joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push 1
call sub.ucrtbase.dll__configure_narrow_argv
add esp, 4
call sub.ucrtbase.dll__initialize_narrow_environment
call sub.ucrtbase.dll___p___argc
mov edi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov ebx, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov esi, eax
call sym._get_nt_header
xor ecx, ecx
cmp word [eax + 0x5c], 2
sete cl
inc ecx
push ecx
call sub.ucrtbase.dll__set_app_type
add esp, 4
push esi
push ebx
push edi
call sym._main
add esp, 0xc
push eax
call sub.ucrtbase.dll_exit
nop word cs:[eax + eax]

Function at 0x404680
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
xor ebx, ebx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
xor eax, eax
jmp 0x4046a9
xor edx, edx
test eax, eax
je 0x4046e5
inc esi
mov ebx, edx
movzx ecx, byte [esi]
cmp ecx, 9
je 0x4046a0
test ecx, ecx
je 0x4046e5
cmp cl, 0x20
jne 0x4046be
test eax, eax
je 0x4046e5
xor edx, edx
cmp ecx, 0x22
je 0x4046cf
cmp ecx, 0x5c
jne 0x4046a6
inc ebx
mov edx, ebx
jmp 0x4046a6
xor ecx, ecx
test eax, eax
sete cl
test bl, 1
cmove eax, ecx
jmp 0x4046a6
movzx ecx, byte [esi + 1]
inc esi
cmp cl, 0x20
je 0x4046e0
movzx eax, cl
cmp eax, 9
je 0x4046e0
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x24], 1
jne 0x40470f
mov word [ebp - 0x20], 1
mov edi, 1
jmp 0x404713
movzx edi, word [ebp - 0x20]
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push edi
push esi
push 0
push eax
call sym._WinMain_16
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40694f
pop dword [ebp - 0x30]
mov eax, 0xe1cddd22
add eax, 0x1e728c2d
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x278bcf90
add dword [ebp - 0x40], 0x26c675bb
mov dword [ebp - 0x3c], 0xd3469559
sub dword [ebp - 0x3c], 0xa1134914
mov dword [ebp - 0x38], 0x2bef6806
sub dword [ebp - 0x38], 0xdfa323d8
mov dword [ebp - 0x34], 0x4bc63605
add dword [ebp - 0x34], 0xb439c9fb
lea eax, [ebp - 0x40]
push eax
mov eax, 0x41b84353
sub eax, 0x4176f2e3
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2977eac
sub dword [ebp - 0x40], 0x8e251556
mov dword [ebp - 0x3c], 0xbf985be3
sub dword [ebp - 0x3c], 0x7e2bfa6e
mov dword [ebp - 0x38], 0x39bcad8
add dword [ebp - 0x38], 0x5fd3a194
mov dword [ebp - 0x34], 0x1e20c00d
add dword [ebp - 0x34], 0xe1df3ff3
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x404c6
push 0
call eax
mov ecx, 0x5dd8
mov edx, eax
mov ebx, 0xe8284401
sub ebx, 0xe7e5e001
add ebx, dword [ebp - 0x30]
mov edi, 0xa220a2e7
sub edi, 0x94d34bc5
add dword [ebp - 8], esi
mov esi, dword [ebx]
xor esi, edi
xor dword [ebp - 0xc], ecx
mov dword [edx], esi
xor dword [ebp - 8], esi
add edx, 0xb65111f0
sub edx, 0xb65111ec
add ebx, 0xd9ccdac5
add ebx, 0x2633253f
loop 0x406a66
add eax, 0x78837b66
sub eax, 0x78821133
xor ebx, ebx
add ebx, eax
add eax, 0xfb77ba03
sub eax, 0xfb77b9fe
mov ecx, 0x1bc62b0
add ecx, 0xfe839d50
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403e07
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [0x42b0c0], ebx
je 0x403e3a
mov eax, 0x42b0c0
mov ecx, dword [ebp + 8]
cmp dword [eax], ecx
je 0x403e3a
inc esi
mov eax, esi
shl eax, 4
lea eax, [eax + 0x42b0c0]
cmp dword [eax], ebx
jne 0x403e23
shl esi, 4
cmp dword [esi + 0x42b0c0], ebx
jne 0x403e4f
mov eax, 0x424998
jmp 0x403fc2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x64]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x64]
push eax
call ebx
mov dword [ebp - 4], eax
call edi
test eax, eax
jne 0x403eff
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
add eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041c56d
pop ecx
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x64]
push eax
call ebx
cmp eax, dword [ebp - 4]
ja 0x403ef6
call edi
test eax, eax
jne 0x403ef6
mov eax, dword [esi + 0x42b0cc]
test eax, eax
je 0x403eeb
mov edi, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403ee8
push dword [esi + 0x42b0cc]
call fcn.0041c4e9
mov dword [esi + 0x42b0cc], edi
jmp 0x403efe
push edi
jmp 0x403ef9
mov eax, dword [ebp - 8]
mov dword [esi + 0x42b0cc], eax
jmp 0x403eff
push dword [ebp - 8]
call fcn.0041c4e9
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x42b0cc]
test eax, eax
jne 0x403fc1
mov ebx, dword [esi + 0x42b0c4]
cmp dword [esi + 0x42b0c8], eax
je 0x403f37
call fcn.00403dac
cmp eax, dword [0x4258e8]
jne 0x403f37
mov ebx, dword [esi + 0x42b0c8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041c56d
cmp dword [0x42b088], 0xffffffff
pop ecx
mov dword [esi + 0x42b0cc], eax
jne 0x403fa1
and dword [0x42b088], 0
push 0x1f
lea eax, [ebp - 0xa4]
push eax
movzx eax, word [0x42c24c]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x403fa1
lea eax, [ebp - 0xa4]
push eax
call fcn.0041c727
pop ecx
mov dword [0x42b088], eax
lea eax, [edi + 1]
push eax
push dword [esi + 0x42b0cc]
push edi
push ebx
push 0
push dword [0x42b088]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi + 0x42b0cc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409ac7
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, 0x4b6
push edi
mov esi, ecx
call fcn.004083f1
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
add eax, 2
push edi
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.00408412
push 1
inc edi
push edi
mov ecx, esi
call fcn.00408412
and dword [ebp - 0x2c4], 0
push 0x2b0
lea eax, [ebp - 0x2c0]
push 0
push eax
call fcn.0041c740
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2c4]
push 0x408a56
push 0xfffffffffffffffc
push edi
mov ecx, esi
mov dword [esi + 0x50], eax
call fcn.0040809f
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.004097b0
mov ecx, esi
mov edi, eax
call fcn.004090d6
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40a81f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40a827
mov dword [ecx*4 + 0x42f480], eax
inc ecx
cmp ecx, 0x100
jb 0x40a822
mov edx, 0x800
jmp 0x40a874
mov eax, dword [ecx*4 + 0x42f080]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x42f480]
inc ecx
mov dword [ecx*4 + 0x42f47c], eax
cmp ecx, edx
jb 0x40a853
mov eax, 0x423240
mov esi, 0x423160
mov dword [0x42f464], eax
mov dword [0x431480], eax
mov dword [0x42f460], esi
call fcn.00410e05
test eax, eax
jne 0x40a8a1
mov dword [0x431480], esi
pop esi
ret

Function at 0x41104c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411072
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x411072
xor al, al
jmp 0x411087
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x41499f
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x414f47
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
movzx ecx, byte [eax + str.cw]
mov byte [ecx + 0x42c558], al
inc eax
cmp eax, 0x100
jb 0x414f4f
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + str.cw]
mov eax, esi
and al, 0x80
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x1b
lea edx, [esi + esi]
xor eax, edx
mov edi, 0xff
and eax, edi
mov edx, eax
xor edx, esi
mov dword [ebp - 8], edx
shl edx, 8
or edx, esi
shl edx, 8
or edx, esi
shl edx, 8
or edx, eax
mov dword [ecx*4 + 0x42d660], edx
mov edx, esi
shl edx, 8
mov ebx, edx
or edx, eax
or ebx, esi
shl edx, 8
or edx, dword [ebp - 8]
shl ebx, 8
or ebx, eax
shl eax, 8
or eax, dword [ebp - 8]
shl ebx, 8
or ebx, dword [ebp - 8]
shl edx, 8
shl eax, 8
mov dword [ecx*4 + 0x42da60], ebx
mov ebx, ecx
movzx esi, byte [ebx + str.cw]
or edx, esi
or eax, esi
mov dword [ecx*4 + 0x42de60], edx
movzx edx, byte [ebx + 0x42c558]
shl eax, 8
or eax, esi
mov dword [ecx*4 + 0x42e260], eax
mov eax, edx
and al, 0x80
mov dword [ebp - 8], edx
movzx eax, al
neg eax
sbb eax, eax
add edx, edx
and eax, 0x1b
xor eax, edx
and eax, edi
mov edx, eax
and dl, 0x80
movzx esi, dl
neg esi
sbb esi, esi
and esi, 0x1b
lea edx, [eax + eax]
xor esi, edx
and esi, edi
mov edx, esi
and dl, 0x80
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea ebx, [esi + esi]
xor edx, ebx
and edx, edi
mov edi, edx
xor edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, edx
xor edi, eax
xor edi, dword [ebp - 8]
xor edx, esi
xor eax, edx
mov esi, edx
xor esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ebx, edi
shl ebx, 8
or ebx, esi
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, eax
mov dword [ecx*4 + 0x42c658], ebx
mov ebx, esi
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, eax
shl ebx, 8
or ebx, edi
mov dword [ecx*4 + 0x42ca58], ebx
mov ebx, edx
shl ebx, 8
or ebx, eax
shl eax, 8
or eax, edi
shl ebx, 8
shl eax, 8
or ebx, edi
or eax, esi
shl ebx, 8
shl eax, 8
or ebx, esi
or eax, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
mov dword [ecx*4 + 0x42ce58], ebx
mov dword [ecx*4 + 0x42d258], eax
jb 0x414f6b
mov dword [0x42e660], 0x414863
mov dword [0x42d65c], 0x4148bf
mov dword [0x42d658], 0x414943
call fcn.00410eda
pop edi
pop esi
pop ebx
test eax, eax
je 0x415116
mov dword [0x42e660], 0x423470
mov dword [0x42d65c], 0x423320
mov dword [0x42d658], 0x4234e0
leave
ret
Function at 0x4158eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
and esi, 7
cmp eax, 5
jae 0x41590b
xor eax, eax
jmp 0x415a20
add dword [ebp + 0x10], 5
push ebx
mov ebx, dword [ebp + 8]
sub eax, 4
add eax, ebx
push edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 4]
lea edx, [edi + ebx]
jmp 0x41592d
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x415932
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x415924
mov ecx, edx
sub ecx, edi
mov eax, edx
sub eax, ebx
sub ecx, ebx
mov dword [ebp - 4], eax
cmp edx, dword [ebp + 0xc]
jae 0x415a09
cmp ecx, 2
jbe 0x415989
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x4159a7
movzx eax, byte [edx + 3]
mov edi, dword [ebp + 0x10]
add edi, dword [ebp - 4]
add dword [ebp - 4], 5
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
cmp dword [ebp + 0x18], 0
je 0x4159b4
add eax, edi
jmp 0x4159b6
shr esi, cl
test esi, esi
je 0x41594f
cmp esi, 4
ja 0x4159a7
cmp esi, 3
je 0x4159a7
mov eax, esi
shr eax, 1
movzx eax, byte [eax + edx + 1]
inc eax
test al, 0xfe
jne 0x41594f
or esi, 8
shr esi, 1
inc dword [ebp - 4]
jmp 0x41591c
sub eax, edi
test esi, esi
je 0x4159e7
and esi, 6
shl esi, 2
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x4159e2
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [ebp + 0x18], 0
je 0x4159e0
add eax, edi
jmp 0x4159e2
sub eax, edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x41591c
push 2
pop eax
shr esi, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x14]
sbb eax, eax
not eax
and eax, esi
pop edi
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop ebx
pop esi
leave
ret

Function at 0x420ded
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c110]
jne 0x420df7
repz ret
jmp fcn.00422dd8
Function at 0x421abb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041f635
and dword [ebp - 0x14], 0
cmp dword [0x42f0dc], 0
mov dword [ebp - 0x18], eax
jne 0x421b6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x421c16
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x421c16
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42f0dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42f0e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42f0e4], eax
call edi
push eax
call esi
mov dword [0x42f0ec], eax
test eax, eax
je 0x421b6e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42f0e8], eax
mov eax, dword [0x42f0e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x421bc7
cmp dword [0x42f0ec], ecx
je 0x421bc7
push eax
call esi
push dword [0x42f0ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x421bc7
test ebx, ebx
je 0x421bc7
call edi
test eax, eax
je 0x421bbe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x421bbe
test byte [ebp - 8], 1
jne 0x421bc7
or dword [ebp + 0x10], 0x200000
jmp 0x421bfa
mov eax, dword [0x42f0e0]
cmp eax, dword [ebp - 0x18]
je 0x421bfa
push eax
call esi
test eax, eax
je 0x421bfa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x421bfa
mov eax, dword [0x42f0e4]
cmp eax, dword [ebp - 0x18]
je 0x421bfa
push eax
call esi
test eax, eax
je 0x421bfa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42f0dc]
call esi
test eax, eax
je 0x421c16
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x421c18
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420ded
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x402c00
pop dword [ebp - 4]
mov eax, 0x6b1d20ec
add eax, 0x95230b14
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x12921f62
add dword [ebp - 0x14], 0x3bc025e9
mov dword [ebp - 0x10], 0x512b40f7
add dword [ebp - 0x10], 0xe1080b4e
mov dword [ebp - 0xc], 0xaa16f3a3
add dword [ebp - 0xc], 0xa235508b
mov dword [ebp - 8], 0xce77d0cc
add dword [ebp - 8], 0x31882f34
lea eax, [ebp - 0x14]
push eax
mov eax, 0x918f224f
add eax, 0x6eb15e3d
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x327cde0
add dword [ebp - 0x14], 0x714a9b76
mov dword [ebp - 0x10], 0xd7d4c6c7
add dword [ebp - 0x10], 0x69979aae
mov dword [ebp - 0xc], 0xedb83701
sub dword [ebp - 0xc], 0x8a48ca95
mov dword [ebp - 8], 0x5b7e0cd9
add dword [ebp - 8], 0xa481f327
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x39182
push 0
call eax
mov ecx, 0x6aac77e4
sub ecx, 0x6aac2645
mov edx, eax
mov edi, 0x3e299ea0
sub edi, 0x3de88ea0
add edi, dword [ebp - 4]
mov esi, 0x6d387a3
sub esi, 0xdaaeb658
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 4
add edi, 0xae2afc2b
add edi, 0x51d503d9
loop 0x402d1d
add eax, 0xec70394f
add eax, 0x13910000
xor ebx, ebx
add ebx, eax
add eax, 0xf8f03fd9
add eax, 0x70fc02c
mov ecx, 0xcbb8859a
add ecx, 0x34877a66
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x402120
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8020c8]
jne 0x40212a
repz ret
jmp fcn.00404fee

Function at 0x404c0f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040316b
and dword [ebp - 4], 0
cmp dword [0x806ee4], 0
mov ebx, eax
jne 0x404cc0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404d71
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404d71
push eax
call fcn.004030f9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x806ee4], eax
call esi
push eax
call fcn.004030f9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x806ee8], eax
call esi
push eax
call fcn.004030f9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x806eec], eax
call esi
push eax
call fcn.004030f9
pop ecx
mov dword [0x806ef4], eax
test eax, eax
je 0x404cc0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004030f9
pop ecx
mov dword [0x806ef0], eax
mov eax, dword [0x806ef0]
cmp eax, ebx
je 0x404d18
cmp dword [0x806ef4], ebx
je 0x404d18
push eax
call fcn.00403174
push dword [0x806ef4]
mov esi, eax
call fcn.00403174
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404d18
test edi, edi
je 0x404d18
call esi
test eax, eax
je 0x404d0f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404d0f
test byte [ebp - 0xc], 1
jne 0x404d18
or dword [ebp + 0x10], 0x200000
jmp 0x404d51
mov eax, dword [0x806ee8]
cmp eax, ebx
je 0x404d51
push eax
call fcn.00403174
pop ecx
test eax, eax
je 0x404d51
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404d51
mov eax, dword [0x806eec]
cmp eax, ebx
je 0x404d51
push eax
call fcn.00403174
pop ecx
test eax, eax
je 0x404d51
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x806ee4]
call fcn.00403174
pop ecx
test eax, eax
je 0x404d71
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404d73
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6494b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x58a015
lea edi, [esi - 0x189015]
push edi
or ebp, 0xffffffff
jmp 0x6494d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6494d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6494c8
mov eax, 1
add ebx, ebx
jne 0x6494eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6494fc
jne 0x64951b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64951b
dec eax
add ebx, ebx
jne 0x649508
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6494e0
add ebx, ebx
jne 0x649517
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x64956d
xor ecx, ecx
sub eax, 3
jb 0x649533
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6495a2
sar eax, 1
mov ebp, eax
jmp 0x64953e
add ebx, ebx
jne 0x64953e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64950c
inc ecx
add ebx, ebx
jne 0x64954c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64950c
add ebx, ebx
jne 0x649559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x64954e
jne 0x64956a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x64954e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x64958c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x64957e
jmp 0x6494ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x64958c
add edi, ecx
jmp 0x6494ce
pop esi
mov edi, esi
mov ecx, 0x5b2f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6495aa
cmp byte [edi], 0x15
jne 0x6495aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6495af
lea edi, [esi + 0x241000]
mov eax, dword [edi]
or eax, eax
je 0x64961e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x270568]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x270590]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6495dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x270598]
or eax, eax
je 0x649618
mov dword [ebx], eax
add ebx, 4
jmp 0x6495f9
call dword [esi + 0x270594]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x64964f
cmp al, 0xef
ja 0x649642
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x649624
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x649631
mov ebp, dword [esi + 0x27059c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x649683
sub esp, 0xffffff80
jmp 0x4673a0