joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e2e8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x438
mov eax, 0x10025b04
call fcn.10023418
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x424], ax
xor esi, esi
lea eax, [ebp - 0x422]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call sub.MSVCR100.dll_memset
fldz
add esp, 0x18
fstp qword [ebp - 0x444]
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSoftGrid
mov ebx, 0x104
push 0x80000002
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e531
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x428], esi
push esi
jmp 0x1001e402
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll__wtof]
fldz
fcomp st(1)
pop ecx
fnstsw ax
test ah, 5
jp 0x1001e3e2
fld qword [ebp - 0x444]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x1001e3e2
lea eax, [ebp - 0x21c]
fstp qword [ebp - 0x444]
push eax
lea eax, [ebp - 0x424]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e3e4
fstp st(0)
inc dword [ebp - 0x428]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
call edi
mov dword [ebp - 0x430], eax
cmp eax, esi
je 0x1001e39a
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0x103
jne 0x1001e531
mov ebx, dword [sym.imp.MSVCR100.dll_wcslen]
push str.ClientUserInterface
call ebx
mov edi, str.SoftwareMicrosoftSoftGrid_
push edi
mov dword [ebp - 0x430], eax
call ebx
mov ecx, dword [ebp - 0x430]
lea ebx, [ecx + eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.1001fbc4
add esp, 0xc
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x1001e531
push ebx
push esi
push eax
call fcn.1001fbc4
push edi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR100.dll_wcscat_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push dword [ebp - 0x428]
call edi
push str.ClientUserInterface
push ebx
push dword [ebp - 0x428]
call edi
add esp, 0x30
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push esi
push dword [ebp - 0x428]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e525
push dword [ebp - 0x434]
push str.LaunchCommand
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x43c]
push 0x1002ac28
push dword [ebp - 0x42c]
call fcn.1001e1a1
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023474
ret
Function at 0x1001fbc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001fbd3
pop dword [ebp - 8]
mov eax, 0xafc3f60a
sub eax, 0x9fc1fa37
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x4c97a583
sub dword [ebp - 0x18], 0xfe456038
mov dword [ebp - 0x14], 0xbfc0de28
add dword [ebp - 0x14], 0x72726e1d
mov dword [ebp - 0x10], 0x664004aa
add dword [ebp - 0x10], 0xe60c3f84
mov dword [ebp - 0xc], 0x27b8a842
add dword [ebp - 0xc], 0xd84757be
lea eax, [ebp - 0x18]
push eax
mov eax, 0x89cc604e
sub eax, 0x79c9eec2
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x4c380f08
sub dword [ebp - 0x18], 0xd7c5a5b2
mov dword [ebp - 0x14], 0x7e988d00
add dword [ebp - 0x14], 0xc2d3d475
mov dword [ebp - 0x10], 0x80e15187
add dword [ebp - 0x10], 0xe28e1ae5
mov dword [ebp - 0xc], 0x55d82902
sub dword [ebp - 0xc], 0x55d82902
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xf2d560ac
sub eax, 0xe2d2ef2c
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x4092e
push 0
call eax
mov ecx, 0x2436aa7d
add ecx, 0xdbc99d9f
xor edi, edi
add edi, eax
mov ebx, 0x10039800
add ebx, dword [ebp - 8]
mov edx, 0xa6168a22
sub edx, 0x15e32236
mov esi, dword [ebx]
sub dword [ebp - 4], 0x82878273
xor esi, edx
sub dword [ebp - 4], 0xcaba6b42
mov dword [edi], esi
sub dword [ebp - 4], ecx
add edi, 0x444e356e
sub edi, 0x444e356a
add ebx, 0xfb592e4d
sub ebx, 0xfb592e49
loop 0x1001fcf1
add eax, 0x611054a8
sub eax, 0x610f4165
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x883ad1b
add ecx, 0x77c52e5
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x10021388
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100327bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100331a8], 0
jne 0x10021493
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jbe 0x1002147d
cmp dword [ebp - 0x94], 5
je 0x1002143c
cmp dword [ebp - 0x94], 6
jne 0x10021489
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021430
dec eax
je 0x10021424
dec eax
je 0x10021418
dec eax
jne 0x10021489
mov dword [0x100331a8], 0x6b
jmp 0x10021493
mov dword [0x100331a8], 0x6a
jmp 0x10021493
mov dword [0x100331a8], 0x69
jmp 0x10021493
mov dword [0x100331a8], 0x68
jmp 0x10021493
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021471
dec eax
je 0x10021465
dec eax
je 0x10021459
mov dword [0x100331a8], 0x67
jmp 0x10021493
mov dword [0x100331a8], 0x66
jmp 0x10021493
mov dword [0x100331a8], 0x65
jmp 0x10021493
mov dword [0x100331a8], 0x64
jmp 0x10021493
mov dword [0x100331a8], 1
jmp 0x10021493
mov dword [0x100331a8], 0x6c
mov ecx, dword [ebp - 4]
mov eax, dword [0x100331a8]
xor ecx, ebp
call fcn.1002336a
leave
ret

Function at 0x1002336a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100327bc]
jne 0x10023374
repz ret
jmp fcn.10023b89
Function at 0x100129ec
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002cef1
call fcn.10014f28
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012a09
xor eax, eax
jmp 0x10012adf
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012add
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10012ab3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.100125e1
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.100125e1
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10012b61
lea ecx, [ebp - 0x240]
call fcn.10012b61
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
call main
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012abd
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012c52
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012a36
jmp 0x10012ad6
mov edi, dword [ebp - 0x234]
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10012c52
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10014ed2
ret

Function at 0x1002aba3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1002abb2
pop dword [ebp - 0x4c]
mov eax, 0x1002abb2
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x47c23
push 0
mov eax, 0x591f7153
sub eax, 0x491c8067
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x667c
xor ebx, ebx
add ebx, eax
mov edi, 0x43570cd3
add edi, 0xccad8b2d
add edi, dword [ebp - 0x4c]
mov edx, 0xa03e92b6
sub edx, 0x7d2e02b5
xor dword [ebp - 0x34], ecx
mov esi, dword [edi]
mov dword [ebp - 8], 0xc994b75c
add esi, edx
xor dword [ebp - 0x1c], 0x1c4509d9
mov dword [ebx], esi
add ebx, 0xc96708b6
add ebx, 0x3698f74e
add edi, 4
loop 0x1002ac08
add eax, 0xb4ebb38f
sub eax, 0xb4ea26cc
xor ebx, ebx
add ebx, eax
add eax, 0xf182e123
add eax, 0xe7d1ee2
mov ecx, 0xd3b64d16
add ecx, 0x3c49b2ea
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1002ec40
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002ee0d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x25000]
push edi
or ebp, 0xffffffff
jmp 0x1002ec6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002ec71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002ec60
mov eax, 1
add ebx, ebx
jne 0x1002ec83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002ec78
jne 0x1002ec94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002ec78
xor ecx, ecx
sub eax, 3
jb 0x1002eca8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002ed1a
mov ebp, eax
add ebx, ebx
jne 0x1002ecb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002ecc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002ece4
inc ecx
add ebx, ebx
jne 0x1002ecd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002ecc5
jne 0x1002ece1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002ecc5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002ed04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002ecf5
jmp 0x1002ec66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002ed04
add edi, ecx
jmp 0x1002ec66
pop esi
mov edi, esi
mov ecx, 0xad3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002ed22
cmp byte [edi], 5
jne 0x1002ed22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002ed27
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x1002ed9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e2a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e330]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002ed54
mov ecx, edi
