joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407800
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4825c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.00462853
mov edi, dword [esp + 0x38]
cmp edi, ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.FNPNS::EXCEPT::CFnpException.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
jne 0x407864
mov edi, 0x48a824
lea ecx, [esi + 0x18]
mov eax, edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
lea ebp, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x407880
sub eax, ebp
push eax
push edi
call fcn.004067f0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10

Function at 0x409cf0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x482b0c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], vtable.FNPNS::ASC::CNamedPipeServer.0
lea ecx, [edi + 0x30]
mov dword [esp + 0x24], 3
call fcn.00440d10
mov eax, dword [edi + 0x28]
mov ecx, dword [eax]
lea esi, [edi + 0x24]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov byte [esp + 0x38], 2
call fcn.00407f00
mov eax, dword [esi + 4]
push eax
call fcn.00457e3b
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax]
add esp, 4
lea esi, [edi + 0x18]
push eax
push esi
push ecx
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov byte [esp + 0x38], 1
call fcn.0042b870
mov eax, dword [esi + 4]
push eax
call fcn.00457e3b
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [edi + 0x14]
add esp, 4
cmp esi, ebx
mov byte [esp + 0x24], bl
je 0x409dc7
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x409dc7
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x409dc7
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov edi, dword [edi + 0xc]
cmp edi, ebx
mov dword [esp + 0x24], 0xffffffff
je 0x409e00
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x409e00
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x409e00
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x40a840
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x14
lea eax, [esp + 4]
push eax
mov dword [esp + 0xc], 0x40a4b0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 8], str.FLEXnet_Licensing_Service
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x40a8b5
push esi
push str.FLEXnet_Licensing_Service
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
mov dword [esp + 4], str.StartServiceCtrlDispatcher___failed
je 0x40a8ae
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
xor eax, eax
pop esi
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret

Function at 0x40b900
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4db114
call esi
push 0x4db0fc
call esi
push 0
push 0
push 0
push 0x40b890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x40c880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x482dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x64]
push edi
lea ecx, [esp + 0x20]
call fcn.0040c6d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x5c], 0
call fcn.0040bc70
push edi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 1
call fcn.0040c6d0
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
lea ecx, [esi + 0x10]
mov byte [esp + 0x6c], 2
mov dword [esp + 0x74], 0x45dbf1e4
call fcn.0040c450
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
push 0xd21c863c
push 0x6d1a1963
push 0xce51d022
lea ecx, [esp + 0x30]
call edx
mov edx, dword [esi + 8]
lea ecx, [esi + 8]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x54
ret 4
Function at 0x419e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4835a8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x80]
lea eax, [esp + 0x17]
push eax
push ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0x1f], 0
call fcn.004199f0
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
xor edi, edi
mov dword [esp + 0x68], edi
test ebp, ebp
je 0x419e8e
cmp ebp, dword [esp + 0x78]
je 0x419e93
call fcn.00462d29
cmp esi, dword [esp + 0x7c]
je 0x419ee2
cmp edi, ebx
je 0x419f14
test ebp, ebp
jne 0x419ea6
call fcn.00462d29
cmp esi, dword [ebp + 8]
jb 0x419eb0
call fcn.00462d29
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x419ec2
mov eax, dword [esp + 0x24]
sub eax, ecx
cmp edi, eax
jb 0x419ecb
call fcn.00462d29
mov ecx, dword [esp + 0x20]
mov dl, byte [esi]
mov byte [ecx + edi], dl
cmp esi, dword [ebp + 8]
jb 0x419eda
call fcn.00462d29
add esi, 1
add edi, 1
jmp 0x419e84
cmp edi, ebx
je 0x419f14
push 0x48a824
push 0
push 0x100
push 0
lea ecx, [esp + 0x3c]
call fcn.00407800
push 0x4bec24
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], vtable.CEnsureFailureException.0
call fcn.00460abe
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
call dword [esp + 0x88]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x419f35
push eax
call fcn.00457e3b
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x18
Function at 0x42ac80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x486428
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0042a4b0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
xor edx, edx
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov dword [esp + 0x24], edx
mov byte [ecx + 4], dl
call fcn.00406710
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x42c370
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x486708
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4d8eb0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov eax, dword [esp + 0x84]
push 4
xor ebp, ebp
push str._tmp
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebp
mov byte [esp + 0x44], 0
call fcn.004067f0
push 0x104
mov dword [esp + 0x80], ebp
call fcn.00457e36
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
add esp, 4
mov esi, eax
push esi
push 0x104
call ebx
mov edi, eax
cmp edi, ebp
jne 0x42c407
push 3
push 0x48c43c
jmp 0x42c442
cmp edi, 0x104
jb 0x42c430
nop
push esi
call fcn.00457e3b
lea ebp, [edi + 1]
push ebp
call fcn.00457e36
add esp, 8
mov esi, eax
push esi
push ebp
call ebx
mov edi, eax
cmp edi, ebp
jae 0x42c410
xor ebp, ebp
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42c435
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.004067f0
push esi
call fcn.00457e3b
add esp, 4
push 0x457920
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x5c]
call fcn.0042b790
push 0x457920
mov bl, 1
push str.libFNP_events.log
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], bl
call fcn.0042a6f0
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0x7c], 2
jb 0x42c497
mov eax, dword [eax + 4]
jmp 0x42c49a
add eax, 4
push eax
lea ecx, [esp + 0x58]
call fcn.0042a0d0
cmp dword [esp + 0x34], esi
mov byte [esp + 0x7c], bl
jb 0x42c4bb
mov edx, dword [esp + 0x20]
push edx
call fcn.00457e3b
add esp, 4
mov edi, dword [esp + 0x14]
push edi
lea ecx, [esp + 0x58]
call fcn.0042a3e0
cmp dword [esp + 0x6c], esi
jb 0x42c4dc
mov eax, dword [esp + 0x58]
push eax
call fcn.00457e3b
add esp, 4
cmp dword [esp + 0x50], esi
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebp
mov byte [esp + 0x58], 0
jb 0x42c500
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00457e3b
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00460f23
add esp, 0x6c
ret
Function at 0x439750
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret
Function at 0x43ed40
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
lea ebx, [eax + 4]
test ebx, ebx
push esi
push edi
je 0x43ed97
mov ebp, dword [esp + 0x18]
lea esi, [ebp + 4]
test esi, esi
je 0x43ed97
cmp byte [eax + 0x48], 0
je 0x43ed97
mov edi, dword [sym.imp.ADVAPI32.dll_IsValidSid]
push ebx
call edi
test eax, eax
setne al
test al, al
je 0x43ed97
cmp byte [ebp + 0x48], 0
je 0x43ed97
push esi
call edi
test eax, eax
setne al
test al, al
je 0x43ed97
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x43f990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4870c6
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x30], esi
xor ebx, ebx
mov dword [esi], vtable.ATL::CSecurityDesc.0
mov dword [esi + 4], ebx
mov dword [esi + 0x14], vtable.ATL::CSecurityDesc.0
mov dword [esi + 0x18], ebx
mov dword [esp + 0x9c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x1c], 2
mov dword [esp + 0x10], vtable.ATL::CDacl.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0xa0], 2
call fcn.00405d00
add esp, 4
mov edi, dword [esp + 0xa4]
push ebx
push edi
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 3
call fcn.00406cc0
lea ecx, [esp + 0x34]
mov byte [esp + 0x9c], 2
call fcn.00405c10
lea ecx, [esp + 0x34]
push ecx
call fcn.00405cd0
add esp, 4
push ebx
push edi
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 4
call fcn.00406cc0
lea ecx, [esp + 0x34]
mov byte [esp + 0x9c], 2
call fcn.00405c10
lea edx, [esp + 0x34]
push edx
call fcn.00405ca0
add esp, 4
mov ecx, dword [esp + 0xa8]
push ebx
push ecx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 5
call fcn.00406cc0
lea ecx, [esp + 0x34]
mov byte [esp + 0x9c], 2
call fcn.00405c10
push ebx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00404af0
lea edi, [esi + 0x14]
cmp edi, esi
je 0x43fae7
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x43fae7
push eax
mov ecx, edi
call fcn.00404470
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0x10]
mov dword [esi + 8], 0xc
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
call fcn.00406f60
mov eax, esi
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x90
ret 8
Function at 0x448aa0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 0xffffffffffffffff
push 0x487e18
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x448b21
push 0x13
push str.CryptAcquireContext
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], eax
mov byte [esp + 0x14], al
call fcn.004067f0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x5c], 0
call fcn.00448910
push 0x4c33e0
lea ecx, [esp + 0x28]
push ecx
call fcn.00460abe
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x54
ret

Function at 0x448b60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x4879f6
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4d8eb0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
test byte [0x4db1fc], 1
jne 0x448bba
or dword [0x4db1fc], 1
mov ecx, 0x4db1f8
mov dword [esp + 0x54], 0
call fcn.00448aa0
push 0x489860
call fcn.00461638
add esp, 4
mov dword [esp + 0x54], 0xffffffff
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov edx, dword [0x4db1f8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x448c1a
push 0xe
push 0x490f40
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.004067f0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], 1
call fcn.00448910
push 0x4c33e0
lea ecx, [esp + 0x24]
push ecx
call fcn.00460abe
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x54
ret 8
Function at 0x44b120
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using des

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov eax, dword [esp + 8]
mov ecx, dword [ecx + 0x88]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
add ecx, 8
mov edi, 8
mov edi, edi
mov eax, esi
ror eax, 4
xor eax, dword [ecx - 8]
add ecx, 0x10
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x492860]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492a60]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492c60]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x492e60]
mov eax, dword [ecx - 0x14]
xor edx, ebx
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x492960]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492b60]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492d60]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x492f60]
xor edx, ebx
mov eax, edx
ror eax, 4
xor eax, dword [ecx - 0x10]
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x492860]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492a60]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492c60]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x492e60]
mov eax, dword [ecx - 0xc]
xor esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x492960]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492b60]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x492d60]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x492f60]
xor esi, ebx
sub edi, 1
jne 0x44b140
mov ecx, dword [esp + 0x14]
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x44d480
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
sub eax, ebp
push edi
mov dword [esp + 0x20], 0xf5
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 4
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
jmp 0x44d4b4
mov edi, dword [esp + 0x10]
mov ebx, 3
sub ebx, edi
add ebx, ebx
add ebx, ebx
xor esi, esi
add ebx, ebx
lea edi, [edi + 0x491be8]
lea esp, [esp]
movzx eax, byte [edi]
mov edx, dword [esp + 0x1c]
mov ecx, 3
sub ecx, esi
add ecx, ecx
push eax
mov eax, dword [edx + ebp]
add ecx, ecx
add ecx, ecx
shr eax, cl
lea ecx, [esp + 0x24]
push eax
call fcn.004542f0
movzx edx, al
mov ecx, ebx
shl edx, cl
add esi, 1
add edi, 4
xor dword [esp + 0x14], edx
cmp esi, 4
jl 0x44d4d0
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, 4
mov dword [esp + 0x10], eax
jl 0x44d4b0
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
add ebp, 4
sub dword [esp + 0x18], 1
jne 0x44d4a1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x44db77
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [eax]
push edi
mov edi, dword [esi + 0xa0]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
push 0
lea eax, [edi + 0x10]
push 0
push eax
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 4
mov dword [edi + 0xc], edx
call fcn.004619c0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0044bc90
push eax
push edi
push edi
call fcn.00449010
add esp, 0x20
mov eax, 0x10
mov edx, 0x491bf8
jmp 0x44dbe0
mov ecx, dword [esi + 0xa0]
mov edi, dword [ecx + eax - 4]
add ecx, eax
rol edi, 8
xor edi, dword [ecx - 0x10]
mov ecx, dword [esi + 0xa0]
xor edi, dword [edx]
add edx, 4
mov dword [eax + ecx], edi
mov ecx, dword [esi + 0xa0]
mov edi, dword [ecx + eax - 0xc]
xor edi, dword [ecx + eax]
add ecx, eax
mov dword [ecx + 4], edi
mov ecx, dword [esi + 0xa0]
mov edi, dword [ecx + eax - 8]
xor edi, dword [ecx + eax + 4]
add ecx, eax
mov dword [ecx + 8], edi
mov ecx, dword [esi + 0xa0]
mov edi, dword [ecx + eax + 8]
xor edi, dword [ecx + eax - 4]
add ecx, eax
add eax, 0x10
cmp edx, 0x491c18
mov dword [ecx + 0xc], edi
jl 0x44dbe0
mov edx, dword [esi - 4]
mov eax, dword [edx + 0x1c]
lea ecx, [esi - 4]
call eax
test al, al
je 0x44dc79
xor edi, edi
mov ecx, dword [esi + 0xa0]
lea eax, [edi + ecx]
push eax
call fcn.0044d480
add edi, 0x10
add esp, 4
cmp edi, 0x80
jl 0x44dc54
pop edi
pop esi
add esp, 8
ret 0xc
mov edx, 0x80
push ebx
xor ecx, ecx
mov dword [esp + 0x18], edx
push ebp
jmp 0x44dc90
mov ebx, 4
jmp 0x44dca0
mov eax, dword [esi + 0xa0]
mov ebp, dword [edx + eax]
mov edi, dword [ecx + eax]
mov dword [ecx + eax], ebp
mov dword [edx + eax], edi
add edx, 4
add ecx, 4
sub ebx, 1
jne 0x44dca0
mov edx, dword [esp + 0x1c]
sub edx, 0x10
cmp edx, 0x40
mov dword [esp + 0x1c], edx
jg 0x44dc90
mov esi, dword [esi + 0xa0]
lea eax, [esi + 0x80]
push eax
call fcn.0044d480
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret 0xc
Function at 0x452130
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov ecx, eax
or ecx, esi
or ecx, edx
test cl, 3
jne 0x452160
shr edx, 2
je 0x45217d
mov ecx, esi
sub ecx, eax
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
sub edx, 1
jne 0x452151
pop esi
ret
test edx, edx
jbe 0x45217d
mov ecx, esi
sub ecx, eax
mov esi, edx
lea ebx, [ebx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x452170
pop esi
ret

Function at 0x457930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
cmp dword [eax + 0x18], 0x10
jb 0x457942
mov eax, dword [eax + 4]
jmp 0x457945
add eax, 4
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4579e6
push edi
mov edi, dword [0x4db284]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov esi, dword [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], edi
je 0x4579c9
cmp eax, 3
je 0x4579c9
cmp eax, 0x7b
je 0x4579c9
cmp eax, 0x57
je 0x4579c9
cmp eax, 0xa1
je 0x4579c9
cmp eax, 0x35
je 0x4579c9
cmp eax, 0x20
jne 0x4579b8
lea ecx, [esp + 0xc]
call fcn.00427680
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x18]
pop edi
mov dword [esi + 4], edx
pop esi
mov dword [eax], 9
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], 0
pop ebx
add esp, 8
ret
xor edi, edi
call fcn.00456c80
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
pop esi
mov dword [eax], 1
pop ebx
add esp, 8
ret
xor esi, esi
call fcn.00456c80
test bl, 0x10
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov dword [ecx], esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 3
jne 0x457a0f
mov dword [esp + 0x18], 2
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
pop esi
mov dword [eax], ecx
pop ebx
add esp, 8
ret

Function at 0x457a40
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, 0x10
cmp dword [eax + 0x18], edx
jb 0x457a53
mov ecx, dword [eax + 4]
jmp 0x457a56
lea ecx, [eax + 4]
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], edx
jb 0x457a64
mov eax, dword [eax + 4]
jmp 0x457a67
add eax, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x457a85
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [0x4db284]
mov dword [eax + 4], ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [0x4db284]
mov dword [eax + 4], ecx
ret