joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449ac9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043e21c
xor ebx, ebx
cmp dword [0x4737fc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x449b9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x449c7f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x449c7f
push eax
call fcn.0043e1ae
mov dword [esp], 0x459a78
push edi
mov dword [0x4737fc], eax
call esi
push eax
call fcn.0043e1ae
mov dword [esp], 0x459a64
push edi
mov dword [0x473800], eax
call esi
push eax
call fcn.0043e1ae
mov dword [0x473804], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00438416
test eax, eax
pop ecx
pop ecx
je 0x449b6d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043e8ee
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x449b9f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043e1ae
cmp eax, ebx
pop ecx
mov dword [0x47380c], eax
je 0x449b9f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043e1ae
pop ecx
mov dword [0x473808], eax
mov eax, dword [0x473808]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x449c24
cmp dword [0x47380c], ecx
je 0x449c24
push eax
call fcn.0043e225
push dword [0x47380c]
mov esi, eax
call fcn.0043e225
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x449c24
cmp edi, ebx
je 0x449c24
call esi
cmp eax, ebx
je 0x449bf1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x449bf1
test byte [ebp - 0x18], 1
jne 0x449c24
lea eax, [ebp - 0x10]
push eax
call fcn.0043844d
test eax, eax
pop ecx
je 0x449c0c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043e8ee
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x449c1b
or dword [ebp + 0x10], 0x200000
jmp 0x449c5f
or dword [ebp + 0x10], 0x40000
jmp 0x449c5f
mov eax, dword [0x473800]
cmp eax, dword [ebp - 8]
je 0x449c5f
push eax
call fcn.0043e225
cmp eax, ebx
pop ecx
je 0x449c5f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x449c5f
mov eax, dword [0x473804]
cmp eax, dword [ebp - 8]
je 0x449c5f
push eax
call fcn.0043e225
cmp eax, ebx
pop ecx
je 0x449c5f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4737fc]
call fcn.0043e225
cmp eax, ebx
pop ecx
je 0x449c7f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x449c81
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x4162b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4162ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4162d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4162c0
mov eax, 1
add ebx, ebx
jne 0x4162e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4162d8
jne 0x4162f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4162d8
xor ecx, ecx
sub eax, 3
jb 0x416308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41637a
mov ebp, eax
add ebx, ebx
jne 0x416313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416344
inc ecx
add ebx, ebx
jne 0x416330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416325
jne 0x416341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416355
jmp 0x4162c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416364
add edi, ecx
jmp 0x4162c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x4163c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0x4163bd
mov dword [ebx], eax
add ebx, 4
jmp 0x41639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4163f4
cmp al, 0xef
ja 0x4163e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4163c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4163d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416428
sub esp, 0xffffff80
jmp 0x405dd2
Function at 0x10017700
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001772d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001772d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4324b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x4324ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4324d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4324c0
mov eax, 1
add ebx, ebx
jne 0x4324e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4324d8
jne 0x4324f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4324d8
xor ecx, ecx
sub eax, 3
jb 0x432508
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43257a
mov ebp, eax
add ebx, ebx
jne 0x432513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x432520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x432544
inc ecx
add ebx, ebx
jne 0x432530
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x432525
jne 0x432541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x432525
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x432564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x432555
jmp 0x4324c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x432564
add edi, ecx
jmp 0x4324c6
pop esi
lea edi, [esi + 0x30000]
mov eax, dword [edi]
or eax, eax
je 0x4325cc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32fcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33008]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x432581
mov ecx, edi
jns 0x4325b0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33010]
or eax, eax
je 0x4325c6
mov dword [ebx], eax