jns 0x1002ed83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e334]
or eax, eax
je 0x1002ed99
mov dword [ebx], eax
add ebx, 4
jmp 0x1002ed71
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002edd0
cmp al, 0xef
ja 0x1002edc3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002eda5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002edb2
mov ebp, dword [esi + 0x2e338]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002ee04
sub esp, 0xffffff80
jmp 0x10015980
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x100280a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001770
call fcn.01002acc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002845
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002845
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100285d
cmp eax, 0x20b
je 0x100284a
mov dword [ebp - 0x1c], edi
jmp 0x1002871
cmp dword [ecx + 0x84], 0xe
jbe 0x1002845
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100286b
cmp dword [ecx + 0x74], 0xe
jbe 0x1002845
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100419c], 0xffffffff
or dword [0x10041a0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004190]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100418c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004198], eax
call fcn.01002ac6
cmp dword [0x10040a0], edi
jne 0x10028ce
push fcn.01002ac6
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002ab4
push 0x10011bc
push 0x10011b8
call sub.msvcrt.dll__initterm
mov eax, dword [0x1004188]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1004184]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x10011b4
push 0x1001198
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1002934
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x10029ee
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x1002982
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x1002950
cmp ax, 0x22
jne 0x100293d
cmp word [esi], 0x22
jne 0x100295b
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x1002969
cmp ax, 0x20
jbe 0x1002956
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x100298f
movzx eax, word [ebp - 0x48]
jmp 0x1002992
cmp word [esi], 0x20
jbe 0x100295b
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x1002982
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x10029b3
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10029e8
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01002b05
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401c66
pop dword [ebp - 0x10]
mov eax, 0x401c66
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1e7d996f
add dword [ebp - 0x20], 0x2fd4abdc
mov dword [ebp - 0x1c], 0x852a1bca
sub dword [ebp - 0x1c], 0x52f6cf85
mov dword [ebp - 0x18], 0x5f5474d1
sub dword [ebp - 0x18], 0x130830a3
mov dword [ebp - 0x14], 0xa5286712
sub dword [ebp - 0x14], 0xa5286712
lea eax, [ebp - 0x20]
push eax
mov eax, 0x81b08034
sub eax, 0x81704fe0
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x65c2df00
add dword [ebp - 0x20], 0xeaf8a56
mov dword [ebp - 0x1c], 0x5403b327
sub dword [ebp - 0x1c], 0x129751b2
mov dword [ebp - 0x18], 0xe497e484
add dword [ebp - 0x18], 0x7ed787e8
mov dword [ebp - 0x14], 0xd113a635
add dword [ebp - 0x14], 0x2eec59cb
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5f80d021
add eax, 0xa0bf600b
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39e9e
push 0
call eax
mov ecx, 0xa0621e5
sub ecx, 0xa05cc2a
xor edx, edx
add edx, eax
mov edi, 0x407000
add edi, dword [ebp - 0x10]
mov esi, 0xcbfb2c8d
xor dword [ebp - 8], edi
mov ebx, dword [edi]
xor ebx, esi
mov dword [ebp - 0xc], 0xf1aedb59
mov dword [edx], ebx
add dword [ebp - 0xc], 0x34708c81
add edx, 4
add edi, 0x817b457f
add edi, 0x7e84ba85
loop 0x401d79
add eax, 0x65ece840
add eax, 0x9a14617f
mov ebx, eax
add eax, 0x372dccd7
add eax, 0xc8d2332e
mov ecx, 0x46b7f2a0
add ecx, 0xb9880d60
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x403e59
pop dword [ebp - 8]
mov eax, 0x403e59
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xb7bb916c
add dword [ebp - 0x18], 0x9696b3df
mov dword [ebp - 0x14], 0x37eb10ca
sub dword [ebp - 0x14], 0x5b7c485
mov dword [ebp - 0x10], 0x826a3ba1
sub dword [ebp - 0x10], 0x361df773
mov dword [ebp - 0xc], 0x57328919
add dword [ebp - 0xc], 0xa8cd76e7
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe75034c2
sub eax, 0xe70fb436
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xe2d18f08
add dword [ebp - 0x18], 0x91a0da4e
mov dword [ebp - 0x14], 0xff07b539
sub dword [ebp - 0x14], 0xbd9b53c4
mov dword [ebp - 0x10], 0xe95cfb33
sub dword [ebp - 0x10], 0x85ed8ec7
mov dword [ebp - 0xc], 0x8b1bba6a
add dword [ebp - 0xc], 0x74e44596
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x8a4821dd
add eax, 0x75f85ef7
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39989
push 0
call eax
mov ecx, 0x8a44c6e4
sub ecx, 0x8a44737f
xor edi, edi
add edi, eax
mov ebx, 0x47faba77
add ebx, 0xb8465589
add ebx, dword [ebp - 8]
mov esi, 0xf907ea9
add dword [ebp - 4], 0x3a88dceb
mov edx, dword [ebx]
add dword [ebp - 4], 0x8101261d
xor edx, esi
xor dword [ebp - 4], ecx
mov dword [edi], edx
add dword [ebp - 4], 0x7b579a14
add edi, 4
add ebx, 4
loop 0x403f72
add eax, 0x14067
mov ebx, eax
add eax, 0x2f3c9a70
sub eax, 0x2f3c9a6b
mov ecx, 0xeccba090
add ecx, 0x13745f70
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405a12
pop dword [ebp - 0x4c]
mov eax, 0x9ec9196e
sub eax, 0x9e88bf5c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x87e5d942
add dword [ebp - 0x5c], 0xc66c6c09
mov dword [ebp - 0x58], 0x7ec8e85c
add dword [ebp - 0x58], 0xb36a63e9
mov dword [ebp - 0x54], 0xe2e40016
sub dword [ebp - 0x54], 0x9697bbe8
mov dword [ebp - 0x50], 0x3668f8e7
sub dword [ebp - 0x50], 0x3668f8e7
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x7c163e7d
add eax, 0x842a4287
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x6d32b5c9
add dword [ebp - 0x5c], 0x73fb38d
mov dword [ebp - 0x58], 0x36844782
sub dword [ebp - 0x58], 0xf517e60d
mov dword [ebp - 0x54], 0x3be731d7
add dword [ebp - 0x54], 0x27883a95
mov dword [ebp - 0x50], 0x612e7d55
sub dword [ebp - 0x50], 0x612e7d55
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x7f3dcb74
sub eax, 0x7efd4a74
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b018
push 0
call eax
mov ecx, 0x8fffd76c
add ecx, 0x700080ae
xor esi, esi
add esi, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x4c]
mov edx, 0x3bdccba9
add edx, 0x48516763
xor dword [ebp - 0x40], 0xae549665
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0xd477f88f
xor ebx, edx
xor dword [ebp - 0x14], edx
mov dword [esi], ebx
add dword [ebp - 0x14], edx
add esi, 0xcf268f5a
sub esi, 0xcf268f56
add edi, 0xa3e3cc1a
add edi, 0x5c1c33ea
loop 0x405b30
add eax, 0x6d8615e7
add eax, 0x927b3d54
xor ebx, ebx
add ebx, eax
add eax, 0x714704d2
sub eax, 0x714704cd
mov ecx, 0x7219217f
sub ecx, 0x71d9217f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000900e
pop dword [ebp - 0x28]
mov eax, 0xd1dea5f3
add eax, 0x3e21ea1b
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x42cd9994
add dword [ebp - 0x38], 0xb84abb7
mov dword [ebp - 0x34], 0x979af2e8
add dword [ebp - 0x34], 0x9a98595d
mov dword [ebp - 0x30], 0xc541f62e
add dword [ebp - 0x30], 0x870a4e00
mov dword [ebp - 0x2c], 0x78094916
add dword [ebp - 0x2c], 0x87f6b6ea
lea eax, [ebp - 0x38]
push eax
mov eax, 0x50ebe5d5
sub eax, 0x40eb45d1
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x7de8fd83
add dword [ebp - 0x38], 0xf6896bd3
mov dword [ebp - 0x34], 0xf8b2e1a3
sub dword [ebp - 0x34], 0xb746802e
mov dword [ebp - 0x30], 0x8c6f6110
sub dword [ebp - 0x30], 0x28fff4a4
mov dword [ebp - 0x2c], 0x7db4fd4f
sub dword [ebp - 0x2c], 0x7db4fd4f
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x2703b8de
sub eax, 0x170318d6
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x397fe
push 0
call eax
mov ecx, 0x4efb77e7
sub ecx, 0x4efb240c
mov esi, eax
mov edx, 0x5e947a82
sub edx, 0x4e938282
add edx, dword [ebp - 0x28]
mov edi, 0x69aa2f32
add edi, 0x4969eefe
xor dword [ebp - 0x14], 0x7fb3c77b
mov ebx, dword [edx]
add ebx, edi
add dword [ebp - 0x1c], 0x6a0a87d5
mov dword [esi], ebx
sub dword [ebp - 0x14], 0x87c2dcf8
add esi, 0x73214b97
sub esi, 0x73214b93
add edx, 0x8e5803fc
add edx, 0x71a7fc08
loop 0x10009130
add eax, 0x1423f
mov ebx, eax
add eax, 0xe9e4156
add eax, 0xf161beaf
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret