joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c17f3
Capabilities:
Encode data using xor

Disassembly:
dec edx
aam 0x25
xor bl, dh
mov esi, 0xd6e8210c
nop
lcall 0xa04b, 0x94699f73
pop esi
and eax, 0xdd99e64b
xor eax, 0x42046544
push ecx
sub edx, dword [edx + 0x5b]
adc al, 0x69
xchg esp, eax
mov eax, dword [0x3fb6ce55]
add ecx, dword [0x36dcd821]
inc byte [esp - 0x345a4ba4]
jl 0x4c17f6
xchg edi, eax
jmp 0x4c1879
movsd dword es:[edi], dword [esi]
adc eax, 0x230c6524
lcall 0x585f, 0xbb5f4886
not byte [esi + 0x46]
or al, 0x85
cmp ebx, eax
adc dl, 0x23
add al, 0xd3
sbb bh, byte [ebx + ebp + 0x47cf2219]
aad 0x3c
xor eax, 0xaf7533a5
cmp al, 0x8e
imul edx, dword [eax], 0xffffffb5
pop edx
jl 0x4c18ff
pop esi
bound eax, qword [ebx - 0x55]
sbb cl, byte [ebx - 0x9231497]
insd dword es:[edi], dx
std
or dh, ch
adc al, 0x94
add esp, dword [edi - 0xcb64c62]
inc edi
adc dword [edi + edx*4 - 0xb84f86c], esi
in eax, 0x1b
loopne 0x4c18f5
salc
or al, 0xd8
add dh, ah
test eax, 0x19a08b41
daa
or al, 0x6b
jg 0x4c192d
sti
xchg edx, eax
sbb eax, 0x50f6e451
sub byte [edi - 0x15], 0x66
lodsb al, byte [esi]
int3
xchg ebp, eax
mov ah, 0x24
xor byte [ebx - 0x7e7cbbe4], 0xa2
mov edx, 0x5b1c67a7
stosd dword es:[edi], eax
retf
loop 0x4c195f
pop ds
inc esi
imul esi
daa
salc
push ebp
ret 0xfa06
xchg ecx, eax
test dword [ebp + 0x309e4d66], ecx
fcomp qword [ebx + 0x328deacb]
test dword [edi + 3], eax
sub byte [esi], al
invalid

Function at 0x4e0413
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513903
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0536
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffc33
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e054d
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb43
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5296c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x52972a
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x529747
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x5297b0
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572693
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x529783
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x529773
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x5297aa
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x529804
inc edi
cmp edi, ecx
jb 0x529797
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055d033
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570f0f
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x5297aa
cmp dword [esi + 0x14], 0x10
jb 0x529813
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x52982d
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572693
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x529863
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x529853
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5298a1
cmp ecx, edx
je 0x529918
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x529889
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.00548603
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055d163
mov eax, esi
jmp 0x5297e9
or ecx, 0xffffffff
jmp 0x5298a3
Function at 0x529b43
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d033
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c66
push ecx
lea ecx, [esi + 0x18]
call fcn.00549363
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c7d
push ecx
lea ecx, [esi + 0x24]
call fcn.00549273
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x549143
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x2169992a
xor dword [0xa61df850], edx
cmp eax, 0xf820fe1b
adc al, 0x46
jmp 0xcdef8556
mov byte [0x14884e8a], al
pop ebp
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
add dword [edx - 0x3aec375b], 0x9ec92d17
inc ecx
out dx, eax
test eax, 0x7481040d
inc eax
movsd dword es:[edi], dword [esi]
jns 0x5490e5
imul bl
push ebx
Function at 0x573153
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6643
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573276
push ecx
lea ecx, [esi + 0x18]
call fcn.00592973
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57328d
push ecx
lea ecx, [esi + 0x24]
call fcn.00592883
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x592883
Capabilities:
Encode data using xor

Disassembly:
and cl, byte [ecx]
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
std
sti
xchg esi, eax
std
dec esp
aas
rcr byte [ecx - 0x6e41c788], 0x2e
mov eax, dword [0x66a8a6cc]
sub ecx, dword [eax - 0x69]
pop ebp
adc eax, 0x76677e85
shr dword [edx + 0x25], cl
adc byte [esi], bh
inc ecx
or bl, byte [eax]
wait
push ss
dec esp
cwd
xor ebx, ebp
or byte [ebp - 0x69], al
stosb byte es:[edi], al
mov esi, 0xcd78054a
sub ebp, esp
salc
mov bh, 0xb0
mov eax, dword [0x39399e57]
in eax, dx
xchg ecx, eax
cdq
cmp bh, ah
mov ss, word [edi]
cmpsb byte [esi], byte es:[edi]
lea ecx, [ebx + 0x46]
lea ecx, [eax - 5]
pop ebx
mov byte [esi + 0x5b21b3e9], dh
inc esi
outsb dx, byte [esi]
push 0x3a
imul ah
cmp eax, 0xa4028adc
mov dl, 0xfd
enter 0xffffffffffffb7e1, 0xffffffffffffffc5
mov byte [0xb912820], al
mov dword [edi - 0x25733e66], ecx
dec eax
pop es
pop eax
inc ebp
fisttp qword [ebx + ecx*4]
jg 0x59287b
sar dword [edi - 0x6b], 1
lodsd eax, dword [esi]
adc al, 0x91
mov al, bl
lahf
fistp qword [esi - 0x3e670b2d]
sub byte [esi + 0x4418e25b], cl
mov edi, 0x5fe17d22
push ds
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
sbb byte [eax + 0x3d], dl
imul ebx, dword [ecx + 0x23], 0x21
sub bh, byte [edx + 0x2a]
jmp 0x6822dcdb
Function at 0x5bc713
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efc03
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc836
push ecx
lea ecx, [esi + 0x18]
call fcn.005dbf33
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bc84d
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbe43
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64cd5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654390
cmp edx, dword [eax]
je 0x64cd7f
add eax, 8
inc ecx
cmp eax, 0x654420
jl 0x64cd70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654390]
jne 0x64cead
mov eax, dword [0xa57cf0]
cmp eax, 1
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4011b5
pop dword [ebp - 0x30]
mov eax, 0x9b2e25e1
sub eax, 0x9aee142c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe459e878
sub dword [ebp - 0x40], 0x9607a32d
mov dword [ebp - 0x3c], 0x4d20fef
add dword [ebp - 0x3c], 0x2d613c56
mov dword [ebp - 0x38], 0x7d3f6f39
sub dword [ebp - 0x38], 0x30f32b0b
mov dword [ebp - 0x34], 0xd8cd0293
add dword [ebp - 0x34], 0x2732fd6d
lea eax, [ebp - 0x40]
push eax
mov eax, 0xe737885a
sub eax, 0xe6f6b806
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xd4b748c3
add dword [ebp - 0x40], 0x9fbb2093
mov dword [ebp - 0x3c], 0x4368a21b
add dword [ebp - 0x3c], 0xfe03bf5a
mov dword [ebp - 0x38], 0x4aa3c9ff
add dword [ebp - 0x38], 0x18cba26d
mov dword [ebp - 0x34], 0x89175945
sub dword [ebp - 0x34], 0x89175945
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xf65bf617
sub eax, 0xf61b25cb
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3799b
push 0
call eax
mov ecx, 0x403c
xor esi, esi
add esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x30]
mov ebx, 0x501f3e84
mov dword [ebp - 0x10], 0x3d5a4bf7
mov edx, dword [edi]
sub dword [ebp - 0x24], 0x609c6f35
sub edx, ebx
xor dword [ebp - 0x18], 0xaf6ac23f
mov dword [esi], edx
add esi, 0xa288a99a
sub esi, 0xa288a996
add edi, 0x4ee58df0
add edi, 0xb11a7214
loop 0x4012c7
add eax, 0x8ac998a3
add eax, 0x75375b20
xor ebx, ebx
add ebx, eax
add eax, 0xe9511f91
add eax, 0x16aee074
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402c00
pop dword [ebp - 0x50]
mov eax, 0x7bc2307a
add eax, 0x847dfb86
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x5273781e
sub dword [ebp - 0x60], 0x42132d3
mov dword [ebp - 0x5c], 0x7f6d198
sub dword [ebp - 0x5c], 0xd5c38553
mov dword [ebp - 0x58], 0xfeb8b4cc
sub dword [ebp - 0x58], 0xb26c709e
mov dword [ebp - 0x54], 0x96f68817
sub dword [ebp - 0x54], 0x96f68817
lea eax, [ebp - 0x60]
push eax
mov eax, 0x7b609472
add eax, 0x84dfdbf2
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xbed948ae
add dword [ebp - 0x60], 0xb59920a8
mov dword [ebp - 0x5c], 0xd3f7cd94
add dword [ebp - 0x5c], 0x6d7493e1
mov dword [ebp - 0x58], 0x2a987938
sub dword [ebp - 0x58], 0xc7290ccc
mov dword [ebp - 0x54], 0x1a47c094
add dword [ebp - 0x54], 0xe5b83f6c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x33ae2
push 0
call eax
mov ecx, 0x601cfe4
add ecx, 0xf9fe6c13
mov edx, eax
mov edi, 0x1280aa0e
add edi, 0xedc055f2
add edi, dword [ebp - 0x50]
mov esi, 0xf8faa6e2
sub esi, 0x60196dca
sub dword [ebp - 0x40], 0xbee5d44d
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0xd2b69f70
add ebx, esi
mov dword [edx], ebx
add dword [ebp - 0x24], esi
add edx, 0x2d9d9ee6
add edx, 0xd262611e
add edi, 4
loop 0x402d1d
add eax, 0xe2af
mov ebx, eax
add eax, 0x7339f68a
sub eax, 0x7339f685
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x409f72
Capabilities:
Move file

Disassembly:
mov eax, 0x40bca7
call fcn.0040a890
sub esp, 0x14
push ebx
push esi
push edi
push ecx
mov eax, esp
xor ebx, ebx
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x10], ebx
call fcn.0040129d
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.00401db0
mov dword [ebp - 4], 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 1
lea eax, [ebp - 0x1c]
pop edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.0040a684
mov byte [ebp - 4], 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
mov esi, 0x40faa4
push eax
push esi
call fcn.00408c13
test al, al
je 0x40a019
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
mov byte [ebp - 4], 4
call fcn.00401228
cmp eax, ebx
jne 0x40a046
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040659c
mov byte [ebp - 4], 6
nop
nop
nop
nop
nop
nop
push 0x40f964
push 0x40f960
lea ecx, [ebp - 0x18]
call fcn.00406da0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x18]
call fcn.004062b4
push eax
lea ecx, [ebp - 0x14]
call fcn.004062b4
push eax
call dword [sym.imp.MSVCRT.dll_rename]
pop ecx
test eax, eax
pop ecx
jne 0x40a0b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040659c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
call fcn.00406565
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00406565
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00406565
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x4335c8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4335cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
call fcn.00401000
mov eax, dword [str.3yL_]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4335d4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0x442914], 0xc
mov dword [ebp - 4], eax
jne 0x401080
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, dword [0x442914]
cmp eax, 0xfa9
jne 0x40109c
mov dword [0x442910], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010be
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x442864], 0
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov edx, edi
lea eax, [ebx + edi]
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x44290c], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, esi
shr edx, cl
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x401054
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4