joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10134340
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x10134389
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x10134800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10154cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.101343b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.10134430
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.10134430
lea ecx, [esi + 0xc]
call fcn.1014cc05
lea ecx, [esi + 0x10]
call fcn.1014cc05
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.101359c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.101359c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.101359c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.1014cc7a
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1014cc7a
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10137d30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x10137d3c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x10137dcf
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x10137d99
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.10137de0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x10137d6e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x10137e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x10137efd
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10137e52
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x10137e7e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.10137de0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x10137ebf
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10137e41
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10139d30
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x10187f3c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x10139d43
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x10139d84
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10187fe4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10139db6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10139dba
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x10139dab
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10139dd8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10139ddc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x10139dcd
xor ecx, ecx
mov eax, 0x10187f4c
xor ebx, ebx
mov bl, byte [ecx + 0x10187ff4]
cmp byte [esp + ebx + 0x14], 0
je 0x10139e07
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1018800c]
cmp byte [esp + ebx + 0x14], 0
je 0x10139e1e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x10139dee
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10139d77
lea edx, [esp + 0x84]
push edx
call fcn.10139e60
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x101501c2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10150204
call fcn.1015303c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10150204
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x101501fb
xor eax, eax
jmp 0x1015020c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10150212
pop edi
pop esi
pop ebx
ret 4
Function at 0x4074df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f88c]
jne 0x4074e9
repz ret
jmp fcn.0040b7af

Function at 0x40b19d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d28
and dword [ebp - 4], 0
cmp dword [0x434964], 0
mov ebx, eax
jne 0x40b24e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b2ff
push eax
call fcn.00405cb6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434964], eax
call esi
push eax
call fcn.00405cb6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x434968], eax
call esi
push eax
call fcn.00405cb6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43496c], eax
call esi
push eax
call fcn.00405cb6
pop ecx
mov dword [0x434974], eax
test eax, eax
je 0x40b24e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405cb6
pop ecx
mov dword [0x434970], eax
mov eax, dword [0x434970]
cmp eax, ebx
je 0x40b2a6
cmp dword [0x434974], ebx
je 0x40b2a6
push eax
call fcn.00405d31
push dword [0x434974]
mov esi, eax
call fcn.00405d31
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2a6
test edi, edi
je 0x40b2a6
call esi
test eax, eax
je 0x40b29d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b29d
test byte [ebp - 0xc], 1
jne 0x40b2a6
or dword [ebp + 0x10], 0x200000
jmp 0x40b2df
mov eax, dword [0x434968]
cmp eax, ebx
je 0x40b2df
push eax
call fcn.00405d31
pop ecx
test eax, eax
je 0x40b2df
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2df
mov eax, dword [0x43496c]
cmp eax, ebx
je 0x40b2df
push eax
call fcn.00405d31
pop ecx
test eax, eax
je 0x40b2df
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x434964]
call fcn.00405d31
pop ecx
test eax, eax
je 0x40b2ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b301
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x100141b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100141c1
pop dword [ebp - 0x4c]
mov eax, 0x8dc399ed
sub eax, 0x7dc2582c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe4460d3
add dword [ebp - 0x5c], 0x400de478
mov dword [ebp - 0x58], 0x3cec5581
add dword [ebp - 0x58], 0xf546f6c4
mov dword [ebp - 0x54], 0x61a795ba
sub dword [ebp - 0x54], 0x155b518c
mov dword [ebp - 0x50], 0x9aade3f3
add dword [ebp - 0x50], 0x65521c0d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x252c57c1
add eax, 0xeadaa94b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x416b381e
sub dword [ebp - 0x5c], 0xccf8cec8
mov dword [ebp - 0x58], 0x86d229a8
sub dword [ebp - 0x58], 0x4565c833
mov dword [ebp - 0x54], 0xdb988590
sub dword [ebp - 0x54], 0x78291924
mov dword [ebp - 0x50], 0x17c20c13
add dword [ebp - 0x50], 0xe83df3ed
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x65d2f
push 0
call eax
mov ecx, 0x78f29718
add ecx, 0x870dab5c
xor edx, edx
add edx, eax
mov edi, 0x8a19ec46
add edi, 0x85ee5fba
add edi, dword [ebp - 0x4c]
mov esi, 0x3ea12a1a
sub esi, 0x17b3c38e
mov ebx, dword [edi]
xor dword [ebp - 0x20], edi
add ebx, esi
xor dword [ebp - 0x1c], eax
mov dword [edx], ebx
xor dword [ebp - 8], 0x36091529
add edx, 0xb7fa2c19
add edx, 0x4805d3eb
add edi, 0xe89bffc
sub edi, 0xe89bff8
loop 0x100142e0
add eax, 0xfca3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4013c8
cmp byte [esi + ebx - 1], 0xa
je 0x40139c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4050a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4050b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401b10
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4050b4]
movzx eax, al
bt eax, esi
jae 0x401b70
mov ecx, dword [0x4050a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401a15
test byte [0x40202c], 8
jne 0x401ab0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x40203c], 8
jne 0x401a68
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4019e4
cmp esi, 3
jbe 0x401a20
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x403130]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x4019e4
mov ecx, dword [0x4050b4]
test ecx, ecx
je 0x401b50
mov dword [esp], 0x40203c
call dword [0x4050b4]
test al, 8
je 0x4019bb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x4019bb
mov ebx, dword [0x4050b4]
test ebx, ebx
je 0x401b30
mov dword [esp], 0x40202c
call dword [0x4050b4]
test al, 8
je 0x4019a6
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
shr edx, 6
imul ebx, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, ebx
lea ebx, [ebp - 0xd4]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x4019ae
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4050b4
call sym._load_func.part.0
jmp 0x40196d
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4050b4
call sym._load_func.part.0
jmp 0x401aba
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4050b4
call sym._load_func.part.0
jmp 0x401a76
mov eax, 0xffffffff
jmp 0x401a15
Function at 0x401ce0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x1003b014
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1003b023
pop dword [ebp - 0x28]
mov eax, 0x9238d14
add eax, 0x6e0230f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc9fa7dac
sub dword [ebp - 0x38], 0x7ba83861
mov dword [ebp - 0x34], 0x5e18849d
sub dword [ebp - 0x34], 0x2be53858
mov dword [ebp - 0x30], 0x45fc0e55
sub dword [ebp - 0x30], 0xf9afca27
mov dword [ebp - 0x2c], 0x42c4b0af
sub dword [ebp - 0x2c], 0x42c4b0af
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa1d89793
sub eax, 0x91d4b717
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd286390
add dword [ebp - 0x38], 0x674a05c6
mov dword [ebp - 0x34], 0xec4404d8
sub dword [ebp - 0x34], 0xaad7a363
mov dword [ebp - 0x30], 0x4c2c3961
sub dword [ebp - 0x30], 0xe8bcccf5
mov dword [ebp - 0x2c], 0x34178ff5
sub dword [ebp - 0x2c], 0x34178ff5
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xad6c9ef0
sub eax, 0x9d68be6c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7c4
push 0
call eax
mov ecx, 0x396bfde6
add ecx, 0xc694455c
mov edx, eax
mov ebx, 0xda152297
add ebx, 0x35f1ef69
add ebx, dword [ebp - 0x28]
mov esi, 0xd3f2675
xor dword [ebp - 0xc], edi
mov edi, dword [ebx]
sub dword [ebp - 0xc], 0x87ff936
sub edi, esi
mov dword [edx], edi
add edx, 0x2368b4b9
add edx, 0xdc974b4b
add ebx, 0xc9491e87
add ebx, 0x36b6e17d
loop 0x1003b13f
add eax, 0x3e9b53c2
add eax, 0xc165ac19
xor ebx, ebx
add ebx, eax
add eax, 0xd9f567a1
add eax, 0x260a9864
mov ecx, 0xbf39462a
sub ecx, 0xaf39462a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402c00
pop dword [ebp - 0x2c]
mov eax, 0x884678f0
add eax, 0x77f9b310
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x7e9d9329
sub dword [ebp - 0x3c], 0x304b4dde
mov dword [ebp - 0x38], 0xe11e6b2a
add dword [ebp - 0x38], 0x5114e11b
mov dword [ebp - 0x34], 0x25f060e2
sub dword [ebp - 0x34], 0xd9a41cb4
mov dword [ebp - 0x30], 0x2a83cf32
sub dword [ebp - 0x30], 0x2a83cf32
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x5046008f
add eax, 0xaffa6fd5
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x1533765d
add dword [ebp - 0x3c], 0x5f3ef2f9
mov dword [ebp - 0x38], 0x64d95fb8
add dword [ebp - 0x38], 0xdc9301bd
mov dword [ebp - 0x34], 0xe22be7a2
sub dword [ebp - 0x34], 0x7ebc7b36
mov dword [ebp - 0x30], 0x4e9f795d
sub dword [ebp - 0x30], 0x4e9f795d
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfaf6f3ff
add eax, 0x5497ca9
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3323a
push 0
call eax
mov ecx, 0x44c20c04
add ecx, 0xbb3e2dc9
xor esi, esi
add esi, eax
mov edx, 0xf9368e7e
add edx, 0x70a7182
add edx, dword [ebp - 0x2c]
mov ebx, 0xe98272b3
add ebx, 0xcdf6d975
sub dword [ebp - 0x14], esi
mov edi, dword [edx]
add dword [ebp - 0x28], 0x25fa6e0
sub edi, ebx
xor dword [ebp - 8], edi
mov dword [esi], edi
xor dword [ebp - 8], 0x9ebb1d99
add esi, 4
add edx, 0xab866205
add edx, 0x54799dff
loop 0x402d24
add eax, 0x3b4b686e
add eax, 0xc4b57199
xor ebx, ebx
add ebx, eax
add eax, 0x67fd2b9f
sub eax, 0x67fd2b9a
mov ecx, 0xe2971fd8
sub ecx, 0xe2571fd8
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4026b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ed20
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x448040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x2c
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea edi, [esi + 0x3c]
add esp, 0xc
lea eax, [edi + 0x10]
mov dword [ebp - 0x10], edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x4027a8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.0041c7a0
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 0
movups xmmword [esi + 0x74], xmm0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404f60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x404fc1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x404fa4
cmp edi, 2
jb 0x404fa4
cmp byte [esi], cl
jne 0x404fa4
cmp byte [esi + 1], cl
jne 0x404fa4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x441548]
jmp 0x404f75
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x441548]
test edi, edi
jne 0x404f75
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x404ff0
cmp cl, 0x23
jne 0x404fd7
cmp byte [esi], cl
jne 0x404fd7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x441548]
test cl, cl
jne 0x404fc8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x405180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x405193
mov dword [ebx], 0
mov edx, 0x441144
call fcn.00405000
mov esi, eax
test esi, esi
je 0x4052b2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4052a8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x4052a8
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x4052a8
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x4052a8
mov ecx, edi
call fcn.00408e30
mov dword [ebp + 8], eax
test eax, eax
je 0x4052a8
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x405291
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [0x4484a0]
add esp, 4
test ecx, ecx
je 0x40527e
movsx edx, word [ecx + 0x5ee4]
lea eax, [ecx + 0x5ee8]
mov esi, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], esi
je 0x405274
lea eax, [edx + 1]
mov edi, 6
cdq
idiv edi
movzx eax, dx
mov word [ecx + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], esi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee0]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x4052a0
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret