joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4032d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x403488
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40330b
dec eax
je 0x4032f5
dec eax
je 0x403301
jmp 0x40330b
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40330b
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40335d
xor ebp, ebp
cmp esi, ebp
jle 0x403379
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x403330
mov ecx, esi
sub ecx, ebp
jmp 0x403335
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x403379
add ebp, 0x4000
cmp esi, ebp
jg 0x403317
jmp 0x403379
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x403484
cmp byte [edi + 0x14], 0
je 0x403484
cmp dword [edi + 0xc], 0
jne 0x403484
call sub.KERNEL32.DLL_GetLastError
mov ebp, eax
mov eax, edi
call fcn.004036ac
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [edi + 0x17]
call fcn.00403e5c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push ebp
call sub.KERNEL32.DLL_SetLastError
mov eax, esi
cdq
cmp edx, dword [esp + 0x14]
jne 0x4033d2
cmp eax, dword [esp + 0x10]
jae 0x40341e
jmp 0x4033d4
jge 0x40341e
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4033f6
cmp eax, 0xffffffff
ja 0x40341e
jmp 0x4033f8
jg 0x40341e
mov eax, esi
cdq
add eax, dword [esp + 8]
adc edx, dword [esp + 0xc]
cmp edx, 0
jne 0x40340f
cmp eax, 0xffffffff
jbe 0x40341e
jmp 0x403411
jle 0x40341e
lea edx, [edi + 0x17]
mov eax, 0x443458
call fcn.0042e9b8
lea edx, [edi + 0x17]
mov eax, 0x443458
call fcn.0042e9ec
test al, al
je 0x40346e
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x40330b
cmp dword [esp + 4], 0
jbe 0x40330b
mov eax, edi
call fcn.004036ac
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.004035f4
jmp 0x40330b
lea ecx, [edi + 0x17]
mov eax, 0x443458
xor edx, edx
call fcn.0042e9a0
jmp 0x403484
mov byte [edi + 8], 1
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403574
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40359b
cmp esi, 0x4e20
jle 0x403591
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4035ec
mov eax, ebx
call fcn.004038f0
test al, al
je 0x4035d3
cmp esi, 0x4e20
jle 0x4035d3
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00403574
jmp 0x4035ef
cmp dword [ebx + 0xc], 1
jne 0x4035e7
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x4035e7
xor eax, eax
jmp 0x4035ef
or eax, 0xffffffff
jmp 0x4035ef
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x403ab4
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0040b738
test eax, eax
je 0x403ada
test ebx, ebx
je 0x403ada
cmp word [ebx], 0
je 0x403ada
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x403ae2
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x403af5
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00404258
xor eax, eax
jmp 0x403b10
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x403b04
cmp eax, 3
jne 0x403b0b
mov eax, 2
jmp 0x403b10
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x403e20
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffc00
mov edx, esp
call fcn.00402330
cmp byte [esp], 0
je 0x403e37
mov eax, esp
jmp 0x403e39
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x403e4d
cmp eax, 5
je 0x403e4d
xor edx, edx
jmp 0x403e52
mov edx, 1
mov eax, edx
add esp, 0x400
ret
Function at 0x403e5c
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
add esp, 0xfffffbd0
mov ebx, eax
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00402330
cmp dword [0x43f1f8], 0
jne 0x403e9a
push 0x43f200
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x403e9a
push str.GetDiskFreeSpaceExA
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x43f1f8], eax
cmp dword [0x43f1f8], 0
je 0x403f09
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00401e94
xor ecx, ecx
lea eax, [esp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
push eax
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x18]
push eax
cmp byte [esp + 0x3c], 0
je 0x403ed4
lea edx, [esp + 0x3c]
jmp 0x403ed6
xor edx, edx
push edx
call dword [0x43f1f8]
test eax, eax
je 0x403f09
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
ja 0x403f09
mov eax, dword [esp + 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x403f76
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push ecx
cmp byte [esp + 0x40], 0
je 0x403f2a
lea eax, [esp + 0x40]
jmp 0x403f2c
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x403f3f
mov eax, 0x163e00
xor edx, edx
jmp 0x403f76
mov eax, dword [esp + 0x18]
imul dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
call fcn.00439408
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x430
pop esi
pop ebx
ret

Function at 0x403f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040b738
test eax, eax
je 0x403fab
test ebx, ebx
je 0x403fab
cmp word [ebx], 0
je 0x403fab
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x40422c
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040b738
test eax, eax
je 0x40424e
test ebx, ebx
je 0x40424e
cmp word [ebx], 0
je 0x40424e
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x404258
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040b738
test eax, eax
je 0x404285
test ebx, ebx
je 0x404285
cmp word [ebx], 0
je 0x404285
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x404294
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x4048ac
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4048b5
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.004140e0
lea eax, [esp + 0xc40]
call fcn.004140e0
lea eax, [esp + 0xc6c]
call fcn.004140e0
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.0040e6e8
test al, al
jne 0x404915
xor eax, eax
jmp 0x404a69
cmp byte [esp], 0
je 0x404925
cmp byte [esp + 0xc98], 0
jne 0x40492c
xor eax, eax
jmp 0x404a69
mov eax, esp
call fcn.00401964
lea edx, [esp + 0xc98]
call fcn.00401750
test eax, eax
je 0x40495a
mov eax, esi
call fcn.00401964
lea edx, [esp + 0xc98]
call fcn.00401750
test eax, eax
je 0x404961
xor eax, eax
jmp 0x404a69
xor ebx, ebx
push 0x400
push esi
push edi
call fcn.0043689c
add esp, 0xc
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00401964
push eax
call fcn.00438038
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00403f80
test al, al
je 0x4049a0
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x404963
mov eax, edi
xor edx, edx
call fcn.00403f80
test al, al
je 0x4049b4
xor eax, eax
jmp 0x404a69
push 0x400
push esi
lea edx, [esp + 0x14bc]
push edx
call fcn.0043689c
add esp, 0xc
mov eax, esp
call fcn.00401964
push eax
lea eax, [esp + 0x14b8]
call fcn.00401964
push eax
call fcn.00436704
add esp, 8
push edi
lea edx, [esp + 0x14b8]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x4049fd
xor eax, eax
jmp 0x404a69
lea eax, [esp + 0x18b4]
call fcn.00402e68
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00403f80
test al, al
jne 0x404a2a
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.00403084
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x404a54
lea eax, [esp + 0x18b4]
call fcn.004031b8
lea eax, [esp + 0x18b4]
call fcn.0040324c
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.00402ebc
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x406690
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40b6dc
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x40b728
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push 0x80000000
push 0xd
call sub.USER32.DLL_ExitWindowsEx
add esp, 0x14
ret

Function at 0x40b7b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x44579c
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x40b7d2
call fcn.0040b780
mov eax, ebp
jmp 0x40b7ea
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x40b7f2
test al, 7
jne 0x40b7d6
cmp esi, 8
jb 0x40b87b
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x40b7fb
xor edx, edx
jmp 0x40b895
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x40b87f
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40b91c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
xor edx, dword [eax + 0x204]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
xor edx, dword [eax + 0x208]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ebx, dword [ecx + 8]
mov esi, dword [edx + 0xc]
xor ebx, dword [eax + 0x20c]
xor esi, dword [eax + 0x210]
xor edx, edx
mov ecx, esi
mov edi, esi
shr edi, 0x15
shl ecx, 0xb
or ecx, edi
mov edi, edx
and edi, 3
add ecx, ebx
xor ecx, dword [eax + edi*4 + 0x204]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ebp, byte [eax + ebp + 0x104]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
mov ecx, ebx
xor edi, dword [esp + 4]
mov dword [esp + 0xc], edi
mov edi, ebx
shr edi, 0xf
shl ecx, 0x11
or ecx, edi
mov edi, edx
and edi, 3
xor ecx, esi
add ecx, dword [eax + edi*4 + 0x204]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ebp, byte [eax + ebp + 0x104]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
xor edi, dword [esp + 8]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov ecx, edi
mov esi, ecx
mov ebx, dword [esp + 0xc]
inc edx
cmp edx, 0x20
jl 0x40b96a
mov edx, dword [esp + 0x10]
xor ebx, dword [eax + 0x204]
mov dword [edx], ebx
xor esi, dword [eax + 0x208]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x20c]
mov dword [ecx + 8], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x210]
mov dword [ecx + 0xc], edx
mov edx, dword [esp]
call fcn.0040bc68
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40babc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
xor ecx, dword [ebx + 0x204]
mov dword [esp], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
xor ecx, dword [ebx + 0x208]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 8]
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x20c]
mov edi, dword [eax + 0xc]
xor edi, dword [ebx + 0x210]
push 0x10
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00436514
add esp, 0xc
mov edx, 0x1f
mov eax, edi
mov ecx, edi
shr ecx, 0x15
shl eax, 0xb
or eax, ecx
mov ecx, edx
and ecx, 3
add eax, esi
xor eax, dword [ebx + ecx*4 + 0x204]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx + 0x104]
movzx ebp, byte [ebx + ebp + 0x104]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
mov eax, esi
xor ecx, dword [esp]
mov dword [esp + 8], ecx
mov ecx, esi
shr ecx, 0xf
shl eax, 0x11
or eax, ecx
mov ecx, edx
and ecx, 3
xor eax, edi
add eax, dword [ebx + ecx*4 + 0x204]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx + 0x104]
movzx ebp, byte [ebx + ebp + 0x104]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
xor ecx, dword [esp + 4]
mov dword [esp], esi
mov dword [esp + 4], edi
mov eax, ecx
mov edi, eax
mov esi, dword [esp + 8]
dec edx
test edx, edx
jge 0x40bb18
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x204]
mov dword [eax], esi
xor edi, dword [ebx + 0x208]
mov edx, dword [esp + 0xc]
mov dword [edx + 4], edi
mov ecx, dword [esp]
mov eax, dword [esp + 0xc]
xor ecx, dword [ebx + 0x20c]
mov dword [eax + 8], ecx
mov eax, ebx
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor edx, dword [ebx + 0x210]
mov dword [ecx + 0xc], edx
lea edx, [esp + 0x10]
call fcn.0040bc68
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40bc68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x44579c
xor ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x204], esi
movzx esi, byte [edx + ecx + 1]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x208], esi
movzx esi, byte [edx + ecx + 2]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x20c], esi
movzx esi, byte [edx + ecx + 3]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x210], esi
add ecx, 4
cmp ecx, 0x10
jl 0x40bc71
pop esi
pop ebx
ret
Function at 0x40c5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x40c607
test esi, esi
jg 0x40c60e
xor eax, eax
jmp 0x40c6c4
push 0x10
mov edx, dword [ebp - 4]
add edx, 4
push edx
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00436514
add esp, 0xc
test esi, esi
jns 0x40c62a
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x40c6a9
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040cfb4
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [eax]
xor dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 4]
xor dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
xor dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp - 0x10], eax
mov eax, edx
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jg 0x40c63c
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.00436514
add esp, 0xc
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c8e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, [ebp*4 + 0x4481ba]
lea ebx, [ebx*4 + 0x447dba]
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, [ebp*4 + 0x4485ba]
lea edx, [edx*4 + 0x4489ba]
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x40c8fa
inc eax
cmp eax, 4
jl 0x40c8f8
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.00436514
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x40c8f6
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40ee84
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x40eea4
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x40ee8b
cmp dword [eax], 0x11
jbe 0x40eebf
mov dword [eax], 0x11
jmp 0x40eeb3
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x40eebf
cmp dword [eax + edx*4], 0
je 0x40eeb1
ret

Function at 0x40f6f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x40f73f
mov eax, 1
jmp 0x40f718
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x40f70e
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.00436514
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40f7a4
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x40f77d
mov eax, 1
jmp 0x40f756
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x40f74c
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.00436514
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x40f7a4
mov eax, dword [ebx]
test eax, eax
jbe 0x40f790
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x40f790
dec eax
test eax, eax
ja 0x40f783
mov dword [edi], eax
test eax, eax
jbe 0x40f7a4
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x40f796
pop edi
pop esi
pop ebx
ret
Function at 0x42eae0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, ecx
mov ebx, edx
mov edi, eax
push esi
mov eax, 0xcf8
call fcn.0040dfac
push eax
test ebx, ebx
je 0x42eb09
cmp byte [ebx], 0
je 0x42eb09
mov edx, ebx
jmp 0x42eb0b
xor edx, edx
push edx
call fcn.004272dc
add esp, 0xc
call fcn.004273a8
call sub.KERNEL32.DLL_GetLastError
cmp eax, 3
jne 0x42eb7a
push esi
call fcn.00436734
pop ecx
mov ebp, eax
mov eax, esi
call fcn.00402290
test al, al
jne 0x42eb4e
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.00436734
pop ecx
add eax, ebp
inc eax
mov ebp, eax
cmp ebp, 0x104
jle 0x42eb7a
push 0x104
mov eax, 0xe5c
call fcn.0040dfac
push eax
test ebx, ebx
je 0x42eb6f
cmp byte [ebx], 0
jne 0x42eb71
xor ebx, ebx
push ebx
call fcn.004272dc
add esp, 0xc
mov eax, edi
call fcn.0042ed54
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret