joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00405468
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4028a1
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4028a1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4028a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4028a1
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402828
cmp esi, ecx
jae 0x4028a1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402812
cmp esi, ecx
jae 0x4028a1
movzx eax, word [esi]
test ax, ax
je 0x4028a1
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40285b
push edi
mov ecx, ebx
call fcn.00402bc0
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40285e
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.005431f0
add esp, 0x10
cmp eax, 0x50
ja case.0x40287c.1
movzx eax, byte [eax + 0x4028d0]
jmp dword [eax*4 + 0x4028c0]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4028b1
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004055fa
push 0x80070057
call fcn.004024a0
call fcn.004055e0
sub dword [eax], 0x40
add byte [eax + ebp + 683343936], ch
inc eax
add byte [ebx + 0x4028], bh
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x402990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x402a9a
test eax, 0xffff0000
jne 0x402a9a
push esi
push edi
movzx edi, ax
push edi
call fcn.00405468
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x402a96
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402a96
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402a96
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402a96
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402a29
cmp esi, ecx
jae 0x402a96
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402a17
cmp esi, ecx
jae 0x402a96
movzx eax, word [esi]
test ax, ax
je 0x402a96
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402a5c
push edi
mov ecx, ebx
call fcn.00402bc0
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x402a5f
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.005431f0
add esp, 0x10
cmp eax, 0x50
ja case.0x402a7d.1
movzx eax, byte [eax + 0x402ac8]
jmp dword [eax*4 + 0x402ab8]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402aad
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004055e0
call fcn.004055fa
push 0x80070057
call fcn.004024a0
nop
test byte [edx], ch
inc eax
add byte [eax - 0x5cffbfd6], ch
sub al, byte [eax]
mov dword [0x402a], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3

Function at 0x403420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00416b8f
Function at 0x40dcd7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x40dd16
call fcn.004068b1
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40dd16
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40dd1e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0041f5e6
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40e723
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40e7af
cmp dword [esi + 0x20], 0
je 0x40e7af
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40e7af
cmp dword [ebp + 8], 0
je 0x40e7af
xor edi, edi
mov ebx, edi
call fcn.004068b1
push 0x56c210
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x40e793
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e7af
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.004200fd
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40e7ab
mov ecx, esi
call fcn.0040e4c1
mov eax, edi
jmp 0x40e7b1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x412cd7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x559ca4
call fcn.0053d92e
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x412cfd
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412d57
lea ecx, [ebp - 0x10]
call fcn.00402950
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x56995c]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00544fe0
push eax
call fcn.004023e0
add esp, 0x14
test esi, esi
je 0x412d4a
push esi
call fcn.00544b93
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402580
mov eax, ebx
call fcn.0053d8fc
ret 8
Function at 0x4156b1
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x415704
push esi
push dword [ebp + 8]
call fcn.0041589a
mov edi, eax
test edi, edi
je 0x4156ff
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4156ff
mov eax, dword [ebp - 8]
jmp 0x415716
mov eax, dword [ebp + 0x10]
jmp 0x415716
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x416be7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004068b1
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x416c1a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.00416c2d
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4178ae
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005454c7
pop ecx
test eax, eax
jne 0x4178f0
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x56d0ec
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040bbeb
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4178b6
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x422766
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x4227bc
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x422795
call fcn.0040479a
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4227aa
call fcn.0040479a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4227bc
call fcn.0040479a
call fcn.004068b1
cmp dword [eax + 0x3c], 0
je 0x4227d1
push edi
mov ecx, ebx
call fcn.00421e89
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004229b7
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4227fa
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x422806
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x430817
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00412c1d
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x430853
call fcn.00430a34
mov dword [esi + 0xc], 1
jmp 0x430858
call fcn.00430a34
cmp dword [esi], 0
je 0x4308a3
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x43087e
push edi
call fcn.004054da
lea ecx, [edi + 1]
push ecx
jmp 0x43088d
push 0xff
call fcn.00402b50
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004054fd
pop edi
jmp 0x4308c7
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4308c7
push dword [esi]
push dword [ebp - 4]
call fcn.0041b7ae
pop esi
leave
ret 0xc

Function at 0x43098b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00430a34
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4309d3
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004054da
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004054fd
jmp 0x4309de
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041b7ae
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x44e9eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x44ea04
call fcn.004068b1
mov esi, dword [eax + 0xc]
push 0x5773e8
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x44ea46
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44ea46
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x44ea46
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0044ea4f
jmp 0x44ea48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4e40cd
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x563b9d
call fcn.0053d961
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403c56
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x56b7d8
call fcn.004140df
cmp eax, 0xffffffff
jne 0x4e41a8
push 0
push 0x5773a4
lea ecx, [ebp - 0x4d0]
call fcn.004140df
cmp eax, 0xffffffff
jne 0x4e41a8
push 0
push 0x56c92c
lea ecx, [ebp - 0x4d0]
call fcn.004140df
cmp eax, 0xffffffff
jne 0x4e41a8
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403c56
add eax, 0x10
pop ecx
mov dword [ebp - 0x4d8], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x4d4], edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4e4177
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56995c]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00402580
jmp 0x4e41e1
lea eax, [ebp - 0x218]
push eax
call fcn.00544b93
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00402c20
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00402580
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4e41ce
mov edi, dword [ebp - 0x4cc]
jmp 0x4e41e1
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56995c]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00402580
mov eax, edi
call fcn.0053d910
ret

