joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ce1dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp edi, ebx
je 0x1ce1e2d
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.01ce1570
test al, al
jne 0x1ce1e0f
add edi, 0x58
cmp edi, ebx
jne 0x1ce1dfa
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x1ce1e30
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x1ce1e44
cmp byte [edi + 0x1b], 0
jns 0x1ce1e52
mov eax, dword [edi + 0x10]
jmp 0x1ce1e55
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x1ce1e30
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1ce1e30
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x1ce1e30
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x1ce1e30
Function at 0x1ce2810
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x1d42db8], 0
je 0x1ce2848
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1d42da4]
test esi, esi
je 0x1ce28e2
test byte [0x1d32eac], 1
je 0x1ce2831
cmp byte [esi + 0xb], 0
jns 0x1ce2867
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x1d0b3f0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1d42db8], eax
inc eax
cmp eax, 1
ja 0x1ce2831
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.01c9afc0
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1ce2982
xor ebx, ebx
jmp 0x1ce2831
push 0xc
call fcn.01c97121
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.01c9afc0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.01cc3870
movzx eax, byte [esi + 0xb]
mov ecx, esi
test al, al
jns 0x1ce2937
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
jne 0x1ce2954
mov ecx, esi
push 9
push str.debug.log
call fcn.01c3dad0
mov dword [0x1d42da4], esi
jmp 0x1ce2856
lea edi, [eax + eax]
test edi, edi
je 0x1ce293b
lea edx, [edi - 2]
cmp word [ecx + edi - 2], 0x5c
mov edi, edx
jne 0x1ce2957
cmp edx, 0xfffffffe
je 0x1ce293b
sar edx, 1
inc edx
cmp eax, edx
jb 0x1ce2a22
mov ecx, esi
push edx
call fcn.01cd98e0
jmp 0x1ce293b
mov esi, dword [0x1d42da4]
push edi
call fcn.01cb0da4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.01c3d7c0
mov ecx, dword [0x1d42da4]
call fcn.01c3be40
cmp word [eax], 0x5c
je 0x1ce29bd
mov ecx, dword [0x1d42da4]
push 1
push 0x1d06ed6
call fcn.01c3dad0
mov ecx, dword [0x1d42da4]
push 9
push str.debug.log
call fcn.01c3dad0
mov eax, dword [0x1d42da4]
cmp byte [eax + 0xb], 0
jns 0x1ce29dc
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x1d0b3f0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1d42db8], eax
inc eax
cmp eax, 1
ja 0x1ce2831
mov dword [0x1d42db8], 0
jmp 0x1ce28db
call fcn.01cab250
int3
Function at 0x1cee100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1cee123
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cee148
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x1cee140
mov eax, ebx
and eax, 0x400
jne 0x1cee156
and ebx, 0x10
shr ebx, 4
jmp 0x1cee158
push 2
call fcn.01c821e0
add esp, 4
test al, al
jne 0x1cee16f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01ce2be0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01ce2d10
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cc4230
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1cee1b1
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.01c75e80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1cee1d6
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.01cc4230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1cee1f8
push dword [ebp - 0xc4]
call fcn.01c97151
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01ce2d70
jmp 0x1cee156

Function at 0x1cee210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1cee233
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cee25e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c821e0
add esp, 4
test al, al
jne 0x1cee270
xor ebx, ebx
jmp 0x1cee247
call fcn.01ce2be0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01ce2d10
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cc4230
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1cee2af
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.01c75e80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1cee2d4
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.01cc4230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1cee2f6
push dword [ebp - 0xc4]
call fcn.01c97151
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01ce2d70
jmp 0x1cee26c
Function at 0x1cee310
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1cee333
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1cee34b
and eax, 0x410
cmp eax, 0x410
je 0x1cee38b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1cee355
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x1cee379
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c821e0
add esp, 4
test al, al
jne 0x1cee3a6
xor ebx, ebx
jmp 0x1cee362
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01cee440
call fcn.01ce2be0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01ce2d10
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.01cc4230
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1cee3e8
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c75e80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1cee40d
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.01cc4230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1cee42f
push dword [ebp - 0xc4]
call fcn.01c97151
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01ce2d70
jmp 0x1cee387

Function at 0x1cee440
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1cee462
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1cee47d
push 2
call fcn.01c821e0
add esp, 4
test al, al
jne 0x1cee499
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01ce2be0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.01ce2d10
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01cc4230
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x1cee4dc
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.01c75e80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1cee501
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push dword [ebp - 0xc8]
call fcn.01cc4230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1cee528
push dword [ebp - 0xc4]
call fcn.01c97151
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01ce2d70
jmp 0x1cee47d
Function at 0x1cf42b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x1d17014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x1cf430a
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x1cf4304
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x1cf42d4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c97fe3
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1cf55d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cee310
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10090b30
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x10090b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10090b3f
pop dword [ebp - 0x44]
mov eax, 0x5f4aaf93
sub eax, 0x4f41a454
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x815e8835
sub dword [ebp - 0x54], 0x330c42ea
mov dword [ebp - 0x50], 0x8c383543
sub dword [ebp - 0x50], 0x5a04e8fe
mov dword [ebp - 0x4c], 0xf69b58ec
sub dword [ebp - 0x4c], 0xaa4f14be
mov dword [ebp - 0x48], 0x6b881afe
add dword [ebp - 0x48], 0x9477e502
lea eax, [ebp - 0x54]
push eax
mov eax, 0x248ac5c
add eax, 0xdc2c484
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb31aef54
add dword [ebp - 0x54], 0xc1577a02
mov dword [ebp - 0x50], 0xe1b0fab4
sub dword [ebp - 0x50], 0xa044993f
mov dword [ebp - 0x4c], 0x7471cb65
sub dword [ebp - 0x4c], 0x11025ef9
mov dword [ebp - 0x48], 0x5395c985
sub dword [ebp - 0x48], 0x5395c985
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x5c4d1
push 0
call eax
mov ecx, 0xebd0e047
add ecx, 0x142f61ca
xor ebx, ebx
add ebx, eax
mov esi, 0x100f3400
add esi, dword [ebp - 0x44]
mov edi, 0x1bce6902
sub edi, 0x6de7e3e5
xor dword [ebp - 0x10], 0x70b81889
mov edx, dword [esi]
xor dword [ebp - 0x18], edx
add edx, edi
sub dword [ebp - 0x24], edx
mov dword [ebx], edx
xor dword [ebp - 0x3c], 0x2503e5a7
add ebx, 4
add esi, 4
loop 0x10090c58
add eax, 0xfb17
xor ebx, ebx
add ebx, eax
add eax, 0x30e31761
sub eax, 0x30e3175c
mov ecx, 0x1da4301
sub ecx, 0xf1da4301
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402ee4
pop dword [ebp - 0x50]
mov eax, 0x402ee4
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x5baa1ffe
sub dword [ebp - 0x60], 0xd57dab3
mov dword [ebp - 0x5c], 0xb597e925
add dword [ebp - 0x5c], 0x7c9b6320
mov dword [ebp - 0x58], 0xd55ad44b
sub dword [ebp - 0x58], 0x890e901d
mov dword [ebp - 0x54], 0x487f32cb
sub dword [ebp - 0x54], 0x487f32cb
lea eax, [ebp - 0x60]
push eax
mov eax, 0xeb2bfb6f
sub eax, 0xeaeb7a6b
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x90487fe9
sub dword [ebp - 0x60], 0x1bd61693
mov dword [ebp - 0x5c], 0xc6ce9f1b
sub dword [ebp - 0x5c], 0x85623da6
mov dword [ebp - 0x58], 0xbe397ef3
add dword [ebp - 0x58], 0xa535ed79
mov dword [ebp - 0x54], 0xbae9e612
sub dword [ebp - 0x54], 0xbae9e612
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x8d211789
sub eax, 0x8ce09689
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x36737
push 0
call eax
mov ecx, 0x1a18090c
add ecx, 0xe5e83c9d
mov edi, eax
mov ebx, 0x4e0c6dc4
add ebx, 0xb23a763c
add ebx, dword [ebp - 0x50]
mov edx, 0x85211f18
sub dword [ebp - 0x34], eax
mov esi, dword [ebx]
sub dword [ebp - 0x4c], 0xa4edc0ed
add esi, edx
xor dword [ebp - 0x30], 0x6433e91e
mov dword [edi], esi
sub dword [ebp - 0x28], 0xc7e8735c
add edi, 4
add ebx, 0x3c0ed53c
sub ebx, 0x3c0ed538
loop 0x402ffb
add eax, 0x10977
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401bd7
pop dword [ebp - 0x14]
mov eax, 0x709d8f0b
add eax, 0x8fa28ccc
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x67c08810
add dword [ebp - 0x24], 0xe691bd3b
mov dword [ebp - 0x20], 0x4964256b
sub dword [ebp - 0x20], 0x1730d926
mov dword [ebp - 0x1c], 0xd673d73f
add dword [ebp - 0x1c], 0x75d86cef
mov dword [ebp - 0x18], 0xf19d08d0
add dword [ebp - 0x18], 0xe62f730
lea eax, [ebp - 0x24]
push eax
mov eax, 0x40f69e7c
add eax, 0xbf49d1e4
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x3842a730
sub dword [ebp - 0x24], 0xc3d03dda
mov dword [ebp - 0x20], 0x5f59c5b8
sub dword [ebp - 0x20], 0x1ded6443
mov dword [ebp - 0x1c], 0xde48e870
add dword [ebp - 0x1c], 0x852683fc
mov dword [ebp - 0x18], 0x9ad7462d
add dword [ebp - 0x18], 0x6528b9d3
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x346af
push 0
call eax
mov ecx, 0xc5aed68f
add ecx, 0x3a5168d0
mov esi, eax
mov edx, 0xfcfe3cbe
sub edx, 0xfcbd3cbe
add edx, dword [ebp - 0x14]
mov ebx, 0x970f35ed
xor dword [ebp - 4], ecx
mov edi, dword [edx]
sub dword [ebp - 4], edi
xor edi, ebx
mov dword [ebp - 8], 0x50e55ef1
mov dword [esi], edi
add esi, 0xbc6223d4
sub esi, 0xbc6223d0
add edx, 0xc2cfc39
sub edx, 0xc2cfc35
loop 0x401cee
add eax, 0xf04f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x12cfd8bb
sub ecx, 0x128fd8bb
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.00401bc8
jmp 0x406676

Function at 0x438c90
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
add edi, edi
and edi, edi
call fcn.00438cc5
mov edi, esi
dec edi
sub edi, edi
xor dword [ecx], ebx
or edi, esi
add ecx, 1
inc edi
mov esi, edi
or edi, esi
cmp ecx, eax
jne fcn.00438c90
or esi, esi
add esi, 0x7a9a915c
sub edi, edi
ret