joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007bff7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1007c041
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1007bfe8
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1007bff7
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10481c9a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1007c048
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10062ebe
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1007c0e7
add edi, 4
add eax, 2
dec ecx
jne 0x1007c02d
call 0x1007c094
loope 0x1007c08a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1007c0e4
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1007c0f5
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1007c0a8
cmp eax, ecx
ja 0x1007c0a8
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1007c132
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1007c128
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1006339d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40142b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x414004]
jne 0x401435
repz ret
jmp fcn.00402051

Function at 0x40a665
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402bd1
and dword [ebp - 4], 0
cmp dword [0x416284], 0
mov ebx, eax
jne 0x40a716
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a7c7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a7c7
push eax
call fcn.00402b5f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x416284], eax
call esi
push eax
call fcn.00402b5f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x416288], eax
call esi
push eax
call fcn.00402b5f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41628c], eax
call esi
push eax
call fcn.00402b5f
pop ecx
mov dword [0x416294], eax
test eax, eax
je 0x40a716
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402b5f
pop ecx
mov dword [0x416290], eax
mov eax, dword [0x416290]
cmp eax, ebx
je 0x40a76e
cmp dword [0x416294], ebx
je 0x40a76e
push eax
call fcn.00402bda
push dword [0x416294]
mov esi, eax
call fcn.00402bda
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a76e
test edi, edi
je 0x40a76e
call esi
test eax, eax
je 0x40a765
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a765
test byte [ebp - 0xc], 1
jne 0x40a76e
or dword [ebp + 0x10], 0x200000
jmp 0x40a7a7
mov eax, dword [0x416288]
cmp eax, ebx
je 0x40a7a7
push eax
call fcn.00402bda
pop ecx
test eax, eax
je 0x40a7a7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a7a7
mov eax, dword [0x41628c]
cmp eax, ebx
je 0x40a7a7
push eax
call fcn.00402bda
pop ecx
test eax, eax
je 0x40a7a7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x416284]
call fcn.00402bda
pop ecx
test eax, eax
je 0x40a7c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a7c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d8e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x414004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x202
mov word [ebp - 0x1a0], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x1a0]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x40d92c
mov eax, 1
jmp 0x40d92e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040142b
mov esp, ebp
pop ebp
ret
Function at 0x40ea90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00401b10
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x917720
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x40eaf4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x464]
mov esp, ebp
pop ebp
ret

Function at 0x40ef20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0
je 0x40ef32
cmp dword [ebp + 0xc], 0
jne 0x40ef39
xor eax, eax
jmp 0x40f0a1
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x40ef4a
xor eax, eax
jmp 0x40f0a1
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push 0x917520
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x40ef75
jmp 0x40f08f
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 2
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40efa7
jmp 0x40f08f
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jmp 0x40efc0
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x40efe1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
test eax, eax
jne 0x40efdf
mov dword [ebp - 0xc], 0
jmp 0x40efe1
jmp 0x40efb7
lea ecx, [ebp - 4]
push ecx
push closesocket
push 0x4155dc
call fcn.00401250
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
shl eax, 1
push eax
push 0x415600
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40f01a
jmp 0x40f08f
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
shl eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40f03f
jmp 0x40f08f
cmp dword [ebp - 0xc], 0
je 0x40f07e
lea eax, [ebp - 4]
push eax
push closesocket
push str._and_more..._
call fcn.00401250
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push str._r_n_r_nUser_Data:_r_n
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40f07e
jmp 0x40f08f
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40f0a1
cmp dword [ebp - 0x14], 0xffffffff
je 0x40f09f
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40f550
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x414004]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00401b10
add esp, 0xc
mov dword [ebp - 0xc], str..txtx
mov dword [ebp - 8], str..logx
call fcn.0040d8e0
push 0x917520
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x214], eax
mov edx, dword [0x91b920]
push edx
push 0x100
push 0x917520
call fcn.00401050
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
add eax, 0x208
push eax
push 0x100
push 0x917520
call fcn.00401050
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0
jmp 0x40f601
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 2
jge 0x40f659
push 0x917520
push 0x100
lea edx, [ebp - 0x210]
push edx
call fcn.00401000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0xc]
push ecx
push 0x100
lea edx, [ebp - 0x210]
push edx
call fcn.00401050
lea eax, [ebp - 0x210]
push eax
push str.http:__note.youdao.com_crash_upload
call fcn.0040e140
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40f5f8
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040142b
mov esp, ebp
pop ebp
ret
Function at 0x404474
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
add ebx, 0xffffc6d7
push edi
mov edi, dword [esp + 0x18]
add esi, 0x409
add edi, 0x210
lea eax, [edi + 0x6a]
cmp ebx, eax
jg 0x4044e2
xor esi, 0x454
cmp ebx, esi
jg 0x404521
mov eax, dword [0x462934]
mov edx, dword [esp + 0x10]
mov eax, dword [eax + 8]
add eax, 0x18c92b
or dword [0x513c6c], eax
mov eax, dword [0x513bfc]
add eax, 0xfb701
add eax, dword [edx + 0xd8]
mov dword [0x513bfc], eax
mov eax, dword [edx + 0x34]
add eax, 0x13ffc9
add eax, dword [edx + 0x78]
mov dword [edx + 0x44], eax
jmp 0x404521
mov eax, dword [0x462934]
mov eax, dword [eax + 0x78]
sub eax, 0x3716
cmp esi, eax
jae 0x404521
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp + 0x14]
xor eax, ebx
and eax, dword [0x513c6c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x462934]
add esi, 2
mov ecx, dword [ecx + 0x78]
sub ecx, 0x3716
cmp esi, ecx
jb 0x4044f8
pop ebp
xor edi, 0x226
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x410fc7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x20]
lea edx, [eax - 0x3f68]
xor ebp, 0x4a9
push esi
lea esi, [eax - 0x47c]
mov dword [esp + 8], edx
mov eax, dword [esp + 0x10]
mov edx, ecx
add eax, 0xffffc225
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], eax
xor edx, 0x23f
push edi
lea eax, [ecx + 0x118]
mov edi, ecx
mov dword [esp + 0x14], eax
xor edi, 0x3a2
lea eax, [esi + 0x318]
cmp edi, eax
je 0x411081
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0xd4]
mov dword [0x513c94], eax
cmp dword [edx + 0x110], 0x62dd
jbe 0x411056
mov ecx, dword [edx + 0x1c]
sub ecx, dword [edx + 0xf4]
mov eax, dword [0x462934]
xor ecx, 0x188d4
mov dword [eax + 0x48], ecx
jmp 0x411061
mov eax, dword [0x513bf0]
sub dword [edx + 0xa4], eax
mov eax, dword [edx + 0xd4]
mov dword [edx + 0xd0], eax
mov ecx, dword [0x462934]
mov eax, dword [edx + 4]
add dword [ecx + 0xd0], eax
jmp 0x411132
mov ecx, dword [0x462934]
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x118]
xor eax, dword [ebx + 0x68]
cmp edi, eax
je 0x411131
mov eax, dword [ebx + 0x78]
or eax, dword [esp + 0x20]
cmp edi, eax
jbe 0x411131
mov ebp, esi
mov eax, ebp
xor eax, edi
mov dword [esp + 0x28], eax
imul eax, edx, 0x3ddb
sub eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
push dword [esp + 0x10]
mov edx, dword [ebx + 0x110]
mov eax, ebp
sub eax, dword [ecx + 0xf8]
xor edx, dword [esp + 0x1c]
mov dword [ebx + 0x120], eax
mov eax, dword [0x462934]
mov ecx, dword [0x513cf4]
xor ecx, dword [0x513cd4]
mov esi, dword [eax + 0x78]
mov eax, dword [ebx + 0x10c]
add eax, dword [esp + 0x2c]
add esi, dword [ebx + 0x48]
push eax
mov eax, dword [esp + 0x28]
sub eax, ebp
push eax
push ecx
push edx
push esi
push ebx
call fcn.00404474
mov ecx, dword [ebx + 0x78]
add edi, 2
or ecx, eax
mov dword [esp + 0x3c], eax
add esp, 0x1c
cmp edi, ecx
jbe 0x41112d
mov ecx, dword [0x462934]
jmp 0x4110c4
mov ebp, dword [esp + 0x2c]
pop ebx
pop edi
pop esi
lea eax, [ebp + 0x251]
pop ebp
pop ecx
ret
Function at 0x41113d
Capabilities:
Connect pipe
Encode data using xor
Read pipe
Resolve function by parsing pe exports
Write pipe

Disassembly:
push ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
push edi
mov edi, dword [esp + 0x28]
add edx, 0xfffff916
lea esi, [ebp + 0x81b]
add edi, 0xffffc7ef
xor esi, 0x9cd
mov dword [esp + 0x10], edi
xor ebx, 0xcd2
add ecx, 0xffffc5d2
cmp edx, esi
mov esi, dword [esp + 0x1c]
jl 0x4112bf
lea eax, [edi + 0x3cc2]
cmp edx, eax
je 0x4111c2
push 0x513bf0
lea eax, [edi + 0x39fc]
push eax
lea eax, [edx + 0x7ce]
push eax
mov eax, edi
xor eax, 0x3bb3
push eax
mov eax, edi
xor eax, 0x3be8
push eax
call fcn.0040452d
add esp, 0x14
jmp 0x4112bf
mov eax, dword [0x513d00]
xor eax, 0x3aba
or eax, ebp
cmp ebx, eax
je 0x4112bf
mov eax, dword [esi + 0x7c]
and eax, 0x3efb
xor eax, dword [0x513c60]
cmp ebx, eax
jne 0x4112bf
mov eax, edx
sub ecx, edi
or eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x30], eax
xor edx, ebp
mov eax, edi
lea edi, [ebp + 0x81b]
imul eax, edi
mov dword [esp + 0x28], eax
imul eax, edx, 0x3cc2
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x78]
mov ecx, dword [0x462934]
sub eax, 0x3f31
imul eax, dword [esi + 0xe4]
push eax
mov eax, dword [esp + 0x34]
imul eax, dword [0x513c18]
push eax
mov eax, dword [ecx + 0xd8]
xor eax, edi
push eax
mov eax, dword [ecx + 0xc]
xor eax, edi
push eax
mov eax, dword [esi + 0xf8]
or eax, dword [esi + 0x120]
add eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push dword [esp + 0x20]
mov ecx, dword [0x513c58]
mov eax, dword [0x513d00]
add eax, ecx
and ecx, 0x3ddb
push eax
push ecx
mov ecx, dword [0x462934]
mov eax, dword [ecx + 0x3c]
or eax, 0x3a2e
sub eax, dword [esi + 0x118]
push eax
mov eax, dword [ecx + 0xec]
push dword [esp + 0x38]
imul eax, edi
and eax, dword [esi + 0x24]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov eax, dword [esi + 0x7c]
inc ebx
and eax, 0x3efb
xor eax, dword [0x513c60]
cmp ebx, eax
je 0x411215
mov edi, dword [esp + 0x10]
mov edx, dword [0x513c40]
jmp 0x41131e
mov eax, dword [esi + 0xdc]
add eax, dword [esi + 0x7c]
xor eax, 0x18c976
add dword [esi + 0x5c], eax
mov eax, dword [esi + 0x120]
sub eax, dword [esi + 8]
add eax, 0x14
xor dword [esi + 0x110], eax
mov eax, dword [0x513cf8]
add eax, 0xfff71741
add dword [esi + 8], eax
mov eax, edx
imul eax, edx
add dword [esi + 0xd4], eax
mov eax, dword [esi + 0x44]
xor eax, 0x13ffcb
imul eax, dword [esi + 8]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x1c]
sub eax, 0x12
add dword [esi + 0x108], eax
inc edx
cmp edx, dword [esi + 0x54]
jbe 0x4112c7
mov eax, dword [0x462934]
cmp dword [eax + 0x90], 0x16b9b
jbe 0x411344
mov eax, dword [eax + 0x70]
sub eax, 0x2bfe2
mov dword [esi + 0x114], eax
jmp 0x411360
mov ecx, dword [esi + 0xd8]
xor ecx, dword [esi + 0xc4]
add ecx, 5
imul ecx, dword [0x513cc4]
mov dword [0x513cc4], ecx
xor edi, 0x3811
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x411678
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x1c]
add ebx, 0xffffc514
push esi
mov esi, dword [esp + 0x18]
add esi, 0x148
lea eax, [ebp + 0x477]
push edi
cmp ebx, eax
jg 0x411840
mov esi, dword [esp + 0x20]
xor edi, edi
mov ecx, dword [0x462934]
mov ebx, edi
mov eax, dword [ecx + 0xb4]
mov ecx, dword [ecx + 0x20]
mov edx, dword [esi + 0x80]
inc ecx
imul ecx, dword [esi + 0x118]
mov eax, dword [ebx + eax]
add ebx, 4
imul edx, eax
mov dword [esi + 0x118], ecx
lea eax, [ecx - 0x160c63]
imul eax, dword [esi + 0xc4]
mov dword [esi + 0xc4], eax
mov ecx, dword [esi + 0x84]
mov eax, dword [esi + 0xb8]
mov byte [ecx + eax], dl
inc dword [esi + 0x84]
mov edx, dword [0x462934]
mov eax, dword [edx + 0x68]
xor eax, 0xfff09a7f
sub dword [0x513c0c], eax
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x98]
add ecx, 0x50e47
add eax, ecx
add dword [edx + 0x98], eax
mov ecx, dword [0x462934]
mov eax, dword [ecx + 0xac]
xor eax, 0x48
or dword [0x513c6c], eax
mov eax, dword [ecx + 0xf4]
add eax, 0x194c18
or dword [esi + 8], eax
mov eax, 0xfff09a7f
sub eax, dword [esi + 0x68]
mov ecx, dword [0x462934]
add dword [0x513d14], eax
mov eax, dword [ecx + 0x110]
xor eax, 0x30
add dword [0x513cc8], eax
cmp ebx, 0xe190
jl 0x4116b0
mov dword [0x513cf0], 0x513bf0
mov eax, dword [esi + 0x10c]
sub dword [esi + 0x44], eax
mov ecx, dword [0x462934]
mov eax, dword [esi + 0x98]
add eax, 0x190e11
push 0x12
xor dword [ecx + 0x1c], eax
mov ecx, dword [esi + 0x1c]
xor ecx, dword [0x513c10]
pop eax
sub eax, ecx
add dword [esi + 0xdc], eax
mov eax, dword [0x462934]
mov eax, dword [eax + 0xe0]
inc eax
imul eax, dword [esi + 0x124]
mov dword [esi + 0x124], eax
mov eax, dword [0x462934]
mov ecx, dword [esi + 0xcc]
mov eax, dword [eax + 0xa4]
xor dword [edi + ecx], eax
add edi, 4
mov eax, dword [esi + 0x7c]
xor eax, dword [0x513c0c]
xor eax, 0x18c92d
or dword [esi + 0x90], eax
mov eax, dword [esi + 0x7c]
sub eax, 0x18c93e
imul eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd0]
add dword [esi + 0xa4], eax
cmp edi, 0x4a98c
jl 0x411785
mov eax, dword [0x513d10]
cmp eax, dword [0x513cfc]
jb 0x4118b2
mov eax, dword [esi + 0xcc]
mov dword [esi + 0xb0], eax
jmp 0x4118b2
lea eax, [ebx + 0x3efb]
imul eax, eax, 0x3fbc
cmp esi, eax
je 0x4118b2
mov eax, dword [0x462934]
mov edi, dword [esp + 0x20]
mov eax, dword [eax + 0xa0]
add eax, dword [edi + 0x120]
cmp esi, eax
je 0x4118b2
mov eax, dword [edi + 0xa0]
add eax, 0x3aba
cmp esi, eax
jae 0x4118b2
lea eax, [ebp - 0x7522]
mov ebp, eax
mov eax, ebx
sub eax, dword [edi + 0x104]
xor eax, dword [edi + 0xdc]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi + 0xa0]
add esi, 2
add eax, 0x3aba
cmp esi, eax
jb 0x411880
mov ebp, dword [esp + 0x24]
pop edi
pop esi
lea eax, [ebp - 0x3a4]
pop ebp
pop ebx
ret
Function at 0x413c14
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
mov ecx, ebp
push esi
mov esi, dword [esp + 0xc]
xor ecx, 0x6be
push edi
lea eax, [ebp + 0xe]
lea edx, [ebp - 0x399]
lea edi, [esi - 0x3a2e]
mov dword [esp + 0x20], edx
cmp edi, eax
je 0x413ced
mov eax, dword [0x462934]
lea ecx, [edi + 0x3f31]
push ebx
mov ebx, dword [esp + 0x20]
push ebx
mov eax, dword [eax + 0x90]
add eax, 0x6121
add dword [ebx + 0x68], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffc2c
xor eax, 0x672
push eax
lea eax, [edx - 0xd0]
push eax
push ecx
push esi
push ecx
call fcn.0041392f
mov edi, eax
mov ecx, ebp
xor ecx, 0x9f
add esi, 0x8c
push ecx
push ebx
lea ecx, [edi - 0x4ec]
mov eax, ebp
push ecx
xor eax, 0x4a9
push esi
push eax
lea eax, [edi + 0x349]
push eax
lea eax, [edi + 0x380]
push eax
call fcn.00413b0f
lea ecx, [edi + 0x33b]
add eax, 0x6df
mov edi, dword [esp + 0x48]
xor ebp, 0x835
push ecx
push esi
push eax
add edi, 0xffffc5d2
push ebx
lea eax, [edi + 0x3716]
push eax
lea eax, [edi + 0x39fc]
push ebp
push eax
call fcn.00403b70
add esp, 0x50
pop ebx
jmp 0x413d62
lea eax, [ecx + ecx]
mov ecx, dword [0x513ce4]
sub ecx, eax
cmp dword [0x513d04], ecx
je 0x413d62
mov eax, dword [0x462934]
sub ebp, dword [eax + 0x114]
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [esp + 0x1c]
mov eax, dword [0x462934]
mov ecx, dword [edx + 0x120]
and ecx, dword [esp + 0x20]
sub ecx, dword [eax + 0x18]
imul eax, dword [edx + 0x90], 0x3be8
mov esi, dword [edx + 0xa8]
push ecx
sub eax, 0x3d9a
push eax
mov eax, esi
sub esi, dword [edx + 0xc4]
and eax, 0x3e04
add eax, dword [edx + 0x64]
push edx
push eax
mov eax, dword [0x513cd8]
or eax, edi
push esi
push eax
call fcn.00411678
add esp, 0x18
lea eax, [edi + 0x3929]
pop edi
pop esi
pop ebp
ret