joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004825
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
jle 0x10004875
push esi
inc cl
movzx ecx, cl
mov edx, dword [eax + ecx*4 + 8]
mov dword [ebp + 8], ecx
lea esi, [eax + ecx*4 + 8]
mov cl, dl
add cl, bl
movzx ebx, cl
mov ecx, dword [eax + ebx*4 + 8]
mov dword [esi], ecx
mov esi, dword [ebp + 0xc]
add cl, dl
mov dword [eax + ebx*4 + 8], edx
movzx ecx, cl
add esi, edi
mov cl, byte [eax + ecx*4 + 8]
xor byte [esi], cl
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x1000483a
pop esi
mov dword [eax + 4], ebx
pop edi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
Function at 0x10004fa9
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x104
push edi
push esi
push 0x10090664
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push 0x10090560
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1009045c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, 0x10090768
push esi
push ebx
push 0
call edi
mov eax, dword [0x10090a74]
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
test eax, eax
je 0x10005004
push esi
mov esi, 0x10090970
push esi
push eax
call edi
push esi
call ebp
pop ecx
push ebx
call ebp
push ebx
call fcn.10005020
push eax
push 0x1009086c
call sub.MSVCRT.dll_strcpy
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10005192
Capabilities:
Set file attributes

Disassembly:
push 6
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x10005224
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret

Function at 0x10005cf5
Capabilities:
Accept command line arguments
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, str.ServerMain
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x10005d3d
add esi, 0xb
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x10005d3d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10005d24
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10005d47
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
leave
ret 8
Function at 0x10005db9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 0x10], 0
push edi
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
pop edi
jne 0x10005e08
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
jne 0x10005e00
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x1000907c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret 8
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10024887
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x10024887
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10024896
pop dword [ebp - 0x14]
mov eax, 0x10024896
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4275a
push 0
mov eax, 0xdaa2af25
sub eax, 0xca9fadc9
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x545fd235
sub ecx, 0x545f815f
mov ebx, eax
mov esi, 0x2edc25db
add esi, 0xe1289625
add esi, dword [ebp - 0x14]
mov edx, 0xda696ba8
mov dword [ebp - 4], 0xd54e26c8
mov edi, dword [esi]
xor dword [ebp - 4], 0xa8a37719
xor edi, edx
xor dword [ebp - 0xc], 0x16716cc6
mov dword [ebx], edi
xor dword [ebp - 0x10], edi
add ebx, 0xce2354db
sub ebx, 0xce2354d7
add esi, 4
loop 0x100248ea
add eax, 0x1362b
mov ebx, eax
add eax, 0xc86c655f
sub eax, 0xc86c655a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001539c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001539c
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001539c
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001539c
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10
Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001539c
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x53de00]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x38
mov byte [ebp - 0xa], 0x76
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x77
mov byte [ebp - 5], 0x31
lea ecx, [ebp - 0x10]
push ecx
call fcn.004c48c0
add esp, 4
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
call fcn.004bfad9
add esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 0
jmp 0x40107f
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xc
jae 0x40109b
mov edx, 0xc
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x28]
mov cl, byte [ebp + edx - 0x10]
mov byte [eax], cl
jmp 0x401076
mov dword [ebp - 0x2c], 0x80000002
jmp 0x4010ad
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x80000005
jae 0x40114d
push 0
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.004be410
push 4
lea ecx, [ebp - 0x20]
call fcn.004be8e0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004c1e20
add esp, 0xc
mov edx, dword [ebp - 0x24]
add edx, 4
mov dword [ebp - 0x24], edx
push 4
lea ecx, [ebp - 0x20]
call fcn.004be900
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.004c1e20
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 4
mov dword [ebp - 0x24], ecx
push 4
lea ecx, [ebp - 0x20]
call fcn.004be920
push eax
mov edx, dword [ebp - 0x24]
push edx
call fcn.004c1e20
add esp, 0xc
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
push 4
lea ecx, [ebp - 0x20]
call fcn.004be940
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004c1e20
add esp, 0xc
mov edx, dword [ebp - 0x24]
add edx, 4
mov dword [ebp - 0x24], edx
jmp 0x4010a4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bfae2
mov esp, ebp
pop ebp
ret
Function at 0x4c0649
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4c0688
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4c0688
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4c0688
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4c0688
cmp dword [ecx + 0x74], 0xe
jbe 0x4c0688
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4c873e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4c87db
push ebx
push esi
call fcn.004c8707
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004c869b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4c8788
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4c87da
push edi
push eax
call fcn.004c6f40
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4c87a8
call fcn.004c727e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4c87d9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004c869b
add esp, 0x20
test eax, eax
jne 0x4c87c7
push edi
call fcn.004c727e
jmp 0x4c87cf
push ebx
call fcn.004c727e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4c99ea
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d1590
push 0x4d1588
push str.FlsAlloc
push 0x1f
call fcn.004c98a9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c9a1e
push dword [ebp + 8]
mov ecx, esi
call dword [0x4cf150]
call esi
jmp 0x4c9a24
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4c9a68
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d15a0
push 0x4d1598
push str.FlsGetValue
push 0x21
call fcn.004c98a9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c9a9f
push dword [ebp + 8]
mov ecx, esi
call dword [0x4cf150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4c9aa7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d15a8
push 0x4d15a0
push str.FlsSetValue
push 0x22
call fcn.004c98a9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c9ae1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4cf150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4ce3c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4ce3ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ce3ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630
Function at 0x41deda
Capabilities:
Encode data using xor

Disassembly:
push 3
xchg edx, edx
lea esi, [esi + 0x14]
push esi
add dword [ebp - 0x2e9], ebp
call dword [0xfffffc04]
sub dword [ebp - 0x2e9], ebp
ret
push 0xcd8d2589
add edi, eax
xchg edx, edx
call fcn.0041dcd7
mov dword [ebp - 0x3fc], esi
lea esi, [edx - 0x611f1ee9]
not ch
dec edx
push 0x15274fa6
call fcn.0041dcd7
lea eax, [esp + 0x28]
lea ecx, [ebp - 0x78194b4e]
sbb edi, 0xffffffca
xchg ecx, ecx
mov dword [esp + 0x4c], esi
xchg esi, eax
mov edi, 0x42478ee7
inc ecx
push 0x3c
mov edi, dword [esp + 0x4c]
push esp
inc dword [esp]
xor ch, 0x96
not eax
push dword [esp]
mov dword [esp + 4], 1
mov ecx, edi
sub ch, dl
push dword [esp]
and dh, dl
call edi
lea ecx, [edi - 0x2cdc5159]
dec byte [esp]
jne 0x41df21
sub dl, ch
mov cl, 0xcc
pop eax
push 1
call fcn.0041dea9
add dh, dh
and ecx, ecx
pop dword [esi + 0x1c]
mov dh, 0x1a
xchg edx, edx
cmp eax, esi
mov dword [esi + 0x14], 0xc
xchg ch, dl
not edx
lea eax, [ebp - 0x295]
xchg dl, ch
dec edx
push eax
mov dword [esi + 0x18], esi
sub byte [esi + 2], 0xfc
push 4
jmp 0x41dd27
Function at 0x4051f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4275f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42bc38]
push ebx
push esi
push edi
test eax, eax
js 0x4052ef
cmp eax, 2
jge 0x4052ef
mov esi, eax
imul esi, esi, 0x214
push ecx
add esi, 0x42b810
inc eax
lea edi, [esi + 1]
push 0x100
mov dword [0x42bc38], eax
push edi
mov byte [esi], 1
call fcn.0040b5b1
add esp, 0xc
cmp byte [esi], 0
je 0x4052ef
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push edi
lea ebx, [esi + 0x110]
push str.._s_04d__02d__02d.txt
push ebx
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x4052cd
mov byte [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aeaf
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4052ef
mov ecx, dword [esi + 0x210]
push ecx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aeaf
mov esp, ebp
pop ebp
ret
Function at 0x405300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x4275f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
js 0x4054e8
cmp esi, dword [eax + 0x428]
jge 0x4054e8
imul esi, esi, 0x214
add esi, eax
cmp byte [esi], 0
je 0x4054e8
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x405384
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x405384
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x40543b
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 1]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.txt
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x405408
mov byte [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aeaf
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40543b
mov eax, dword [esi + 0x210]
push eax
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aeaf
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call fcn.0040c790
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call fcn.0040b751
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call fcn.0040c790
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4054c1
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aeaf
mov esp, ebp
pop ebp
ret