Function at 0x554116
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00553d93
Function at 0x10005d25
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10005d34
pop dword [ebp - 0x44]
mov eax, 0x10005d34
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x1ee7a0bb
sub dword [ebp - 0x54], 0xd0955b70
mov dword [ebp - 0x50], 0x122459
add dword [ebp - 0x50], 0x322127ec
mov dword [ebp - 0x4c], 0x825271d9
sub dword [ebp - 0x4c], 0x36062dab
mov dword [ebp - 0x48], 0x678b11c0
add dword [ebp - 0x48], 0x9874ee40
lea eax, [ebp - 0x54]
push eax
mov eax, 0xcecaff12
add eax, 0x4135f17a
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc34aa533
sub dword [ebp - 0x54], 0x4ed83bdd
mov dword [ebp - 0x50], 0xb8d5a110
sub dword [ebp - 0x50], 0x77693f9b
mov dword [ebp - 0x4c], 0x1416c471
sub dword [ebp - 0x4c], 0xb0a75805
mov dword [ebp - 0x48], 0x51d7df5f
add dword [ebp - 0x48], 0xae2820a1
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x5393ef7c
sub eax, 0x4392ff38
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37de3
push 0
call eax
mov ecx, 0x59d250ab
add ecx, 0xa62df2c1
mov edx, eax
mov ebx, 0x1001a400
add ebx, dword [ebp - 0x44]
mov edi, 0xc22b2f7
sub edi, 0x76b4c4e4
xor dword [ebp - 0x2c], 0xf5cef9ab
mov esi, dword [ebx]
sub dword [ebp - 4], ebx
xor esi, edi
mov dword [edx], esi
add dword [ebp - 0x3c], ecx
add edx, 4
add ebx, 0x728f03f5
add ebx, 0x8d70fc0f
loop 0x10005e4b
add eax, 0xf8bd347
sub eax, 0xf8ad2c4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x100d6754
sub ecx, 0xd6754
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10043e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10043e7f
pop dword [ebp - 8]
mov eax, 0x16abc37e
add eax, 0xf9587b01
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd28ff420
add dword [ebp - 0x18], 0x7bc2512b
mov dword [ebp - 0x14], 0x5f6e3bd1
sub dword [ebp - 0x14], 0x2d3aef8c
mov dword [ebp - 0x10], 0x3b99ab15
add dword [ebp - 0x10], 0x10b29919
mov dword [ebp - 0xc], 0x67dfe61c
add dword [ebp - 0xc], 0x982019e4
lea eax, [ebp - 0x18]
push eax
mov eax, 0xab2f0e23
add eax, 0x64d6f1ed
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xbab4da95
sub dword [ebp - 0x18], 0x4642713f
mov dword [ebp - 0x14], 0x19682adf
sub dword [ebp - 0x14], 0xd7fbc96a
mov dword [ebp - 0x10], 0xe050c9f4
add dword [ebp - 0x10], 0x831ea278
mov dword [ebp - 0xc], 0x3f0aae36
sub dword [ebp - 0xc], 0x3f0aae36
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x55a26
push 0
call eax
mov ecx, 0x6970db68
sub ecx, 0x6970940e
mov esi, eax
mov edx, 0x1008bc00
add edx, dword [ebp - 8]
mov edi, 0x27d6dbbc
sub edi, 0x6f060404
mov dword [ebp - 4], 0x4ac72d2d
mov ebx, dword [edx]
sub dword [ebp - 4], 0x60462673
xor ebx, edi
add dword [ebp - 4], 0xd6eeceb
mov dword [esi], ebx
xor dword [ebp - 4], 0x42e93d42
add esi, 4
add edx, 4
loop 0x10043f96
add eax, 0x1103b
xor ebx, ebx
add ebx, eax
add eax, 0x60cc0088
sub eax, 0x60cc0083
mov ecx, 0x5a6f8261
sub ecx, 0x4a6f8261
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x405a12
pop dword [ebp - 0x34]
mov eax, 0xcf6eec17
sub eax, 0xcf2e9205
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x439a11f5
add dword [ebp - 0x44], 0xab83356
mov dword [ebp - 0x40], 0x6c4c8d91
sub dword [ebp - 0x40], 0x3a19414c
mov dword [ebp - 0x3c], 0x4bb6c938
add dword [ebp - 0x3c], 0x957af6
mov dword [ebp - 0x38], 0xbd0ed6d6
add dword [ebp - 0x38], 0x42f1292a
lea eax, [ebp - 0x44]
push eax
mov eax, 0x30a66d3c
sub eax, 0x3065ec38
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xdedecea7
add dword [ebp - 0x44], 0x95939aaf
mov dword [ebp - 0x40], 0x48216a13
add dword [ebp - 0x40], 0xf94af762
mov dword [ebp - 0x3c], 0x251e8b3a
sub dword [ebp - 0x3c], 0xc1af1ece
mov dword [ebp - 0x38], 0x90340cd0
add dword [ebp - 0x38], 0x6fcbf330
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x342d4
push 0
call eax
mov ecx, 0x1e431342
add ecx, 0xe1bd2987
mov ebx, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x34]
mov edx, 0xaa4da17
sub edx, 0xb41549ce
add dword [ebp - 0x28], 0x6ebbd9ca
mov edi, dword [esi]
sub edi, edx
xor dword [ebp - 0x20], 0xb369c2d6
mov dword [ebx], edi
xor dword [ebp - 0x30], ecx
add ebx, 4
add esi, 0xf215c227
add esi, 0xdea3ddd
loop 0x405b29
add eax, 0xe5f7
xor ebx, ebx
add ebx, eax
add eax, 0x2d9023bf
add eax, 0xd26fdc46
mov ecx, 0x6d810a9d
add ecx, 0x92bef563
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc