joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403640
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov ebx, 0x41350c
mov eax, 0x418090
call fcn.0040e298
call sub.KERNEL32.DLL_GetCommandLineA
mov esi, eax
test esi, esi
je 0x403677
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x403677
lea eax, [esi + 1]
mov edx, 0x22
call fcn.0040da88
mov esi, eax
test esi, esi
je 0x4036e3
mov edx, 0x4120f6
mov eax, esi
call fcn.0040dacc
mov esi, eax
test eax, eax
je 0x403696
mov eax, ebx
mov edx, esi
call fcn.0040daf8
xor ecx, ecx
xor eax, eax
jmp 0x4036d5
and edx, 0xff
cmp edx, 0x20
je 0x4036a9
mov cl, 1
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
je 0x4036b8
cmp edx, 0x2f
jne 0x4036d4
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x4036c8
cmp edx, 0x53
jne 0x4036d4
mov dword [0x412058], 1
jmp 0x4036dc
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x40369c
test cl, cl
jne 0x4036e3
mov byte [ebx], 0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x64
mov dword [0x418078], ebx
mov dword [0x418074], ebx
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x41390c], eax
push 0x65
push dword [0x418074]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x413910], eax
mov eax, esp
call fcn.00405104
push 0x400
push 0x41310c
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x41310c
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
mov edx, 0x41310c
mov eax, 0x41807c
call fcn.004048ec
lea eax, [esp + 8]
call fcn.00403f0c
lea eax, [esp + 0x20]
call fcn.00403f0c
lea edx, [esp + 8]
lea ecx, [esp + 0x20]
push 0
push 0x40100c
mov dword [0x413d14], edx
push 0
mov dword [0x413d18], ecx
push str.STARTDLG
push dword [0x418078]
call sub.USER32.DLL_DialogBoxParamA
lea eax, [esp + 0x20]
mov edx, 2
call fcn.00403f30
lea eax, [esp + 8]
mov edx, 2
call fcn.00403f30
mov eax, esp
mov edx, 2
call fcn.00405178
xor ecx, ecx
mov dword [0x413d18], ecx
mov dword [0x413d14], ecx
cmp dword [0x412864], 0
jne 0x4037e6
cmp dword [0x412870], 0
jne 0x4037e6
mov ecx, 4
mov edx, dword [0x412048]
xor eax, eax
call fcn.0040178a
jmp 0x42b58e
Function at 0x405eb4
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0040505c
test eax, eax
je 0x405eda
test ebx, ebx
je 0x405eda
cmp word [ebx], 0
je 0x405eda
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x405ee2
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x405ef5
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.004060d8
xor eax, eax
jmp 0x405f10
call sub.KERNEL32.DLL_GetLastError
jmp 0x4275f0
pop edi
pop esi
pop ebx
ret

Function at 0x406078
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040505c
test eax, eax
je 0x4060a3
test ebx, ebx
je 0x4060a3
cmp word [ebx], 0
je 0x4060a3
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x4060d8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040505c
test eax, eax
je 0x406105
test ebx, ebx
je 0x406105
cmp word [ebx], 0
je 0x406105
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x406114
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x40796c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x414124
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne fcn.00407986
jmp loc.00425390
Function at 0x4080b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ecx, 0x20
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 4
call fcn.0040da0c
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x40811b
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x4080e6
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x408113
cmp ecx, 4
jl 0x4080e4
cmp ecx, 4
jne 0x40811b
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x408126
cmp esi, 0xa
jle 0x408108
cmp esi, 0xa
jg 0x4082c6
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x4147c8]
lea edx, [esp + 0xc]
xor byte [edx], al
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov al, byte [edx + 0x4147c8]
lea edx, [esp + 0xc]
xor byte [edx + 1], al
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x4147c8]
lea edx, [esp + 0xc]
xor byte [edx + 2], al
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov al, byte [edx + 0x4147c8]
lea edx, [esp + 0xc]
xor byte [edx + 3], al
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x4149c8]
lea eax, [esp + 0xc]
xor byte [eax], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x4081d6
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x408274
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x4081b6
inc edx
cmp edx, dword [esp + 8]
jl 0x4081b4
jmp 0x408274
mov edx, 1
jmp 0x4081f4
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x4081df
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x4081ff
adc eax, 0
cmp edx, eax
jl 0x4081dd
jmp 0x428bd0
xor edx, edx
jmp 0x4082b2
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x40827c
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x4082aa
cmp ecx, 4
jl 0x40827a
cmp ecx, 4
jne 0x4082b2
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x4082bd
cmp esi, 0xa
jle 0x40829f
cmp esi, 0xa
jle 0x40812f
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4082d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x416de6]
lea ebx, [ebx*4 + 0x4169e6]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x4171e6]
lea edx, [edx*4 + 0x4175e6]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x4082e2
jmp loc.004287e8
Function at 0x409588
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
jmp loc.004240d0
Function at 0x40b2b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
mov esi, dword [ebp - 8]
mov ebx, ecx
xor edx, edx
inc ecx
mov bl, byte [esi + ebx]
mov byte [ebp - 9], bl
jmp 0x40b3e0
cmp dword [eax + 8], 0
jne 0x40b2f3
jmp 0x4224b0
xor ebx, ebx
mov bl, byte [eax + 4]
sar ebx, 6
sub ebx, 1
jb 0x40b30d
je 0x40b322
dec ebx
je 0x40b341
dec ebx
je 0x40b363
jmp 0x40b3d8
mov ebx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
movzx ebx, byte [ebx + ecx]
mov word [esi + edx*2], bx
inc ecx
inc edx
jmp 0x40b3d8
mov ebx, dword [ebp - 8]
movzx esi, byte [ebp - 9]
movzx ebx, byte [ebx + ecx]
shl esi, 8
inc ecx
add bx, si
mov esi, dword [ebp + 0xc]
mov word [esi + edx*2], bx
inc edx
jmp 0x40b3d8
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 8]
movzx esi, byte [esi + ecx + 1]
movzx ebx, byte [ebx + ecx]
shl esi, 8
add bx, si
mov esi, dword [ebp + 0xc]
mov word [esi + edx*2], bx
inc edx
add ecx, 2
jmp 0x40b3d8
mov ebx, ecx
mov esi, dword [ebp - 8]
inc ecx
movzx esi, byte [esi + ebx]
test esi, 0x80
je 0x40b3ba
mov edi, dword [ebp - 8]
mov ebx, ecx
inc ecx
and esi, 0x7f
mov bl, byte [edi + ebx]
add esi, 2
mov byte [ebp - 0xa], bl
jmp 0x40b3af
mov ebx, dword [ebp - 4]
dec esi
movzx edi, byte [ebp - 0xa]
movzx ebx, byte [ebx + edx]
add bx, di
movzx edi, byte [ebp - 9]
and bx, 0xff
shl edi, 8
add bx, di
mov edi, dword [ebp + 0xc]
mov word [edi + edx*2], bx
inc edx
test esi, esi
jle 0x40b3d8
cmp edx, dword [ebp + 8]
jl 0x40b389
jmp 0x40b3d8
add esi, 2
jmp 0x40b3cf
mov ebx, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
dec esi
movzx ebx, byte [ebx + edx]
mov word [edi + edx*2], bx
inc edx
test esi, esi
jle 0x40b3d8
cmp edx, dword [ebp + 8]
jl 0x40b3bf
shl byte [eax + 4], 2
sub dword [eax + 8], 2
cmp ecx, dword [ebp + 0x10]
jge 0x40b3ee
cmp edx, dword [ebp + 8]
jl 0x40b2dc
cmp edx, dword [ebp + 8]
jl 0x40b3f7
mov edx, dword [ebp + 8]
dec edx
mov eax, dword [ebp + 0xc]
mov word [eax + edx*2], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push esi
push edi
xor eax, eax
mov dword [ebp - 4], edx
mov dword [ebx + 0xc18], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov esi, 0x80000000
je 0x40c989
or esi, 0x40000000
mov dword [ebp - 8], 1
cmp byte [ebx + 0x12], 0
jne 0x40c99c
cmp byte [ebp + 0xc], 0
je 0x40c9a0
or dword [ebp - 8], 2
call fcn.0040505c
test eax, eax
je 0x40c9cc
test edi, edi
je 0x40c9cc
cmp word [edi], 0
je 0x40c9cc
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push edi
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x40c9e5
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c9fe
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40c9fe
mov dword [ebx + 0xc18], 1
xor eax, eax
cmp esi, 0xffffffff
mov byte [ebx + 0x13], 0
setne dl
mov dword [ebx + 0xc], eax
and edx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x40ca3c
mov dword [ebx + 4], esi
test edi, edi
je 0x40ca31
lea eax, [ebx + 0x416]
mov edx, edi
call fcn.0040e1a0
lea eax, [ebx + 0x15]
mov edx, dword [ebp - 4]
call fcn.0040daf8
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40cba8
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x40cbb7
cmp byte [ebx + 0x14], 0
jne 0x40cbbb
xor eax, eax
pop ebx
ret
cmp dword [ebx + 4], 0xffffffff
je 0x40cbc8
mov eax, ebx
call fcn.0040cb3c
jmp 0x425b60

Function at 0x40cc04
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
jmp loc.00423e78

Function at 0x40cdbc
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40cde3
cmp esi, 0x4e20
jle 0x40cdd9
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40ce34
mov eax, ebx
call fcn.0040cfec
test al, al
je 0x40ce1b
cmp esi, 0x4e20
jle 0x40ce1b
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040cdbc
jmp 0x40ce37
cmp dword [ebx + 0xc], 1
jne 0x40ce2f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40ce2f
xor eax, eax
jmp 0x40ce37
or eax, 0xffffffff
jmp 0x40ce37
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x4126e4], 0
jne 0x40e0b9
call fcn.0040dc94
jmp loc.004261a0
call fcn.0040dc94
sub eax, dword [0x4126e0]
cmp eax, 0x64
jle 0x40e0f5
cmp dword [0x412864], 0
je 0x40e0f0
mov eax, 0x418068
mov edx, 0xff
call fcn.0040b604
mov eax, 0x418068
mov edx, 0xff
call fcn.0040b5fc
call fcn.004027d8
ret
Function at 0x402b95
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x402ba9
mov dword [esi + 0x10], 8
xor al, al
pop esi
ret
and dword [esi + 0x10], 0
mov eax, dword [esi + 8]
push edi
test eax, eax
je 0x402c05
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402bfc
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x402bf3
movzx eax, word [edi + 4]
mov ecx, 0x14c
cmp ax, cx
je 0x402be4
mov ecx, 0x8664
cmp ax, cx
jne 0x402bf3
push dword [edi + 0x58]
mov ecx, esi
call main
mov dword [edi + 0x58], eax
jmp 0x402c0c
mov dword [esi + 0x10], 7
jmp 0x402c0c
mov dword [esi + 0x10], 6
jmp 0x402c0c
mov dword [esi + 0x10], 1
xor eax, eax
cmp dword [esi + 0x10], eax
pop edi
sete al
pop esi
ret

Function at 0x402d01
Capabilities:
Parse pe header

Disassembly:
and dword [ecx + 0x10], 0
mov edx, dword [ecx + 8]
push esi
test edx, edx
je 0x402d57
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x402d4e
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x402d45
movzx edx, word [eax + 4]
mov esi, 0x14c
cmp dx, si
jne 0x402d3b
and dword [ecx + 0x10], 0
mov eax, dword [eax + 0x58]
pop esi
ret
mov esi, 0x8664
cmp dx, si
je 0x402d32
mov dword [ecx + 0x10], 7
jmp 0x402d5e
mov dword [ecx + 0x10], 6
jmp 0x402d5e
mov dword [ecx + 0x10], 1
xor eax, eax
pop esi
ret

Function at 0x40547c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40548b
pop dword [ebp - 0x34]
mov eax, 0x3bd37eb5
add eax, 0xc46cd5d6
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa9f6df7a
add dword [ebp - 0x44], 0xa45b65d1
mov dword [ebp - 0x40], 0xbb9affc5
add dword [ebp - 0x40], 0x76984c80
mov dword [ebp - 0x3c], 0x373c964c
sub dword [ebp - 0x3c], 0xeaf0521e
mov dword [ebp - 0x38], 0xad51be15
add dword [ebp - 0x38], 0x52ae41eb
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa4162d6d
sub eax, 0xa3d38d19
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x8d11ac53
add dword [ebp - 0x44], 0xe760bd03
mov dword [ebp - 0x40], 0x2c0739
add dword [ebp - 0x40], 0x41405a3c
mov dword [ebp - 0x3c], 0x3fb5c141
add dword [ebp - 0x3c], 0x23b9ab2b
mov dword [ebp - 0x38], 0x90470709
sub dword [ebp - 0x38], 0x90470709
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x8f984bd4
add eax, 0x70aa5484
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc68
push 0
call eax
mov ecx, 0x3fb4
xor ebx, ebx
add ebx, eax
mov esi, 0x54ac00
add esi, dword [ebp - 0x34]
mov edi, 0x9b04f796
add dword [ebp - 0x30], 0x70e7117d
mov edx, dword [esi]
xor dword [ebp - 4], 0x22fb8b09
sub edx, edi
mov dword [ebx], edx
sub dword [ebp - 0x24], 0x11f14132
add ebx, 0x1cce6bac
sub ebx, 0x1cce6ba8
add esi, 0x8036fe64
add esi, 0x7fc901a0
loop 0x40559d
add eax, 0x4caedfa5
sub eax, 0x4cadee02
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403203
pop dword [ebp - 0x24]
mov eax, 0x51c8ff97
sub eax, 0x5188cd94
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x647240d
sub dword [ebp - 0x34], 0xb7f4dec2
mov dword [ebp - 0x30], 0x8b4085e5
add dword [ebp - 0x30], 0xa6f2c660
mov dword [ebp - 0x2c], 0xc8788da0
add dword [ebp - 0x2c], 0x83d3b68e
mov dword [ebp - 0x28], 0x7db79114
add dword [ebp - 0x28], 0x82486eec
lea eax, [ebp - 0x34]
push eax
mov eax, 0xd5f874ae
sub eax, 0xd5b7f422
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x2065b51f
add dword [ebp - 0x34], 0x540cb437
mov dword [ebp - 0x30], 0x1c4c0d12
add dword [ebp - 0x30], 0x25205463
mov dword [ebp - 0x2c], 0x91a14571
add dword [ebp - 0x2c], 0xd1ce26fb
mov dword [ebp - 0x28], 0xd2bbef8c
sub dword [ebp - 0x28], 0xd2bbef8c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x8852fdc9
add eax, 0x77ed830b
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x37c41
push 0
call eax
mov ecx, 0x5dee597a
sub ecx, 0x5dee0cca
mov ebx, eax
mov edi, 0xf3baba38
add edi, 0xc8655c8
add edi, dword [ebp - 0x24]
mov edx, 0x9f28d6cf
sub edx, 0x56ff0e0e
xor dword [ebp - 4], 0x1a9674fe
mov esi, dword [edi]
add dword [ebp - 8], 0xf48af6b5
xor esi, edx
sub dword [ebp - 0x10], 0x968fff48
mov dword [ebx], esi
add ebx, 0xdf58018c
add ebx, 0x20a7fe78
add edi, 0xea278813
add edi, 0x15d877f1
loop 0x403325
add eax, 0x13f52f49
add eax, 0xec0bf64a
xor ebx, ebx
add ebx, eax
add eax, 0xed0e70dd
add eax, 0x12f18f28
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x61540847
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2c1d50c4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10002bf0
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x1012931c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0x100f55e0
mov dword [ebp - 0xa38], eax
call fcn.10003260
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100a25c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10002c9e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x10002c9e
xor ecx, ecx
lea esi, [edi + 1]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10067cda
push esi
mov esi, eax
mov dword [ebp - 0xa34], eax
push 0
push esi
call fcn.100a25c0
add esp, 0x10
push esi
push edi
call ebx
test eax, eax
jne 0x10002cb3
push esi
call fcn.1008144f
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x100f562c]
mov dword [ebp - 0xc], eax
mov ax, word [0x100f5630]
push 0x208
mov word [ebp - 8], ax
call fcn.10067cda
mov ebx, eax
add esp, 4
mov eax, esi
movzx eax, word [eax]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push ebx
push eax
call edi
test eax, eax
jne 0x10002d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10002dbc
push ebx
call fcn.1008144f
push 2
call fcn.10067cda
add esp, 8
mov ebx, eax
lea eax, [ebp - 0xc]
push 1
push ebx
push eax
call edi
test eax, eax
je 0x10002dbc
mov edi, ebx
lea ecx, [edi + 2]
nop word [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10002d30
sub edi, ecx
lea eax, [ebp - 0x218]
sar edi, 1
push edi
push ebx
push eax
call fcn.100ad25e
add esp, 0xc
test eax, eax
je 0x10002d6c
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x10002d54
movzx eax, word [esi]
test ax, ax
je 0x10002dbc
jmp 0x10002cd9
lea eax, [ebp - 0x218]
lea eax, [eax + edi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x100f5634
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.10003380
add esp, 0x14
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.10001e10
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0xa30]
call fcn.10001ee0
push dword [ebp - 0xa34]
call fcn.1008144f
push ebx
call fcn.1008144f
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.10081454
mov esp, ebp
pop ebp
ret 8
Function at 0x10006e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea997
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1012931c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [edi], vtable.plog::Record.0
mov dword [edi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x1c], eax
lea esi, [edi + 0x28]
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x24], eax
mov dword [ebp + 8], esi
mov dword [esi], 0x100f5c00
mov dword [esi + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push 0
push 0
lea ebx, [esi + 4]
mov dword [ebp - 4], 0
push ebx
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.10006a40
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 1
mov dword [ebp + 0x18], ebx
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + esi - 4], eax
mov dword [ebx], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10081411
mov esi, eax
add esp, 4
test esi, esi
je 0x10006eee
push 1
mov byte [ebp - 4], 2
call fcn.10068730
add esp, 4
mov dword [esi + 4], eax
jmp 0x10006ef0
xor esi, esi
mov dword [ebx + 0x34], esi
lea eax, [ebx + 4]
mov dword [ebx + 0xc], eax
lea ecx, [ebx + 8]
mov dword [ebx + 0x10], ecx
lea eax, [ebx + 0x14]
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [ebx], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 4
mov dword [edi + 0xc0], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0xc4], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0xc8], eax
xor eax, eax
mov dword [edi + 0xdc], 0
mov dword [edi + 0xe0], 0xf
mov byte [edi + 0xcc], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 7
mov word [edi + 0xe4], ax
lea eax, [edi + 8]
push eax
call fcn.100b649e
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18