joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eb20
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5a665b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov ecx, 0x60d1c8
call fcn.00413d60
push 0x18
call fcn.0058f5f0
add esp, 4
mov dword [0x5fff30], eax
xor esi, esi
mov eax, dword [0x5fff30]
push 0x20
mov dword [eax + esi*4], 0
call fcn.0058f5f0
mov ecx, dword [0x5fff30]
add esp, 4
lea edx, [esi + 0x2a]
mov dword [ecx + esi*4], eax
mov ecx, dword [0x60d19c]
push edx
call fcn.004fef50
mov ecx, dword [0x5fff30]
mov edx, dword [ecx + esi*4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x40eb90
inc esi
cmp esi, 6
jl 0x40eb52
mov ecx, 0x60d1a4
call fcn.004101e0
test eax, eax
je 0x40ebc0
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, 0x8e6630
call fcn.004afd40
push 0x1c
mov byte [0x8e8ed8], 1
call fcn.0058f5cc
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x40ebf6
mov ecx, eax
call fcn.0040ea40
mov esi, eax
jmp 0x40ebf8
xor esi, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.00506020
push str.run.tmp
mov dword [eax + 0x18], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 4
call fcn.0058f5f0
push str.PDLL.DLL
mov dword [0xafa424], eax
call fcn.004fecc0
mov edx, dword [0xafa424]
mov dword [edx], eax
mov eax, dword [0xafa424]
mov ecx, dword [eax]
add esp, 8
test ecx, ecx
jne 0x40ec55
push eax
call fcn.0058fcbe
add esp, 4
xor eax, eax
mov dword [0xafa424], eax
mov dword [eax], 1
mov ecx, dword [esp + 8]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40f690
Capabilities:
Delete file

Disassembly:
cmp dword [0x8c2900], 1
je 0x40f7b8
push 0
push 0
mov dword [0x8c2900], 1
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
mov eax, dword [0x5ffea8]
test eax, eax
mov byte [0x6fecf4], 1
je 0x40f6e1
mov ecx, 0x8e95d8
call fcn.0040f560
mov eax, dword [0x5ffea8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5ffea8], 0
mov ecx, 0x5f9940
call fcn.005054d0
test eax, eax
je 0x40f700
mov ecx, 0x5f9940
call fcn.00505720
mov byte [0x5f0309], 0
mov al, byte [0x60d17d]
test al, al
je 0x40f71a
push 1
mov byte [0x5f0309], 0
call fcn.004e54c0
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.fc.pbd
call esi
push str.run.tmp
call esi
mov ecx, dword [0x5fff30]
test ecx, ecx
je 0x40f767
xor esi, esi
jmp 0x40f740
mov eax, dword [esi + ecx]
test eax, eax
je 0x40f756
push eax
call fcn.0058fcbe
mov ecx, dword [0x5fff30]
add esp, 4
add esi, 4
cmp esi, 0x18
jl 0x40f740
push ecx
call fcn.0058fcbe
add esp, 4
mov ecx, dword [0x60d19c]
test ecx, ecx
je 0x40f781
mov esi, ecx
call fcn.004fef10
push esi
call fcn.0058fcbe
add esp, 4
mov ecx, 0xafa588
call fcn.00509390
mov eax, dword [0xafa424]
cmp dword [eax], 0
pop esi
je 0x40f7ae
push eax
call fcn.0058fcbe
add esp, 4
mov dword [0xafa424], 0
call fcn.004fed10
mov ecx, 0x5f9940
jmp fcn.005055b0
ret
Function at 0x40f870
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x1c
call fcn.0040d960
test eax, eax
je 0x40f8e4
call fcn.0040db90
mov eax, dword [esp + 0x28]
push eax
call fcn.0040eda0
add esp, 4
test eax, eax
je 0x40f8e4
call fcn.0040e070
test eax, eax
je 0x40f8e4
push str.f700
call dword [sym.imp.XExp.dll_void___cdecl_fnXExpSetLogName_char__]
push str.Fortress_Adventure_:_Debugging_Enabled__r_n_______________APP_VER_00000000000000000000000000000000000000000000000000000000000000000000000
call dword [sym.imp.XExp.dll_void___cdecl_fnXExpSetDescription_char__]
push str.F700
push str.logplusccr247
push str.ccrlogftp
push 0x15
push str.211.117.61.247
call dword [sym.imp.XExp.dll_void___cdecl_fnXExpSetFtpConnection_char___unsigned_int__char___char___char__]
push 0x40da40
call dword [sym.imp.XExp.dll_void___cdecl_fnXExpSetCallbackFunc_void____cdecl___void__]
add esp, 0x20
call fcn.0040d6e0
test eax, eax
jne 0x40f8ec
xor eax, eax
add esp, 0x1c
ret 0x10
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x28]
push esi
push edi
call fcn.0040f7c0
add esp, 8
test eax, eax
je 0x40f94f
call fcn.0040d770
mov ecx, 0x5f9940
call fcn.005056a0
test eax, eax
jne 0x40f959
push eax
push 0x5b6230
push 0x5b61e0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push str.http:__fortress.x2game.com_common_executeX2Chat.asp
push str.IEXPLORE.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.run.tmp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
push esi
push edi
call fcn.0040eb20
add esp, 8
test eax, eax
je 0x40f94f
mov eax, dword [0x5f0470]
test eax, eax
je 0x40f9fb
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, edi
mov al, byte [0x816f6c]
test al, al
jne 0x40f9a1
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
je 0x40f9e6
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call ebp
test eax, eax
je 0x40f9e6
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
call ebx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call esi
test eax, eax
jne 0x40f9b4
mov ecx, 0x60d1a4
call fcn.004103a0
mov eax, dword [0x5f0470]
test eax, eax
jne 0x40f990
pop ebp
pop ebx
call fcn.0040f690
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret 0x10
Function at 0x410b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x410b53
mov eax, 0x80004005
pop edi
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
cmp ebp, 0x200
push esi
jne 0x410ba2
mov edx, dword [0x8c311c]
mov esi, dword [0x8c3120]
movsx eax, bx
mov ecx, ebx
sar ecx, 0x10
mov dword [0x8c311c], eax
sub eax, edx
mov dword [0x8c3120], ecx
sub ecx, esi
mov dword [0x8c3124], edx
mov dword [0x8c3128], esi
mov dword [0x8c3114], eax
mov dword [0x8c3118], ecx
jmp 0x410bcc
cmp ebp, 0x201
jne 0x410bcc
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [edi + 0x1a0]
cmp eax, 0xfa
jae 0x410bc4
mov ebp, 0x203
call esi
mov dword [edi + 0x1a0], eax
mov ecx, dword [edi + 4]
lea eax, [ecx + 0x324]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x410bd8
sub eax, esi
mov dword [esp + 0x1c], eax
jne 0x410bfa
test ecx, ecx
je 0x410bfa
mov edx, dword [esp + 0x18]
mov eax, dword [ecx]
push ebx
push edx
push ebp
call dword [eax + 0xc8]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
ret 0xc
Function at 0x413d60
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
lea eax, [esp + 0x28]
push eax
mov ebx, ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x2c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, dword [esp + 0x30]
push edi
push 0x5d4788
lea ecx, [esp + 0x14]
push ecx
push edi
shr esi, 0x14
mov dword [esp + 0x1c], edi
call sub.DDRAW.dll_DirectDrawCreateEx
test eax, eax
jl 0x413e1a
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0x10004000
mov ecx, dword [eax]
push eax
call dword [ecx + 0x5c]
test eax, eax
jl 0x413e1a
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x413dfe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [esp + 0x10]
imul esi, esi, 0x3e8
shr edx, 0x14
add esi, edx
push edi
mov dword [ebx + 0xed708], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x4154b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x5fe940]
push ebx
push ebp
push esi
push edi
push 0
push 0x80
mov ebp, ecx
push 3
push 0
mov dword [esp + 0x3c], eax
xor eax, eax
push 1
mov dword [ebp + 0xae024], 1
lea edi, [ebp + 0x97424]
mov ecx, 0x5a00
rep stosd dword es:[edi], eax
lea ebx, [ebp + 0xadc24]
push SysReAllocString
or eax, 0xffffffff
mov ecx, 0x100
mov edi, ebx
push str.common.txt
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2f], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4156bb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0x14], eax
je 0x415583
push eax
call fcn.0058f5f0
mov ecx, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
push edi
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415587
push edi
call fcn.00590179
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.005900c7
add esp, 0x20
ret
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp edx, ecx
mov dword [esp + 0x24], ecx
jle 0x41565b
mov esi, 0xfff523dc
sub esi, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], esi
nop
mov al, byte [ecx + edi]
cmp al, 0xa
je 0x415621
cmp al, 0xd
je 0x41564e
cmp byte [esp + 0x13], 0
je 0x415601
cmp al, 0x59
jne 0x4155cf
mov byte [ebx], 1
jmp 0x41564e
cmp al, 0x52
jne 0x4155d8
mov byte [ebx], 2
jmp 0x41564e
cmp al, 0x42
jne 0x4155e1
mov byte [ebx], 3
jmp 0x41564e
cmp al, 0x47
jne 0x4155ea
mov byte [ebx], 4
jmp 0x41564e
cmp al, 0x44
jne 0x4155f3
mov byte [ebx], 0
jmp 0x41564e
cmp al, 0x57
jne 0x4155fc
mov byte [ebx], 0xff
jmp 0x41564e
mov byte [esp + 0x13], 0
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add esi, ecx
inc ecx
mov byte [esi + ebp + 0x97424], al
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x24]
jmp 0x41564e
mov eax, dword [esp + 0x14]
add eax, 0x5a
inc ebx
mov dword [esp + 0x14], eax
lea eax, [esi + ebx]
cmp eax, 0x3fe
jl 0x41563b
mov ecx, edx
jmp 0x41564e
inc dword [ebp + 0xae024]
mov byte [esp + 0x13], 1
mov dword [esp + 0x20], 0
inc ecx
cmp ecx, edx
mov dword [esp + 0x24], ecx
jl 0x4155b0
mov ecx, dword [ebp + 0xae024]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
jle 0x4156b2
lea edx, [ebp + 0x97424]
mov edi, str._yellow_notice_
mov esi, edx
mov ecx, 0x10
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x415693
mov ecx, dword [ebp + 0xae024]
inc eax
add edx, 0x5a
cmp eax, ecx
jl 0x415671
jmp 0x4156ae
lea ecx, [eax + 1]
mov dword [ebp + 0xae028], ecx
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov dword [ebp + 0xae02c], ecx
mov dword [ebp + 0xae024], eax
mov edi, dword [esp + 0x18]
push edi
call fcn.00590179
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
call fcn.005900c7
add esp, 0x20
ret
Function at 0x4169d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5a763e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [esp], ecx
mov edx, 9
mov dword [esp + 0x10], edx
lea eax, [ecx + 0x78]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 8
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x6c]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 7
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x60]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 6
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x54]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 5
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x48]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 4
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x3c]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 3
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x30]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 2
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x24]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dl, 1
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0x18]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
xor dl, dl
mov dword [eax], 0x5b5f30
mov byte [esp + 0x10], dl
lea eax, [ecx + 0xc]
mov dword [esp + 4], eax
mov dword [eax], 0x5b60dc
mov byte [esp + 0x10], dl
mov dword [eax], 0x5b5f30
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [ecx], 0x5b60dc
mov dword [esp + 0x10], eax
mov dword [ecx], 0x5b5f30
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4192e0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a872e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, ecx
xor ecx, ecx
push esi
mov dword [esp + 4], eax
mov dword [eax], 0x5b5f30
mov dword [eax + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [eax], 0x5b60dc
mov edx, dword [0xaf9600]
mov dword [eax + 8], edx
inc dword [0xaf9600]
mov dword [esp + 0x14], 1
lea edx, [eax + 0xc]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 2
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 3
lea edx, [eax + 0x18]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 4
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 5
lea edx, [eax + 0x24]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 6
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 7
lea edx, [eax + 0x30]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 8
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 9
lea edx, [eax + 0x3c]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 0xa
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 0xb
lea edx, [eax + 0x48]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 0xc
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 0xd
lea edx, [eax + 0x54]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 0xe
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 0xf
lea edx, [eax + 0x60]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 0x10
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 0x11
lea edx, [eax + 0x6c]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 0x12
mov dword [edx], 0x5b60dc
mov esi, dword [0xaf9600]
mov dword [edx + 8], esi
inc dword [0xaf9600]
mov byte [esp + 0x14], 0x13
lea edx, [eax + 0x78]
mov dword [esp + 8], edx
mov dword [edx], 0x5b5f30
mov dword [edx + 4], ecx
mov byte [esp + 0x14], 0x14
mov dword [edx], 0x5b60dc
mov ecx, dword [0xaf9600]
mov dword [edx + 8], ecx
inc dword [0xaf9600]
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x419570
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5a8863
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004173d0
mov dword [esp + 0x18], 0
mov dword [esi], 0x5b79a8
mov dword [esp + 0x18], 1
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 2
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 3
lea edi, [esi + 0x20]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 4
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 5
lea edi, [esi + 0x30]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 6
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 7
lea edi, [esi + 0x40]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 8
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 9
lea edi, [esi + 0x50]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0xa
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0xb
lea edi, [esi + 0x60]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0xc
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0xd
lea edi, [esi + 0x70]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0xe
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0xf
lea edi, [esi + 0x80]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0x10
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0x11
lea edi, [esi + 0x90]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0x12
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0x13
lea edi, [esi + 0xa0]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0x14
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0x15
lea edi, [esi + 0xb0]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0x16
mov dword [edi], 0x5b79a8
mov byte [esp + 0x18], 0x17
lea edi, [esi + 0xc0]
mov ecx, edi
mov dword [esp + 0xc], edi
call fcn.004173d0
mov byte [esp + 0x18], 0x18
mov dword [edi], 0x5b79a8
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x41a460
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx + 0x97040]
mov byte [ecx + 0x97038], al
mov dl, byte [ecx + 0x97041]
mov byte [ecx + 0x9703c], dl
mov al, byte [ecx + 0x97040]
mov byte [ecx + 0x97039], al
mov dl, byte [ecx + 0x97041]
mov byte [ecx + 0x9703d], dl
mov al, byte [ecx + 0x97040]
mov byte [ecx + 0x9703a], al
mov dl, byte [ecx + 0x97041]
mov byte [ecx + 0x9703e], dl
mov al, byte [ecx + 0x97040]
mov byte [ecx + 0x9703b], al
mov dl, byte [ecx + 0x97041]
mov byte [ecx + 0x9703f], dl
mov al, byte [ecx + 0x97050]
mov byte [ecx + 0x97048], al
mov dl, byte [ecx + 0x97051]
mov byte [ecx + 0x9704c], dl
mov al, byte [ecx + 0x97050]
mov byte [ecx + 0x97049], al
mov dl, byte [ecx + 0x97051]
mov byte [ecx + 0x9704d], dl
mov al, byte [ecx + 0x97050]
mov byte [ecx + 0x9704a], al
mov dl, byte [ecx + 0x97051]
mov byte [ecx + 0x9704e], dl
mov al, byte [ecx + 0x97050]
mov byte [ecx + 0x9704b], al
mov dl, byte [ecx + 0x97051]
xor eax, eax
mov byte [ecx + 0x9704f], dl
mov dword [ecx + 0x97378], eax
mov dword [ecx + 0x970a4], eax
mov dword [ecx + 0x970b0], eax
mov dword [ecx + 0x973a8], eax
mov dword [ecx + 0x973b4], eax
mov dword [ecx + 0x973c0], eax
mov dword [ecx + 0x973cc], eax
mov dword [ecx + 0x973d8], eax
mov dword [ecx + 0x973e4], eax
jmp fcn.00419810
Function at 0x4368c0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2efc
call fcn.00590180
mov eax, dword [0x5fe940]
mov dword [esp + 0x2ef8], eax
push ebx
xor eax, eax
push esi
push edi
mov byte [esp + 0x10], 0
mov ecx, 0x1ff
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1010], 0
mov ecx, 0x7bb
lea edi, [esp + 0x1011]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
mov dword [esp + 0xc], 0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x436920
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x436931
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x436993
lea edi, [esp + 0x1010]
mov bl, 0x5c
jmp 0x436950
mov cl, byte [esp + eax + 0x10]
cmp cl, 0x2e
jne 0x436962
cmp byte [esp + eax + 0x11], bl
jne 0x436962
inc eax
jmp 0x43698f
cmp cl, bl
je 0x43696b
cmp cl, 0x2f
jne 0x43696c
inc eax
xor edx, edx
cmp eax, esi
jge 0x436988
mov cl, byte [esp + eax + 0x10]
cmp cl, bl
je 0x436988
cmp cl, 0x2f
je 0x436988
inc eax
mov byte [edi + edx], cl
inc edx
cmp eax, esi
jl 0x436972
inc dword [esp + 0xc]
add edi, 0x63
cmp eax, esi
jl 0x436950
push 0x8c2910
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x1ff
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x810], 0
mov ecx, 0x1ff
lea edi, [esp + 0x811]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push 0x8c2910
push eax
call fcn.0059000d
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
jle 0x436a61
mov ecx, eax
lea ebx, [esp + 0x1010]
mov dword [esp + 0xc], ecx
push ebx
call fcn.005a5e70
push ebx
lea edx, [esp + 0x818]
push 0x5b8710
push edx
call fcn.0059000d
lea eax, [esp + 0x820]
add esp, 0x10
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x436a20
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x436a30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0xc]
add ebx, 0x63
dec eax
mov dword [esp + 0xc], eax
jne 0x4369f5
mov ecx, dword [esp + 0x2f04]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret