joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ff0
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
add esp, 0xfffffbd0
mov ebx, eax
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.004024e0
cmp dword [0x4431fc], 0
jne 0x40402e
push 0x443204
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x40402e
push str.GetDiskFreeSpaceExA
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4431fc], eax
cmp dword [0x4431fc], 0
je 0x4040a2
lea edx, [esp + 0x30]
mov ecx, 0x400
mov eax, ebx
call fcn.00401f24
xor eax, eax
lea edx, [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
push edx
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x18]
push eax
cmp byte [esp + 0x3c], 0
je 0x40406d
lea edx, [esp + 0x3c]
jmp 0x40406f
xor edx, edx
push edx
call dword [0x4431fc]
test eax, eax
je 0x4040a2
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
ja 0x4040a2
mov eax, dword [esp + 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x40410f
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push ecx
cmp byte [esp + 0x40], 0
je 0x4040c3
lea eax, [esp + 0x40]
jmp 0x4040c5
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x4040d8
mov eax, 0x163e00
xor edx, edx
jmp 0x40410f
mov eax, dword [esp + 0x18]
imul dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
call fcn.0043d3f0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x430
pop esi
pop ebx
ret

Function at 0x404118
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040c0d4
test eax, eax
je 0x404143
test ebx, ebx
je 0x404143
cmp word [ebx], 0
je 0x404143
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x4043c8
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040c0d4
test eax, eax
je 0x4043ea
test ebx, ebx
je 0x4043ea
cmp word [ebx], 0
je 0x4043ea
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x4043f4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040c0d4
test eax, eax
je 0x404421
test ebx, ebx
je 0x404421
cmp word [ebx], 0
je 0x404421
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x404430
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x404b64
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x404b6d
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.00414c00
lea eax, [esp + 0xc40]
call fcn.00414c00
lea eax, [esp + 0xc6c]
call fcn.00414c00
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.0040f114
test al, al
jne 0x404bcd
xor eax, eax
jmp 0x404d1d
cmp byte [esp], 0
je 0x404bdd
cmp byte [esp + 0xc98], 0
jne 0x404be4
xor eax, eax
jmp 0x404d1d
mov eax, esp
call fcn.004019d8
lea edx, [esp + 0xc98]
call fcn.00401750
test eax, eax
je 0x404c12
mov eax, esi
call fcn.004019d8
lea edx, [esp + 0xc98]
call fcn.00401750
test eax, eax
je 0x404c19
xor eax, eax
jmp 0x404d1d
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.00401994
push ebx
push str.rtmp_d
mov eax, edi
call fcn.004019d8
push eax
call fcn.0043c044
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00404118
test al, al
je 0x404c57
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x404c1b
mov eax, edi
xor edx, edx
call fcn.00404118
test al, al
je 0x404c6b
xor eax, eax
jmp 0x404d1d
lea eax, [esp + 0x14b4]
mov ecx, 0x400
mov edx, esi
call fcn.00401994
mov eax, esp
call fcn.004019d8
push eax
lea eax, [esp + 0x14b8]
call fcn.004019d8
push eax
call fcn.0043a8d0
add esp, 8
push edi
lea edx, [esp + 0x14b8]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x404cb1
xor eax, eax
jmp 0x404d1d
lea eax, [esp + 0x18b4]
call fcn.00402fdc
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00404118
test al, al
jne 0x404cde
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.004031ec
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x404d08
lea eax, [esp + 0x18b4]
call fcn.00403320
lea eax, [esp + 0x18b4]
call fcn.004033b4
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.0040302c
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x406964
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40c078
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x40c0c4
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push 0x80000000
push 0xd
call sub.USER32.DLL_ExitWindowsEx
add esp, 0x14
ret

Function at 0x40c154
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x449cf4
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x40c16e
call fcn.0040c11c
mov eax, ebp
jmp 0x40c186
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x40c18e
test al, 7
jne 0x40c172
cmp esi, 8
jb 0x40c217
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x40c197
xor edx, edx
jmp 0x40c231
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x40c21b
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c2b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
xor edx, dword [eax + 0x204]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
xor edx, dword [eax + 0x208]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ebx, dword [ecx + 8]
mov esi, dword [edx + 0xc]
xor ebx, dword [eax + 0x20c]
xor esi, dword [eax + 0x210]
xor edx, edx
mov ecx, esi
mov edi, esi
shr edi, 0x15
shl ecx, 0xb
or ecx, edi
mov edi, edx
and edi, 3
add ecx, ebx
xor ecx, dword [eax + edi*4 + 0x204]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ebp, byte [eax + ebp + 0x104]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
mov ecx, ebx
xor edi, dword [esp + 4]
mov dword [esp + 0xc], edi
mov edi, ebx
shr edi, 0xf
shl ecx, 0x11
or ecx, edi
mov edi, edx
and edi, 3
xor ecx, esi
add ecx, dword [eax + edi*4 + 0x204]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ebp, byte [eax + ebp + 0x104]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
xor edi, dword [esp + 8]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov ecx, edi
mov esi, ecx
mov ebx, dword [esp + 0xc]
inc edx
cmp edx, 0x20
jl 0x40c306
mov edx, dword [esp + 0x10]
xor ebx, dword [eax + 0x204]
mov dword [edx], ebx
xor esi, dword [eax + 0x208]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x20c]
mov dword [ecx + 8], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x210]
mov dword [ecx + 0xc], edx
mov edx, dword [esp]
call fcn.0040c604
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c458
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
xor ecx, dword [ebx + 0x204]
mov dword [esp], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
xor ecx, dword [ebx + 0x208]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 8]
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x20c]
mov edi, dword [eax + 0xc]
xor edi, dword [ebx + 0x210]
push 0x10
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0043a6e0
add esp, 0xc
mov edx, 0x1f
mov eax, edi
mov ecx, edi
shr ecx, 0x15
shl eax, 0xb
or eax, ecx
mov ecx, edx
and ecx, 3
add eax, esi
xor eax, dword [ebx + ecx*4 + 0x204]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx + 0x104]
movzx ebp, byte [ebx + ebp + 0x104]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
mov eax, esi
xor ecx, dword [esp]
mov dword [esp + 8], ecx
mov ecx, esi
shr ecx, 0xf
shl eax, 0x11
or eax, ecx
mov ecx, edx
and ecx, 3
xor eax, edi
add eax, dword [ebx + ecx*4 + 0x204]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx + 0x104]
movzx ebp, byte [ebx + ebp + 0x104]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
xor ecx, dword [esp + 4]
mov dword [esp], esi
mov dword [esp + 4], edi
mov eax, ecx
mov edi, eax
mov esi, dword [esp + 8]
dec edx
test edx, edx
jge 0x40c4b4
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x204]
mov dword [eax], esi
xor edi, dword [ebx + 0x208]
mov edx, dword [esp + 0xc]
mov dword [edx + 4], edi
mov ecx, dword [esp]
mov eax, dword [esp + 0xc]
xor ecx, dword [ebx + 0x20c]
mov dword [eax + 8], ecx
mov eax, ebx
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor edx, dword [ebx + 0x210]
mov dword [ecx + 0xc], edx
lea edx, [esp + 0x10]
call fcn.0040c604
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c604
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x449cf4
xor ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x204], esi
movzx esi, byte [edx + ecx + 1]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x208], esi
movzx esi, byte [edx + ecx + 2]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x20c], esi
movzx esi, byte [edx + ecx + 3]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x210], esi
add ecx, 4
cmp ecx, 0x10
jl 0x40c60d
pop esi
pop ebx
ret
Function at 0x40ced0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
jg 0x40cef0
xor eax, eax
jmp 0x40cfb1
mov edx, dword [ebp - 0xc]
test edx, edx
jns 0x40cefa
add edx, 0xf
sar edx, 4
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, 4
mov ecx, dword [eax]
xor ecx, dword [edx]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, ebx
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 0xc]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.0040d334
add dword [ebp - 8], 0x10
mov edx, dword [ebp - 0x14]
dec edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jle 0x40cf8d
mov eax, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
xor ecx, dword [edx]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [edx + 8]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0xc]
xor eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
add ebx, 0x10
lea edx, [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0040d334
add dword [ebp - 8], 0x10
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jg 0x40cf49
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x14]
shl eax, 4
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40cfb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x40cfcf
test esi, esi
jg 0x40cfd6
xor eax, eax
jmp 0x40d07e
push 0x10
mov edx, dword [ebp - 4]
add edx, 4
push edx
lea ecx, [ebp - 0x28]
push ecx
call fcn.0043a6e0
add esp, 0xc
test esi, esi
jns 0x40cff2
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x40d063
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040d8b0
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x40cfff
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.0043a6e0
add esp, 0xc
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d088
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 4
push 0x20
push edx
lea edx, [esp + 0x14]
push edx
call fcn.0043a6e0
add esp, 0xc
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x40d0f1
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x40d0bc
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40d0e9
cmp ecx, 4
jl 0x40d0ba
cmp ecx, 4
jne 0x40d0f1
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40d0fc
cmp esi, 0xa
jle 0x40d0de
cmp esi, 0xa
jg 0x40d28f
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x44a0f4]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x44a0f4]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x44a0f4]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x44a0f4]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x44a2f4]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x40d19f
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x40d23d
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40d17f
inc edx
cmp edx, dword [esp + 8]
jl 0x40d17d
jmp 0x40d23d
mov edx, 1
jmp 0x40d1bd
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40d1a8
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x40d1c8
adc eax, 0
cmp edx, eax
jl 0x40d1a6
mov eax, dword [esp + 8]
sar eax, 1
jns 0x40d1d7
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x44a0f4]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x44a0f4]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x44a0f4]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x44a0f4]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x40d23d
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x40d222
inc edx
cmp edx, dword [esp + 8]
jl 0x40d220
xor edx, edx
jmp 0x40d27b
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x40d245
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40d273
cmp ecx, 4
jl 0x40d243
cmp ecx, 4
jne 0x40d27b
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x40d286
cmp esi, 0xa
jle 0x40d268
cmp esi, 0xa
jle 0x40d105
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40d298
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, [ebp*4 + 0x44c712]
lea ebx, [ebx*4 + 0x44c312]
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, [ebp*4 + 0x44cb12]
lea edx, [edx*4 + 0x44cf12]
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x40d2aa
inc eax
cmp eax, 4
jl 0x40d2a8
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.0043a6e0
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x40d2a6
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40f93c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x40f95c
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x40f943
cmp dword [eax], 0x11
jbe 0x40f977
mov dword [eax], 0x11
jmp 0x40f96b
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x40f977
cmp dword [eax + edx*4], 0
je 0x40f969
ret

Function at 0x4101b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x4101f7
mov eax, 1
jmp 0x4101d0
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x4101c6
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.0043a6e0
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41025c
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x410235
mov eax, 1
jmp 0x41020e
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x410204
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.0043a6e0
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x41025c
mov eax, dword [ebx]
test eax, eax
jbe 0x410248
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x410248
dec eax
test eax, eax
ja 0x41023b
mov dword [edi], eax
test eax, eax
jbe 0x41025c
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x41024e
pop edi
pop esi
pop ebx
ret
Function at 0x419dec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffff70
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 8], edx
mov esi, dword [esp + 8]
jmp 0x419e69
xor eax, eax
mov edx, dword [esp]
add edx, esi
add edx, eax
mov cl, byte [edx + 1]
mov byte [esp + eax + 0x19], cl
mov bl, byte [edx]
sub bl, cl
mov byte [esp + eax + 0x18], bl
mov dl, byte [edx + 2]
sub dl, cl
mov byte [esp + eax + 0x1a], dl
add eax, 3
cmp eax, 0x78
jl 0x419e17
mov ebx, 3
mov cl, byte [esp + ebx + 0x18]
sub cl, byte [esp + ebx + 0x15]
movsx ecx, cl
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 8]
add dword [esp + edx*4 + 0xc], eax
inc ebx
cmp ebx, 0x78
jl 0x419e43
add esi, 0x780
mov eax, dword [esp + 4]
add eax, 0xffffff88
cmp esi, eax
jl 0x419e15
inc dword [esp + 8]
cmp dword [esp + 8], 2
jle 0x419e0f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jb 0x419e95
cmp eax, dword [esp + 0x14]
ja 0x419e95
xor eax, eax
jmp 0x419ea1
mov eax, 1
cmp edx, dword [esp + 0x14]
jbe 0x419ea1
inc eax
add esp, 0x90
pop esi
pop ebx
ret

Function at 0x41a4d0
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
push esp
push 0
push edx
push eax
push 0x10000
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
test ebx, ebx
jne 0x41a511
mov edx, str.CreateThread_failed
mov eax, 0x447970
call fcn.00432964
mov eax, 0x447970
call fcn.00432c64
mov eax, 0x447970
mov edx, 2
call fcn.00432af4
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x4329f0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, ecx
mov ebx, edx
mov edi, eax
push esi
mov eax, 0xd04
call fcn.0040e8b4
push eax
test ebx, ebx
je 0x432a19
cmp byte [ebx], 0
je 0x432a19
mov edx, ebx
jmp 0x432a1b
xor edx, edx
push edx
call fcn.0042acac
add esp, 0xc
call fcn.0042ad94
call sub.KERNEL32.DLL_GetLastError
cmp eax, 3
jne 0x432a8a
push esi
call fcn.0043a900
pop ecx
mov ebp, eax
mov eax, esi
call fcn.00402438
test al, al
jne 0x432a5e
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.0043a900
pop ecx
add eax, ebp
inc eax
mov ebp, eax
cmp ebp, 0x104
jle 0x432a8a
push 0x104
mov eax, 0xe68
call fcn.0040e8b4
push eax
test ebx, ebx
je 0x432a7f
cmp byte [ebx], 0
jne 0x432a81
xor ebx, ebx
push ebx
call fcn.0042acac
add esp, 0xc
mov eax, edi
call fcn.00432c64
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret