al
je 0x418325
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jg 0x4181dc
mov eax, dword [0x4377a8]
pop edi
add eax, ebp
pop esi
pop ebp
mov dword [0x4377a8], eax
pop ebx
pop ecx
ret
cmp ebp, 0xf000
mov dword [esp + 0x10], 0
jl 0x418245
mov eax, dword [0x4377a8]
mov ecx, dword [0x4377a4]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x418238
mov eax, dword [esp + 0x18]
mov ecx, dword [0x4377a4]
lea edx, [esp + 0x10]
push 0
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418238
mov eax, dword [0x4377a8]
pop edi
add eax, ebp
pop esi
pop ebp
mov dword [0x4377a8], eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov byte [0x437798], 1
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x18]
mov eax, dword [0x4377b4]
mov dword [esp + 0x1c], 4
mov edx, dword [0x4377a8]
mov esi, dword [0x4377b0]
sub edx, esi
cmp edx, eax
jae 0x4182a2
sub eax, edx
cmp eax, ebp
jle 0x418270
mov eax, ebp
mov esi, dword [0x4377ac]
mov ecx, eax
add esi, edx
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x4377a8]
add edx, eax
sub ebp, eax
mov dword [0x4377a8], edx
je 0x418325
add ebx, eax
mov eax, dword [0x4377a8]
mov dword [0x4377b4], 0
add eax, 0xffffc400
test eax, eax
mov dword [0x4377b0], eax
jge 0x4182c6
xor eax, eax
mov dword [0x4377b0], eax
mov ecx, dword [0x4377a4]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x418300
mov eax, dword [0x4377ac]
mov ecx, dword [0x4377a4]
lea edx, [esp + 0x10]
push 0
push edx
push 0xf000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418307
mov byte [0x437798], 1
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [0x4377b4], eax
je 0x418325
mov ecx, dword [esp + 0x1c]
dec ecx
test ecx, ecx
mov dword [esp + 0x1c], ecx
jg 0x418256
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41afa0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x100
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [esp + 0x104]
mov dl, byte [esp + 0x108]
lea eax, [esp + ecx]
mov cl, byte [esp + ecx]
and cl, 0xfe
test dl, dl
mov byte [eax], cl
je 0x41afd5
or cl, 1
mov byte [eax], cl
lea edx, [esp]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
add esp, 0x100
ret

Function at 0x428410
Capabilities:
Delete file

Disassembly:
mov al, byte [0x43784c]
mov dword [0x4369c4], 0x48
test al, al
mov dword [0x4369c8], 0xffffffff
je 0x428451
mov al, byte [0x43784e]
test al, al
je 0x42844c
push 0
mov byte [0x43784d], 1
call fcn.00428460
add esp, 4
jmp fcn.004284f0
jmp fcn.00428580
ret
Function at 0x428580
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x437848]
mov byte [0x43784c], 0
test eax, eax
mov dword [0x4369c8], 0xffffffff
je 0x4285dd
push esi
mov esi, dword [sym.imp.WINMM.dll_mciSendCommandA]
push 0
push 2
push 0x808
push eax
call esi
mov eax, dword [0x437848]
push 0
push 2
push 0x804
push eax
call esi
mov dword [0x437848], 0
mov dword [0x4369c0], 0x5265c00
mov dword [0x437850], 0
pop esi
mov eax, dword [0x437844]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4285fd
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x437844
jmp fcn.00406ad0
ret

Function at 0x42f400
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x150
lea ecx, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x160]
push edi
push esi
call fcn.00401020
lea ecx, [esp + 0x10]
call fcn.00406c70
lea ecx, [esp + 0x10]
call fcn.00406cc0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x42f446
mov edx, 0x436a6c
lea ecx, [esp + 0x10]
call fcn.00407cf0
mov ecx, esi
call fcn.00406ad0
lea ecx, [esp + 0x14]
call fcn.004064c0
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dl, 0x3b
lea ecx, [esp + 0x10]
call fcn.00406860
mov ebx, eax
test ebx, ebx
jge 0x42f474
mov ecx, dword [esp + 0x10]
mov ebx, dword [ecx + 4]
push ebx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.00406b40
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.00407cc0
lea ecx, [esp + 0x18]
call fcn.00406610
lea ecx, [esp + 0x14]
call fcn.00406c70
lea ecx, [esp + 0x14]
call fcn.00406cc0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x42f4f9
lea edx, [esp + 0x20]
add eax, 0xc
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x42f4f9
lea edx, [esp + 0x4c]
mov ecx, esi
call fcn.00407e30
mov dl, 0xd
mov ecx, esi
call fcn.00407ea0
mov dl, 0xa
mov ecx, esi
call fcn.00407ea0
lea eax, [esp + 0x20]
push eax
push edi
call ebp
test eax, eax
jne 0x42f4c9
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
inc ebx
push 0x7fffffff
push ebx
lea edx, [esp + 0x24]
lea ecx, [esp + 0x18]
call fcn.00406bb0
mov edx, eax
lea ecx, [esp + 0x10]
call fcn.00407cc0
lea ecx, [esp + 0x1c]
call fcn.00406610
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x42f45c
lea ecx, [esp + 0x14]
call fcn.00406610
lea ecx, [esp + 0x10]
call fcn.00406610
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x150
ret

Function at 0x42f590
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push esi
push edi
mov edi, ecx
mov ecx, edx
call fcn.004184c0
mov eax, dword [0x4375cc]
mov edx, dword [0x437078]
add eax, 0xc
lea ecx, [esp + 8]
push eax
mov eax, dword [0x4374b8]
push 0x3ff
push ecx
mov ecx, dword [0x437444]
add edx, 0xc
add eax, 0xc
push edx
add ecx, 0xc
push eax
push ecx
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
jle 0x42f601
mov ecx, edi
call fcn.00406610
lea edx, [esp + 8]
mov ecx, edi
push esi
push edx
call fcn.00406650
mov al, 1
pop edi
pop esi
add esp, 0x400
ret
pop edi
xor al, al
pop esi
add esp, 0x400
ret
Function at 0x402a61
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4131c4], 0
jne 0x402a6f
call fcn.00402a37
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402a9c
test cl, 7
je 0x402a9c
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
dec esi
inc ecx
jmp 0x402a7d
cmp esi, 8
jb 0x402b20
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4131c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
dec edi
jne 0x402aa6
xor edx, edx
test esi, esi
jbe 0x402b40
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4131c0]
inc edx
cmp edx, esi
jb 0x402b27
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x402d5d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00401200
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x402def
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040707a
lea eax, [ebp - 0x800]
push eax
call fcn.00409537
mov esi, eax
lea eax, [ebp - 0x800]
push eax
call fcn.004078e1
test al, al
jne 0x402dcb
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.00409537
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x402def
push eax
push 0xaf
call fcn.00409140
push eax
push 0x4112dc
call fcn.0040a3da
add esp, 0xc
leave
ret 8
Function at 0x4045d7
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c0]
call fcn.00403195
xor edi, edi
push edi
lea eax, [ebp - 0x30c0]
push eax
push dword [ebp + 8]
push edi
call fcn.00405b72
test al, al
je 0x40477c
cmp word [ebp - 0x2440], di
je 0x40477c
lea eax, [ebp - 0x2440]
push eax
lea eax, [ebp - 0x2cc0]
push eax
call fcn.0040717e
push eax
call fcn.0040d0d4
test eax, eax
je 0x40477c
lea eax, [ebp - 0x2440]
push eax
push dword [ebp + 8]
call fcn.0040717e
push eax
call fcn.0040d0d4
test eax, eax
jne 0x40477c
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x4046cd
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040c8c3
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.0040717e
push eax
call fcn.00409775
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.004052ae
test al, al
je 0x4046b5
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x404666
cmp word [ebp - 0x800], di
je 0x40477c
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040c8c3
lea eax, [ebp - 0x2cc0]
push eax
call fcn.0040717e
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.0040717e
push eax
call fcn.00409561
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x40477c
lea ecx, [ebp - 0x1c20]
call fcn.004049e8
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.004052ae
test al, al
jne 0x404743
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x1c20]
push edi
call fcn.00404d4b
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x40476d
lea ecx, [ebp - 0x1c20]
call fcn.00404a53
lea ecx, [ebp - 0x1c20]
call fcn.00404ad8
lea ecx, [ebp - 0x1c20]
call fcn.00404bcd
mov al, 1
jmp 0x40477e
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4