joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f916c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, edx
xor edx, edx
push ebp
push 0x5f9215
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ebx
sub edx, 2
jb 0x5f918d
je 0x5f91fa
jmp 0x5f91ff
mov ecx, 0x465
mov edx, ebx
call fcn.005f7534
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebx*4 + 0x653f10]
call fcn.004e6660
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040477c
cmp dword [ebp - 4], 0
je 0x5f91ff
mov eax, dword [ebp - 4]
call fcn.004f1bb4
mov ebx, eax
test ebx, ebx
jbe 0x5f91ff
mov eax, ebx
call fcn.004f1ba4
test eax, eax
jbe 0x5f91e3
push 0
push 0
push 0x12
push eax
call sub.user32.dll_PostMessageA
jmp 0x5f91ff
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x5f91ff
call fcn.005faf88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f921c
lea eax, [ebp - 4]
call fcn.00404574
ret

Function at 0x5fbdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff75c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x8a4], ecx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x44c], eax
xor eax, eax
push ebp
push 0x5fbf86
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x44c]
inc edx
imul edx, edx, 0x446
xor ecx, ecx
call fcn.00402f1c
lea edx, [ebp - 0x8a4]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 0x8a4]
lea ecx, [ebp - 0x454]
mov edx, 0x5fbfa0
call fcn.0040a28c
mov eax, dword [ebp - 0x454]
call fcn.00409f98
test al, al
je 0x5fbf58
push 0
mov ecx, dword [ebp - 0x454]
mov dl, 1
mov eax, dword [0x41d93c]
call fcn.0042277c
mov dword [ebp - 0x458], eax
xor ebx, ebx
push ebp
push 0x5fbf51
push dword fs:[ebx]
mov dword fs:[ebx], esp
mov eax, dword [ebp - 0x458]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x5fbe99
cmp eax, 0x446
jbe 0x5fbf38
jmp 0x5fbe9f
jle 0x5fbf38
lea edx, [ebp - 0x89e]
mov ecx, 0x446
mov eax, dword [ebp - 0x458]
call fcn.004224f4
xor ebx, ebx
push ebp
push 0x5fbf2e
push dword fs:[ebx]
mov dword fs:[ebx], esp
lea edx, [ebp - 0x446]
mov ecx, 0x446
mov eax, dword [ebp - 0x458]
call fcn.004224f4
mov ecx, 0x446
lea eax, [ebp - 0x89e]
lea edx, [ebp - 0x446]
mov bl, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x5fbeea
imul eax, dword [ebp - 0x450], 0x223
mov edx, dword [ebp - 0x44c]
lea edi, [edx + eax*2]
lea esi, [ebp - 0x446]
mov ecx, 0x111
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
inc dword [ebp - 0x450]
cmp dword [ebp - 0x450], 5
jl 0x5fbec3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fbf38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fbf58
mov eax, dword [ebp - 0x458]
call fcn.004036a0
ret
cmp dword [ebp - 0x450], 0
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fbf8d
lea eax, [ebp - 0x8a4]
call fcn.00404574
lea eax, [ebp - 0x454]
call fcn.00404574
ret
Function at 0x5fbfa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff760
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x89c], ecx
mov dword [ebp - 0x8a0], ecx
mov ecx, edx
imul ecx, ecx, 0x446
add ecx, 0x445
test ecx, ecx
js 0x5fbfdd
shr ecx, 2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x5fbfd6
mov eax, esp
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5fc106
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
lea edx, [ebp - 0x8a0]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 0x8a0]
lea ecx, [ebp - 0x89c]
mov edx, 0x5fc128
call fcn.0040a28c
mov ecx, dword [ebp - 0x89c]
mov dl, 1
mov eax, dword [0x41d93c]
call fcn.0042277c
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x5fc0e1
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00402c04
mov ebx, 0x446
lea esi, [ebp - 0x452]
mov eax, pe_nt_image_headers32
call fcn.00402f3c
mov byte [esi], al
inc esi
dec ebx
jne 0x5fc050
lea edx, [ebp - 0x452]
mov ecx, 0x446
mov eax, dword [ebp - 0xc]
call fcn.0042252c
xor eax, eax
mov dword [ebp - 8], eax
imul eax, dword [ebp - 8], 0x223
mov edx, dword [ebp - 4]
lea eax, [edx + eax*2]
lea edx, [ebp - 0x898]
mov ecx, 0x446
call fcn.00402a14
mov ebx, 0x446
lea eax, [ebp - 0x452]
lea edx, [ebp - 0x898]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x5fc0a6
lea edx, [ebp - 0x898]
mov ecx, 0x446
mov eax, dword [ebp - 0xc]
call fcn.0042252c
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jl 0x5fc078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc0e8
mov eax, dword [ebp - 0xc]
call fcn.004036a0
ret
Function at 0x600c98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x600daf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
movsx eax, byte [esi + 0x48]
call fcn.0040993c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x600dc8
call fcn.00404890
mov eax, dword [ebp - 8]
call fcn.00404a44
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040477c
mov eax, dword [ebp - 4]
mov dl, 6
call fcn.004f14f4
cmp byte [esi + 0x48], 0
jg 0x600d26
mov eax, dword [esi + 0xf0]
push eax
call sub.kernel32.dll_ResetEvent
mov eax, dword [esi + 0xec]
push eax
call sub.kernel32.dll_SetEvent
push 1
call sub.kernel32.dll_Sleep_1
test ebx, ebx
jbe 0x600d26
push ebx
mov eax, dword [esi + 0xf0]
push eax
call sub.kernel32.dll_WaitForSingleObject
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov dword [esi + 0x84], edi
cmp byte [esi + 0x48], 6
setge bl
jmp 0x600d4a
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [esi + 0x48], 6
setge bl
test bl, bl
jne 0x600d5c
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x1f4
jbe 0x600d3c
lea edx, [ebp - 0x18]
movsx eax, byte [esi + 0x48]
call fcn.0040993c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x600de8
call fcn.00404890
mov eax, dword [ebp - 0x14]
call fcn.00404a44
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040477c
mov eax, dword [ebp - 0x10]
mov dl, 6
call fcn.004f14f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x600db6
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404598
ret
Function at 0x602200
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x653fe8]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x653fe8]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x653fe8]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x653fe8]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x653f6c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x60223b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x60231c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x653fe8]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x653fe8]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x653fe8]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x653fe8]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x653f6c]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x653fe8]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x653fe8]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x653fe8]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x653fe8]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x602367
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x61527c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x615337
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10c]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov edx, dword [ebp - 0x10c]
mov eax, 0x61534c
call fcn.00404b88
mov ebx, eax
test ebx, ebx
jle 0x6152f5
push esi
lea edx, [ebp - 0x110]
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.00474e9c
mov eax, dword [ebp - 0x110]
mov ecx, ebx
dec ecx
mov edx, 1
call fcn.00404aa4
jmp 0x615319
push 0
push 0x26
lea eax, [ebp - 0x105]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
mov eax, esi
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004047f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61533e
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404598
ret

Function at 0x615354
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6154e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404844
dec eax
jle 0x6154ad
cmp byte [ebx], 0x25
jne 0x6154ad
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.00404844
mov ecx, eax
dec ecx
mov edx, 2
mov eax, ebx
call fcn.00404aa4
mov edx, dword [ebp - 4]
mov eax, 0x6154f8
call fcn.00404b88
mov esi, eax
cmp esi, 1
jle 0x6154ad
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404aa4
mov edx, 0x615504
mov eax, dword [ebp - 8]
call fcn.00409418
test al, al
je 0x61545c
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404844
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00404aa4
mov eax, dword [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.004047f4
mov edx, dword [ebp - 0x118]
mov eax, edi
pop ecx
call fcn.00404890
jmp 0x6154b6
mov edx, 0x615514
mov eax, dword [ebp - 8]
call fcn.00409418
test al, al
je 0x6154ad
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404844
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00404aa4
mov eax, dword [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
call fcn.0061527c
mov edx, dword [ebp - 0x120]
mov eax, edi
pop ecx
call fcn.00404890
jmp 0x6154b6
mov eax, edi
mov edx, ebx
call fcn.004045c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6154e8
lea eax, [ebp - 0x120]
mov edx, 4
call fcn.00404598
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404598
ret
Function at 0x61a588
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
cmp ecx, 0x200
jg 0x61a5ad
mov esi, ecx
dec esi
test esi, esi
jl 0x61a5d7
inc esi
xor ecx, ecx
mov bl, byte [eax + ecx + 0x205]
xor byte [edx + ecx], bl
inc ecx
dec esi
jne 0x61a59c
pop esi
pop ebx
ret
mov esi, ecx
dec esi
test esi, esi
jl 0x61a5d7
inc esi
xor ecx, ecx
mov ebx, ecx
and ebx, 0x800001ff
jns 0x61a5c9
dec ebx
or ebx, 0xfffffe00
inc ebx
mov bl, byte [eax + ebx + 0x205]
xor byte [edx + ecx], bl
inc ecx
dec esi
jne 0x61a5b7
pop esi
pop ebx
ret

Function at 0x61a8e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61a98d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x61a90d
mov eax, edi
mov edx, esi
call fcn.004045c8
jmp 0x61a972
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.00404844
mov ecx, eax
mov edx, 1
mov eax, esi
call fcn.00404aa4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404990
jne 0x61a93d
mov eax, edi
mov edx, esi
call fcn.004045c8
jmp 0x61a972
push 0x61a9a4
push ebx
push 0x61a9c8
push esi
push 0x61a9dc
lea eax, [ebp - 8]
mov edx, 5
call fcn.00404904
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, edi
mov edx, ebx
call fcn.004045c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a994
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404598
ret

Function at 0x61c44c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x61c49d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x61c484
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x61c474
jmp 0x61c49d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x61c485
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x62b650
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
dec esi
test esi, esi
jl 0x62b666
inc esi
xor ecx, ecx
mov bl, byte [edx + ecx]
xor byte [eax + ecx], bl
inc ecx
dec esi
jne 0x62b65c
pop esi
pop ebx
ret

Function at 0x62b960
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
test ecx, ecx
jns 0x62b96e
add ecx, 0x1ff
sar ecx, 9
dec ecx
test ecx, ecx
jl 0x62b99c
inc ecx
mov dword [esp], ecx
xor esi, esi
xor ecx, ecx
mov ebx, esi
shl ebx, 9
add ebx, ecx
lea edi, [eax + ebx]
mov bl, byte [edx + ecx]
xor byte [edi], bl
inc ecx
cmp ecx, 0x200
jne 0x62b97e
inc esi
dec dword [esp]
jne 0x62b97c
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x62e054
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x10
mov edx, 0x654e10
mov ecx, eax
mov bl, byte [edx]
xor byte [ecx], bl
inc ecx
inc edx
dec esi
jne 0x62e062
pop esi
pop ebx
ret
Function at 0x62f614
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov dword [esp], ecx
mov ebx, edx
mov esi, eax
lea eax, [esp + 4]
mov cl, 1
mov edx, 0x20
call fcn.00402f1c
cmp bx, 0x20
jbe 0x62f63a
mov bx, 0x20
movzx ecx, bx
lea edx, [esp + 4]
mov eax, esi
call fcn.00402a14
mov ecx, dword [esp]
lea eax, [esp + 4]
mov edx, 0x20
call fcn.004f39fc
mov ecx, 0x10
mov eax, 0x654e20
mov edx, dword [esp]
mov bl, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x62f666
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x62f678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x62f7f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx]
cmp word [eax + 0x562], 0
je 0x62f7e1
mov eax, dword [ebx]
add eax, 0x81
xor ecx, ecx
mov edx, 0x3b
call fcn.00402f1c
mov eax, dword [ebx]
call fcn.0062f118
cmp al, 4
jne 0x62f703
mov eax, dword [ebx]
mov ax, word [eax + 0x420]
mov edx, eax
and dx, 0xff00
cmp dx, 0xff00
jne 0x62f6f1
and ax, 0xff
mov edx, dword [ebx]
mov word [edx + 0x9a], ax
jmp 0x62f703
mov eax, dword [ebx]
mov ax, word [eax + 0x420]
mov edx, dword [ebx]
mov word [edx + 0x9a], ax
mov eax, dword [ebx]
mov ax, word [eax + 0x188]
push eax
mov eax, dword [ebx]
add eax, 0x81
push eax
mov eax, dword [ebx]
add eax, 0x7a
push eax
mov eax, dword [ebx]
add eax, 0x7b
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebx]
call fcn.0062b8fc
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebx]
mov edx, dword [ebx]
mov eax, dword [esi + 0x564]
call dword [esi + 0x560]
mov eax, dword [ebx]
mov al, byte [eax + 0x81]
test al, al
setne byte [ebp - 1]
cmp al, 1
jne 0x62f7e1
mov eax, dword [ebx]
call fcn.0062f118
cmp al, 4
jne 0x62f7be
mov eax, dword [ebx]
add eax, 0x5c0
call fcn.0040a538
mov edx, eax
lea ecx, [ebp - 0x11]
mov eax, dword [ebx]
add eax, 0x5c0
call fcn.0062f614
mov eax, dword [ebx]
add eax, 0x5c0
xor ecx, ecx
mov edx, 0x20
call fcn.00402f1c
xor eax, eax
mov edx, dword [ebx]
mov dl, byte [edx + eax + 0x3e8]
mov ecx, eax
and ecx, 0x8000000f
jns 0x62f7a9
dec ecx
or ecx, 0xfffffff0
inc ecx
xor dl, byte [ebp + ecx - 0x11]
mov ecx, dword [ebx]
mov byte [ecx + eax + 0x9c], dl
inc eax
cmp eax, 0x20
jne 0x62f791
jmp 0x62f7e1
xor eax, eax
mov edx, dword [ebx]
mov dl, byte [edx + eax + 0x3e8]
mov ecx, dword [ebx]
xor dl, byte [ecx + eax + 0x2e8]
mov ecx, dword [ebx]
mov byte [ecx + eax + 0x9c], dl
inc eax
cmp eax, 0x20
jne 0x62f7c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f7fe
lea eax, [ebp - 0x18]
call fcn.00404574
ret
Function at 0x634610
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
lea esi, [eax + 0x40]
mov ecx, 0x80
lea edx, [eax + 0xc0]
mov bl, byte [edx]
xor byte [esi], bl
inc esi
inc edx
dec ecx
jne 0x634620
pop esi
pop ebx
ret

Function at 0x639588
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6395f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6552b8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x6395e3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00639578
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x639384]
call fcn.00639620
mov dword [0x65531c], eax
mov eax, dword [ebp - 4]
call fcn.00639528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639600
lea eax, [ebp - 8]
call fcn.00406538
ret
Function at 0x63a2a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x63a450
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x3d1b8], 0
je 0x63a2f4
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x3d1bc]
cmp eax, 0x7530
jbe 0x63a2f8
xor eax, eax
jmp 0x63a2fa
mov al, 1
test al, al
je 0x63a36f
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x3d1c0]
call fcn.004047e8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404990
jne 0x63a369
lea eax, [ebp - 0x10]
lea edx, [ebx + 0x3d1df]
call fcn.004047e8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00404990
jne 0x63a369
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x3d200]
call fcn.004047e8
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404990
jne 0x63a369
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x3d251]
call fcn.004047e8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
call fcn.00404990
je 0x63a36d
xor eax, eax
jmp 0x63a36f
mov al, 1
test al, al
jne 0x63a388
mov eax, dword [ebp + 8]
push eax
push 4
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00613a94
jmp 0x63a39f
lea eax, [ebp - 0x1c]
mov ecx, esi
mov edx, 0x63a468
call fcn.00404890
mov eax, dword [ebp - 0x1c]
call fcn.004f14a0
mov byte [ebx + 0x3d1b8], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x3d1bc], eax
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00404820
lea edx, [ebp - 0x11c]
lea eax, [ebx + 0x3d1c0]
mov cl, 0x1e
call fcn.00402e0c
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404820
lea edx, [ebp - 0x11c]
lea eax, [ebx + 0x3d1df]
mov cl, 0x20
call fcn.00402e0c
lea eax, [ebp - 0x11c]
mov edx, esi
mov ecx, 0xff
call fcn.00404820
lea edx, [ebp - 0x11c]
lea eax, [ebx + 0x3d200]
mov cl, 0x50
call fcn.00402e0c
lea eax, [ebx + 0x3d251]
mov edx, dword [ebp + 8]
mov ecx, 0xff
call fcn.00404820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63a457
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404598
ret