joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452954
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45296b
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419fc4
mov eax, dword [0x45990c]
cmp word [eax + 2], 0
jne 0x452993
mov eax, dword [0x45990c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00454644
mov eax, dword [0x4599b0]
cmp word [eax + 2], 0
jne 0x4529ad
mov eax, dword [0x4599b0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00454850
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411d74]
call fcn.004039d0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411d74]
call fcn.004039d0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411d74]
call fcn.004039d0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e334]
call fcn.00424200
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x452b64
mov eax, dword [0x459834]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004245d4
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x454f14
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x459834]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c990
test eax, eax
je 0x452ab4
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408c0c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c9c4
test eax, eax
je 0x452ac8
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov byte [ebx + 0xd4], 0
push ebx
push 0x4540d0
call fcn.0041b140
mov dword [ebx + 0xc8], eax
mov eax, dword [0x459740]
cmp byte [eax], 0
jne 0x452b19
mov eax, ebx
call fcn.00452ca8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00455128
mov eax, ebx
call fcn.00455c8c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452b59
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452f28
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x452fc7
cmp dword [ebx + 0x94], 0
jne 0x452fc1
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452eb0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452fc1
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452f87
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452fc1
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414118
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452f96
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4531e0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x45ec94]
cmp dword [eax + 0x30], 0
je 0x45333d
test bl, bl
jne 0x45328e
cmp dword [esi + 0x9c], 0
jne 0x453283
mov eax, esi
call fcn.00455b08
push eax
push 0x45310c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x453254
mov eax, dword [0x45ec94]
call fcn.004560f8
test al, al
je 0x453254
mov eax, dword [0x45ecb8]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x453254
push 0
mov eax, dword [0x45ecb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45323e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x453283
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414118
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x453263
inc dword [esi + 0x9c]
jmp 0x45333d
cmp dword [esi + 0x9c], 0
jle 0x45333d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45333d
cmp dword [esi + 0x44], 0
je 0x4532e9
mov eax, dword [0x45ec94]
call fcn.004560f8
test al, al
je 0x4532e9
mov eax, dword [0x45ecb8]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x4532e9
push 5
mov eax, dword [0x45ecb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4532d3
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x453318
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414118
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4532f8
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x45ecb8
mov ecx, 1
mov edx, dword [0x4530ec]
call fcn.00405884
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x453e24
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x453e8e
mov eax, ebx
call fcn.004560f8
test al, al
jne 0x453e8e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404904
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x453e7b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x453e9b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
jmp 0x453e9b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45530c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45537a
mov eax, esi
call fcn.0043e18c
test al, al
je 0x45537a
mov eax, dword [ebx + 0x84]
call fcn.0043de18
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45537a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45536e
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043de18
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00435de4
jmp 0x45537a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00455148
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x225d4294
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x33202515
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4024fc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40251f
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x402530
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x40253f
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x40254c
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.00405cb8
test eax, eax
je 0x402579
test esi, esi
je 0x402579
cmp word [esi], 0
je 0x402579
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x402590
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4025a9
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4025a9
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x402613
mov dword [ebx + 4], edi
test esi, esi
je 0x4025de
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00405b10
jmp 0x4025e7
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x4025fa
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040144c
jmp 0x402609
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.004058ec
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.004026f8
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402804
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
test esi, esi
je 0x40292c
cmp dword [edi + 0xc], 0
je 0x402843
mov eax, dword [edi + 0xc]
dec eax
je 0x40282d
dec eax
je 0x402839
jmp 0x402843
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x402843
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x402896
xor ebx, ebx
cmp esi, ebx
jle 0x4028b3
push 0
lea eax, [ebp - 0xc]
push eax
mov edx, esi
sub edx, ebx
cmp edx, 0x4000
jge 0x402867
mov ecx, esi
sub ecx, ebx
jmp 0x40286c
mov ecx, 0x4000
push ecx
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 5], dl
test dl, dl
je 0x4028b3
add ebx, 0x4000
cmp esi, ebx
jg 0x40284f
jmp 0x4028b3
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
jne 0x402928
cmp byte [edi + 0x14], 0
je 0x402928
cmp dword [edi + 0xc], 0
jne 0x402928
lea edx, [edi + 0x17]
mov eax, 0x412870
call fcn.0040dc18
test al, al
je 0x402912
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
jae 0x402843
cmp dword [ebp - 0xc], 0
jbe 0x402843
mov eax, edi
call fcn.00402b58
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.00402aa0
jmp 0x402843
lea ecx, [edi + 0x17]
mov eax, 0x412870
xor edx, edx
call fcn.0040dc00
jmp 0x402928
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a1c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x402a46
cmp esi, 0x4e20
jle 0x402a3c
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x402a96
mov eax, ebx
call fcn.00402d68
test al, al
je 0x402a7d
cmp esi, 0x4e20
jle 0x402a7d
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00402a1c
jmp 0x402a99
cmp dword [ebx + 0xc], 1
jne 0x402a91
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x402a91
xor eax, eax
jmp 0x402a99
or eax, 0xffffffff
jmp 0x402a99
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x402dec
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.00405cb8
test eax, eax
je 0x402e12
test ebx, ebx
je 0x402e12
cmp word [ebx], 0
je 0x402e12
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x402e1a
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x402e2d
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00403248
xor eax, eax
jmp 0x402e48
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x402e3c
cmp eax, 3
jne 0x402e43
mov eax, 2
jmp 0x402e48
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x403174
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
lea edx, [ebp - 0x400]
call fcn.00402244
cmp byte [ebp - 0x400], 0
je 0x403199
lea eax, [ebp - 0x400]
jmp 0x40319b
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x4031af
cmp eax, 5
je 0x4031af
xor edx, edx
jmp 0x4031b4
mov edx, 1
mov eax, edx
mov esp, ebp
pop ebp
ret

Function at 0x4031bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00405cb8
test eax, eax
je 0x4031e7
test ebx, ebx
je 0x4031e7
cmp word [ebx], 0
je 0x4031e7
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x40321c
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00405cb8
test eax, eax
je 0x40323e
test ebx, ebx
je 0x40323e
cmp word [ebx], 0
je 0x40323e
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x403248
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.00405cb8
test eax, eax
je 0x403275
test ebx, ebx
je 0x403275
cmp word [ebx], 0
je 0x403275
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x403284
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x4035bc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4035c5
mov eax, dword [ebp - 4]
add esp, 0xfffffb30
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x14b4]
lea eax, [ebp - 0x4a0]
call fcn.00407974
lea eax, [ebp - 0x474]
call fcn.00407974
lea eax, [ebp - 0x448]
call fcn.00407974
push 0
lea ecx, [ebp - 0x10b4]
mov edx, ebx
mov eax, esi
call fcn.00407558
test al, al
jne 0x403622
xor eax, eax
jmp 0x40376e
cmp byte [ebp - 0x10b4], 0
je 0x403634
cmp byte [ebp - 0x41c], 0
jne 0x40363b
xor eax, eax
jmp 0x40376e
lea eax, [ebp - 0x10b4]
call fcn.00401ae0
lea edx, [ebp - 0x41c]
call fcn.004019dc
test eax, eax
je 0x40366b
mov eax, esi
call fcn.00401ae0
lea edx, [ebp - 0x41c]
call fcn.004019dc
test eax, eax
je 0x403672
xor eax, eax
jmp 0x40376e
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.00401ac0
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00401ae0
push eax
call fcn.004014f0
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.004031bc
test al, al
je 0x4036b0
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x403674
mov eax, edi
xor edx, edx
call fcn.004031bc
test al, al
je 0x4036c4
xor eax, eax
jmp 0x40376e
lea eax, [ebp - 0x18b4]
mov ecx, 0x400
mov edx, esi
call fcn.00401ac0
lea eax, [ebp - 0x10b4]
call fcn.00401ae0
push eax
lea eax, [ebp - 0x18b4]
call fcn.00401ae0
pop edx
call fcn.0040144c
push edi
lea ecx, [ebp - 0x18b4]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x403708
xor eax, eax
jmp 0x40376e
lea eax, [ebp - 0x24d4]
call fcn.00402468
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.004031bc
test al, al
jne 0x403733
lea eax, [ebp - 0x24d4]
xor ecx, ecx
mov edx, esi
call fcn.00402648
mov ebx, eax
lea eax, [ebp - 0x18b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40375a
lea eax, [ebp - 0x24d4]
call fcn.0040274c
lea eax, [ebp - 0x24d4]
call fcn.004027d0
mov al, 1
push eax
lea eax, [ebp - 0x24d4]
mov edx, 2
call fcn.004024b8
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403d4c
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x405d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x413420
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x405d68
call fcn.00405d10
mov eax, dword [ebp - 4]
jmp 0x405d81
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x405d89
test al, 7
jne 0x405d6d
cmp esi, 8
jb 0x405e12
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x405d92
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x405e34
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x405e19
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4061ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x406203
test esi, esi
jg 0x40620a
xor eax, eax
jmp 0x4062ae
mov edx, dword [ebp - 4]
add edx, 4
lea eax, [ebp - 0x28]
mov ecx, 0x10
call fcn.00401340
test esi, esi
jns 0x406224
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x406295
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00406560
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x406231
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 0x10
call fcn.00401340
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4062b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ecx, 0x20
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 4
call fcn.00401340
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x40631f
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x4062ea
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x406317
cmp ecx, 4
jl 0x4062e8
cmp ecx, 4
jne 0x40631f
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40632a
cmp esi, 0xa
jle 0x40630c
cmp esi, 0xa
jg 0x4064bd
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x413ac8]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x413ac8]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x413ac8]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x413ac8]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x413cc8]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x4063cd
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x40646b
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x4063ad
inc edx
cmp edx, dword [esp + 8]
jl 0x4063ab
jmp 0x40646b
mov edx, 1
jmp 0x4063eb
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x4063d6
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x4063f6
adc eax, 0
cmp edx, eax
jl 0x4063d4
mov eax, dword [esp + 8]
sar eax, 1
jns 0x406405
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x413ac8]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x413ac8]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x413ac8]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x413ac8]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x40646b
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x406450
inc edx
cmp edx, dword [esp + 8]
jl 0x40644e
xor edx, edx
jmp 0x4064a9
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x406473
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x4064a1
cmp ecx, 4
jl 0x406471
cmp ecx, 4
jne 0x4064a9
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x4064b4
cmp esi, 0xa
jle 0x406496
cmp esi, 0xa
jle 0x406333
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4064c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x4160e6]
lea ebx, [ebx*4 + 0x415ce6]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x4164e6]
lea edx, [edx*4 + 0x4168e6]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x4064da
inc eax
cmp eax, 4
jl 0x4064d8
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.00401340
inc esi
cmp esi, 0xa
jl 0x4064d6
add esp, 0x14
pop edi
pop esi
pop ebx
ret