add ebx, 4
jmp 0x43259e
call dword [esi + 0x3300c]
mov ebp, dword [esi + 0x33014]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x432600
sub esp, 0xffffff80
jmp 0x403670
Function at 0xfc62b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0xfc62ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xfc62d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfc62c0
mov eax, 1
add ebx, ebx
jne 0xfc62e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xfc62d8
jne 0xfc62f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfc62d8
xor ecx, ecx
sub eax, 3
jb 0xfc6308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xfc637a
mov ebp, eax
add ebx, ebx
jne 0xfc6313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xfc6320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xfc6344
inc ecx
add ebx, ebx
jne 0xfc6330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xfc6325
jne 0xfc6341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfc6325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xfc6364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xfc6355
jmp 0xfc62c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xfc6364
add edi, ecx
jmp 0xfc62c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0xfc63c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xfc6381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0xfc63bd
mov dword [ebx], eax
add ebx, 4
jmp 0xfc639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xfc63f4
cmp al, 0xef
ja 0xfc63e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xfc63c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xfc63d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xfc6428
sub esp, 0xffffff80
jmp 0xfb5dd2
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403203
pop dword [ebp - 0x1c]
mov eax, 0x403203
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd027b42f
sub dword [ebp - 0x2c], 0x81d56ee4
mov dword [ebp - 0x28], 0xd646794b
sub dword [ebp - 0x28], 0xa4132d06
mov dword [ebp - 0x24], 0xb9e0124
add dword [ebp - 0x24], 0x40ae430a
mov dword [ebp - 0x20], 0xe9d5a79f
add dword [ebp - 0x20], 0x162a5861
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xcc9065e8
add eax, 0x33b01aa4
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x4f819a87
sub dword [ebp - 0x2c], 0xdb0f3131
mov dword [ebp - 0x28], 0xccb49309
add dword [ebp - 0x28], 0x74b7ce6c
mov dword [ebp - 0x24], 0xfa4d3012
sub dword [ebp - 0x24], 0x96ddc3a6
mov dword [ebp - 0x20], 0xe9fc0ade
sub dword [ebp - 0x20], 0xe9fc0ade
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x27346d20
sub eax, 0x26f3ec4c
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39779
push 0
call eax
mov ecx, 0xc775e6e4
sub ecx, 0xc7759366
xor ebx, ebx
add ebx, eax
mov edi, 0x38737ed8
add edi, 0xc7cd9128
add edi, dword [ebp - 0x1c]
mov edx, 0x2be204b8
sub dword [ebp - 0x18], ebx
mov esi, dword [edi]
xor dword [ebp - 0x10], edx
xor esi, edx
xor dword [ebp - 8], esi
mov dword [ebx], esi
xor dword [ebp - 8], esi
add ebx, 0x7b1c27da
sub ebx, 0x7b1c27d6
add edi, 0xa754610f
add edi, 0x58ab9ef5
loop 0x40331c
add eax, 0x140cb
mov ebx, eax
add eax, 0x993559b3
sub eax, 0x993559ae
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x404893
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
call fcn.0040480b
xor eax, eax
mov edx, dword [eax + 0x426490]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x4048a0
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x40556c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x405599
test cl, 7
je 0x405599
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x42c2a0]
dec esi
inc ecx
jmp 0x40557a
cmp esi, 8
jb 0x40563c
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x42c6a0]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x42c2a0]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x42caa0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x42d2a0]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x42d6a0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x42daa0]
movzx edx, dl
xor edi, dword [edx*4 + 0x42cea0]
movzx eax, al
xor edi, dword [eax*4 + 0x42dea0]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x4055ab
pop ebx
jmp 0x40563c
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x42c2a0]
dec esi
inc ecx
test esi, esi
ja 0x405628
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x405963
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x4059ad
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041036f
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410671
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004106ea
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x4059cd
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x4059bc
cmp esi, ebx
jae 0x4059e5
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.00419f50
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.0041036f
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410671
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.00410671
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.004106ea
lea eax, [ebp - 0x160]
push eax
call fcn.0041036f
xor ecx, ecx
test esi, esi
jbe 0x405a4f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405a3e
pop edi
cmp esi, ebx
jae 0x405a68
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.00419f50
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00410671
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00410671
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.004106ea
pop esi
pop ebx
leave
ret 0x14
Function at 0x405aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x405ab9
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041b990
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405963
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041b990
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405b70
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405963
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041b990
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405b5e
dec dword [ebp + 0x6c]
jne 0x405b37
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041b990
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405b2c
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040cb9a
push esi
lea eax, [ebp]
push eax
call fcn.0040cb9a
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040cb9a
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040cb9a
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20
Function at 0x405bbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp edi, 0x18
ja 0x405d64
and dword [ebp + 0x1c], 0
push esi
lea esi, [ebx + 0x102]
cmp dword [esi + 0x12], edi
jne 0x405c0b
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0040cc69
test al, al
je 0x405c0b
push 0x10
push dword [ebp + 0x14]
push esi
call fcn.0041a304
add esp, 0xc
test eax, eax
je 0x405d6a
inc dword [ebp + 0x1c]
add ebx, 0x178
cmp dword [ebp + 0x1c], 4
jb 0x405bdc
mov esi, 0x200
push esi
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 0x10]
call fcn.0041130d
xor eax, eax
inc eax
mov ecx, edi
shl eax, cl
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x264]
push eax
call fcn.0041a160
pop ecx
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00405aa0
push esi
lea eax, [ebp - 0x264]
push eax
call fcn.0040cb9a
mov edx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
lea eax, [edx + 0x5e0]
mov ecx, dword [eax]
mov ebx, ecx
and ebx, 3
imul ebx, ebx, 0x178
add ebx, edx
inc ecx
mov dword [eax], ecx
push 0x40
mov dword [ebx + 0x114], edi
pop ecx
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x102]
push eax
movsw word es:[edi], word [esi]
call fcn.0041b990
push 0x20
pop esi
push esi
lea eax, [ebp - 0x24]
push eax
lea edi, [ebx + 0x118]
push edi
call fcn.0041b990
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.0041b990
push esi
lea eax, [ebp - 0x64]
push eax
add ebx, 0x158
push ebx
call fcn.0041b990
add esp, 0x30
push 1
push esi
push edi
call fcn.0040caf4
xor ebx, ebx
cmp dword [ebp + 0x20], ebx
je 0x405d06
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x20]
call fcn.0041b990
add esp, 0xc
mov edi, dword [ebp + 0x24]
cmp edi, ebx
je 0x405d37
push 8
push ebx
push edi
call fcn.00419f50
add esp, 0xc
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x44]
mov eax, ecx
and eax, 7
add eax, edi
xor byte [eax], dl
inc ecx
cmp ecx, esi
jb 0x405d1b
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.0040cb9a
cmp dword [ebp + 0x18], ebx
je 0x405d59
push dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
push 0x100
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
add ecx, 0x5e8
call fcn.0040c947
push esi
lea eax, [ebp - 0x24]
push eax
call fcn.0040cb9a
pop esi
pop edi
pop ebx
leave
ret 0x20
push 0
push 0x20
pop esi
push esi
lea edi, [ebx + 0x118]
push edi
call fcn.0040caf4
push esi
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0041b990
add esp, 0xc
push 1
push esi
push edi
call fcn.0040caf4
push esi
lea eax, [ebx + 0x138]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0041b990
push esi
add ebx, 0x158
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.0041b990
add esp, 0x18
jmp 0x405cef
Function at 0x405e37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x405e89
lea eax, [ebp + 8]
push eax
push dword [esi + 4]
call fcn.00404870
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.00405963
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x405e6e
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x405eb1
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.00405963
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041b990
add esp, 0xc
pop esi
leave
ret 8

Function at 0x4061f6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a1f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x40626c
push esi
push dword [ebp + 8]
call fcn.00419ed3
pop ecx
push dword [ebp + 8]
mov esi, eax
call fcn.0040a563
test al, al
jne 0x406249
lea eax, [ebp - 0x1000]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.00419ed3
pop ecx
lea esi, [esi + eax + 1]
mov eax, 0x104
cmp esi, eax
pop esi
jbe 0x40626c
push eax
push 0xc3
call fcn.0040c098
push eax
push 0x426558
call fcn.0040dfa8
add esp, 0xc
leave
ret 4