joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002154a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 4], cl
test cl, cl
je 0x1002161a
mov dword [ebp - 8], 0x860b4ffb
xor ecx, ecx
mov dword [ebp - 0xc], 0xfffffff7
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xa1434a93
mov dword [ebp - 0x20], 0xfa025ec5
mov dword [ebp - 8], ecx
jmp 0x10021596
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10021588
mov dword [ebp - 8], ecx
jmp 0x100215ad
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x14], ecx
jne 0x100215b2
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x100215a1
cmp dword [ebp - 0xc], ecx
jne 0x100215ba
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xbc0d
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
neg edx
mov eax, dword [ebp - 0x10]
sbb edx, edx
inc edx
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, 0xd44c039e
setle dl
xor eax, eax
cmp edx, 2
setne al
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
je 0x10021605
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0xc], 0xd42a
mov dword [ebp - 8], eax
jmp 0x10021630
push 0x2292
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xcf2
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x100228e8
Capabilities:
Create process on windows

Disassembly:
test cl, cl
je 0x10022903
push 0x2292
xor eax, eax
push eax
push eax
push eax
push eax
push 0xcf2
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 0
push 0x198d
push 0x15ed
push 0x212f
call dword [sym.imp.GDI32.dll_MoveToEx]
ret
Function at 0x10023fe7
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x10061084
call fcn.1005fe44
sub esp, 0x1c
mov dword [ebp - 0x24], edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002406f
cmp byte [ebp + 0x20], 0
je 0x1002403b
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1002402a
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xedf21916
inc dword [edx]
cmp dword [edx], 1
jl 0x10024018
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
xor ebx, ebx
mov dword [edx], ebx
cmp dword [edx], ebx
jg 0x1002402a
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esi], ebx
cmp dword [esi], ebx
jg 0x10024067
mov edx, dword [ebp - 0x24]
mov ecx, dword [edi]
mov eax, dword [edx]
cmp dword [eax + ecx*4], ebx
jne 0x10024064
inc dword [esi]
cmp dword [esi], ebx
jle 0x10024055
mov edx, dword [ebp + 0x14]
inc dword [edx]
cmp dword [edx], ebx
jle 0x1002404c
jmp 0x1002402a
cmp byte [ebp + 0xc], 0
je 0x1002407f
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1002402a
mov dword [ebp - 0x24], 0x4de
xor ebx, ebx
cmp dword [ebp - 0x24], 0x77b
jle 0x100240e8
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x1c], 0x50ee
mov dword [ebp - 0x18], eax
mov ebx, eax
mov esi, 0x5e95
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007bfb8
cdq
push edx
push eax
call fcn.1000dd80
dec ebx
dec esi
jne 0x100240a9
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
add eax, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x100240a2
inc esi
mov dword [ebp - 0x20], esi
push 0
pop ebx
cmp esi, 0x51d5
jl 0x10024096
inc edi
cmp edi, 0x1208
jl 0x10024093
push ecx
mov byte [ebp - 0x11], bl
lea edx, [ebp - 0x11]
push ecx
call fcn.10022dcc
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x101
pop ecx
jge 0x1002402a
mov edx, str.zpek_hdjjoefye_aeghul_npck_siovzncyz_wcafab_ejyxpwbgu_kdl_mrxnu_inui_zbylpg_mhtk_cqhimrwnv
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x1002402a
Function at 0x10024c28
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100610cd
call fcn.1005fe44
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0x1c], 0x34ac
mov ebx, ecx
cmp dword [ebp - 0x1c], 0x352b
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
jle 0x10024c8a
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x1801
mov eax, ebx
mov ecx, 0x1007bfb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000dd80
add ebx, edi
dec dword [ebp - 0x18]
jne 0x10024c5d
inc edi
cmp edi, 0x218e
jl 0x10024c54
inc esi
cmp esi, 0x426b
jl 0x10024c52
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x33f1
jge 0x10024cc5
mov edx, str.bucz_gbw_ghuha_jhyov_xssohqhdj_pxsx_qec_mej_ilp
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x10024cc5
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10024cdc
push 0xddc
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x10024d51
mov dword [ebp - 0x1c], 0x6702
cmp dword [ebp - 0x1c], 0x6896
jle 0x10024d38
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10024d13
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.1000e875
inc edi
cmp edi, 0x3bc1
jl 0x10024cf8
inc esi
cmp esi, 0x723b
jl 0x10024cf6
cmp dword [ebp - 0x1c], 0x655e
jge 0x10024d4c
push str.iwohfamio_lemc_sekygjlh_thupfhk_nvvrogg_ccdvdmjv
call fcn.10047a23
pop ecx
mov eax, dword [ebp + 0x14]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027fcb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100607cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov byte [esp], cl
push ebx
mov ebx, edx
mov dword [esp + 0x20], ebx
push esi
push edi
test cl, cl
je 0x100280a4
push dword [esp + 0x28]
movdqa xmm0, xmmword [0x1006e960]
lea eax, [esp + 0x4c]
push eax
xor esi, esi
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], esi
movdqu xmmword [esp + 0x48], xmm0
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.10011607
mov dword [esp + 0x6c], esi
mov dword [esp + 0x10], 0x76e6bacd
mov dword [esp + 0x28], 0xd94543be
mov dword [esp + 0x28], 0x6ec79cf1
mov dword [esp + 0x10], esi
jmp 0x1002808f
push 1
push 0x60d2
push esi
push 0xe5a
push 1
push 0x38f8
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 1
push eax
push 0x664
mov edx, 0x43fe
mov ecx, 0x5bec
call fcn.10026718
add esp, 0x20
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10028053
lea ecx, [esp + 0x2c]
call fcn.1000e145
jmp 0x10028160
mov dword [esp + 0x20], 0x35e0
cmp dword [esp + 0x20], 0x389a
push 0
pop esi
jle 0x1002813f
mov dword [esp + 0x1c], esi
mov ebx, esi
mov dword [esp + 0x18], 0x793f
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], 0x6c67
mov edi, esi
mov eax, ebx
lea ecx, [esp + 0x48]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100280f7
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push esi
push 1
lea ecx, [esp + 0x50]
call fcn.1000e875
inc edi
cmp edi, 0x4bd5
jl 0x100280dd
dec ebx
dec dword [esp + 0x10]
jne 0x100280db
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
add ebx, edi
dec dword [esp + 0x18]
mov dword [esp + 0x14], ebx
jne 0x100280cf
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x3061
jl 0x100280c1
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x20], 0x32a6
jge 0x10028154
push str.ulvfqww_fudpqwj_dsojoxfq_wodm_rnasloa_ducpoihiq_xrxb_uisz_fzfynzexp_plokyf_ffh
call fcn.10047a23
pop ecx
cmp byte [ebx], 0
je 0x10028160
push esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100285a2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x10028622
mov dword [esi], 0xffffffe2
cmp dword [esi], 0x15
jne 0x1002863c
push ebx
mov ebx, dword [ebp + 0x18]
or ecx, 0xffffffff
mov dword [ebp - 8], 0x549ec71
mov dword [ebp - 0xc], 0xb35b6890
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [ebx]
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, 0x94bb489f
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
mov dword [ebp - 0xc], ecx
mov dword [edi], 0xfffffffd
jmp 0x10028613
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10028611
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
dec dword [edi]
cmp dword [edi], 0xffffffe2
je 0x100285ff
inc dword [esi]
cmp dword [esi], 0x15
je 0x100285c3
pop ebx
jmp 0x1002863c
mov eax, dword [ebp + 8]
mov dword [eax], 3
cmp dword [eax], 0
jl 0x1002863c
mov ecx, dword [ebp + 0x1c]
dec dword [ecx]
dec dword [eax]
cmp dword [eax], 0
jge 0x10028633
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10028737
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x10061171
call fcn.1005fe44
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0x20], 0xe0
cmp dword [ebp - 0x20], 0x24b
push edi
mov dword [ebp - 0x10], esp
jle 0x100287c9
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x7dfc
mov dword [ebp - 0x24], esi
mov edi, 0x558
mov eax, esi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002878c
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000e875
add esi, ebx
dec edi
jne 0x10028775
mov edi, dword [ebp - 0x18]
add ebx, edi
dec dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
jne 0x1002876d
dec edi
mov dword [ebp - 0x18], edi
cmp edi, 0xffff997f
jg 0x10028764
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x46fb
jl 0x1002875f
cmp dword [ebp - 0x20], 0xfffffda3
jge 0x100287dd
push str.kuh_gdf_jrrrpgxp_bpy_srlgsw
call fcn.10047a23
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x10028895
mov dword [ebp - 0x1c], 0x119e
cmp dword [ebp - 0x1c], 0x1319
jle 0x10028855
push 0x5bc
push 0
push 0x20e6
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
shl ebx, cl
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007bfb8
cdq
push edx
push eax
call fcn.1000dd80
inc esi
cmp esi, 0x20b4
jl 0x10028821
mov esi, dword [ebp - 0x20]
inc edi
cmp edi, 0x7500
jl 0x10028814
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x64bd
jl 0x10028812
mov eax, dword [ebp + 0xc]
dec dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0xeab
jge 0x10028879
mov edx, str.oewthp_jjmrij_ifrxrt_uqlfo_tipodlln_ghatonnbt_xgyjty_uadqycm
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x1002889f
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031d8a
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031ddf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x692d
push 0
push dword [ebp - 0x18]
call fcn.1003e2d8
add esp, 0x20
jmp 0x10031e2d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10031e15
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10031e13
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10031e2d
push 0x2292
push 0
push 0
push 0
push 0
push 0xcf2
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x43b6f8]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43b6fc]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x43b700]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x43b704]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x44a954], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x44a954]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x44a950], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x44a8a4], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x44a94c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408d38
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43af30]
jne 0x408d42
repz ret
jmp fcn.0040ccb4

Function at 0x409fb3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402abe
and dword [ebp - 4], 0
cmp dword [0x43f940], 0
mov ebx, eax
jne 0x40a064
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a115
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a115
push eax
call fcn.00402a4c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43f940], eax
call esi
push eax
call fcn.00402a4c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f944], eax
call esi
push eax
call fcn.00402a4c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43f948], eax
call esi
push eax
call fcn.00402a4c
pop ecx
mov dword [0x43f950], eax
test eax, eax
je 0x40a064
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402a4c
pop ecx
mov dword [0x43f94c], eax
mov eax, dword [0x43f94c]
cmp eax, ebx
je 0x40a0bc
cmp dword [0x43f950], ebx
je 0x40a0bc
push eax
call fcn.00402ac7
push dword [0x43f950]
mov esi, eax
call fcn.00402ac7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a0bc
test edi, edi
je 0x40a0bc
call esi
test eax, eax
je 0x40a0b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a0b3
test byte [ebp - 0xc], 1
jne 0x40a0bc
or dword [ebp + 0x10], 0x200000
jmp 0x40a0f5
mov eax, dword [0x43f944]
cmp eax, ebx
je 0x40a0f5
push eax
call fcn.00402ac7
pop ecx
test eax, eax
je 0x40a0f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a0f5
mov eax, dword [0x43f948]
cmp eax, ebx
je 0x40a0f5
push eax
call fcn.00402ac7
pop ecx
test eax, eax
je 0x40a0f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f940]
call fcn.00402ac7
pop ecx
test eax, eax
je 0x40a115
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a117
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40288e
pop dword [ebp - 0x10]
mov eax, 0xbf5318c3
add eax, 0x40ed0fcb
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x53e648b2
sub dword [ebp - 0x20], 0x5940367
mov dword [ebp - 0x1c], 0x13d59cb
add dword [ebp - 0x1c], 0x30f5f27a
mov dword [ebp - 0x18], 0xe673bba5
add dword [ebp - 0x18], 0x65d88889
mov dword [ebp - 0x14], 0x19ff6a4e
add dword [ebp - 0x14], 0xe60095b2
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xaa2015ec
add dword [ebp - 0x20], 0xca52536a
mov dword [ebp - 0x1c], 0x207910e1
add dword [ebp - 0x1c], 0x20f35094
mov dword [ebp - 0x18], 0xf1db3690
add dword [ebp - 0x18], 0x719435dc
mov dword [ebp - 0x14], 0x3a25f1a
add dword [ebp - 0x14], 0xfc5da0e6
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xfc679f82
add eax, 0x3d8e152
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad8a
push 0
call eax
mov ecx, 0x26e06541
add ecx, 0xd91ff3bf
mov edx, eax
mov ebx, 0xf2e957f1
add ebx, 0xd57b80f
add ebx, dword [ebp - 0x10]
mov edi, 0xf743e45b
sub edi, 0x7ccf563a
mov dword [ebp - 4], 0xef8687ee
mov esi, dword [ebx]
add dword [ebp - 0xc], 0x100696f5
xor esi, edi
add dword [ebp - 0xc], 0x3da6c71d
mov dword [edx], esi
add dword [ebp - 4], edi
add edx, 0xe1ef8bc5
add edx, 0x1e10743f
add ebx, 4
loop 0x4029ab
add eax, 0x4d2bbb9b
sub eax, 0x4d2a64c8
mov ebx, eax
add eax, 0xd1a3d49f
add eax, 0x2e5c2b66
mov ecx, 0x794e2236
add ecx, 0x86f1ddca
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x429488
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
lea eax, [ebp - 0xb2]
push edi
push esi
mov edi, 0x4714ec
mov esi, 0x427d65
push ebx
add esp, 0xfffffff4
mov ebx, 0x46256c
cld
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov dword [0x47108c], 0x1e6
lea edi, [ebp - 0xb0]
push 1
push eax
lea eax, [ebp - 0xb8]
push eax
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
shl eax, 3
sub eax, dword [ebp + 8]
lea eax, [edx + eax*4]
lea esi, [eax*8]
mov eax, dword [esi + ebx]
push eax
call fcn.0043fd4c
mov dword [ebp - 0xbc], eax
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [esi + ebx]
push eax
call fcn.0043e450
mov ecx, dword [ebp - 0xbc]
add esp, 0x10
mov dword [esi + ebx], ecx
mov eax, dword [ebp - 0xb8]
mov dword [esi + 0x462570], eax
xor eax, eax
mov ax, word [ebp - 0xb2]
mov dword [esi + 0x462574], eax
cmp ecx, 0xffffffff
jne 0x42958c
add esp, 0xfffffff4
lea ebx, [esi + 0x46257c]
push edi
call fcn.0043ddf0
push edi
push ebx
push 0x429444
push 0x7ff4
call fcn.0041fb30
add esp, 0x20
lea eax, [esi + 0x46259c]
add esp, 0xfffffff8
push eax
push ebx
mov eax, dword [esi + 0x462650]
push eax
push 0x429464
push 0x427dcb
push 0x100
call fcn.00437adc
add esp, 0x20
mov eax, dword [ebp + 8]
add esp, 0xfffffff4
push eax
call fcn.00422aa4
jmp 0x429650
mov eax, dword [0x45cba0]
mov edi, 0x462650
test eax, eax
je 0x4295a5
mov edx, dword [esi + edi]
cmp dword [edx + 0xf4], eax
jae 0x4295ae
mov edx, dword [esi + edi]
mov eax, dword [edx + 0xf4]
mov dword [edx + 0xf8], eax
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 8]
shl ebx, 3
add esp, 0xfffffffc
sub ebx, dword [ebp + 8]
lea ebx, [edx + ebx*4]
shl ebx, 3
mov dword [ebx + 0x462640], 4
push 0x1fa
push 0x427d65
mov eax, dword [ebx + edi]
mov eax, dword [eax + 0xf8]
inc eax
push eax
call fcn.004361d8
mov edx, dword [ebx + edi]
mov esi, eax
mov eax, dword [edx + 0x12c]
push eax
push 1
mov eax, dword [edx + 0xf8]
push eax
push esi
call sub.cygwin1.dll_fread
mov eax, dword [ebx + edi]
add esp, 0x20
add esp, 0xfffffffc
mov eax, dword [eax + 0xf8]
push eax
push esi
mov eax, dword [ebx + 0x46256c]
push eax
call fcn.0043f6d4
add esp, 0xfffffffc
push 0x1fd
push 0x427d65
push esi
call fcn.00436254
add esp, 0x20
add esp, 0xfffffff4
push 0
call sub.cygwin1.dll_time
mov edx, eax
mov eax, dword [ebx + edi]
mov dword [eax + 0x108], edx
lea esp, [ebp - 0xd8]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4296b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
push esi
mov edi, 0x4714ec
push ebx
mov esi, 0x427d65
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
cld
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov dword [0x47108c], 0x209
mov edi, 0x462650
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
shl eax, 3
sub eax, dword [ebp + 8]
lea eax, [ecx + eax*4]
lea esi, [eax*8]
mov eax, dword [esi + edi]
mov eax, dword [eax + 0x12c]
push eax
push 1
push ebx
push edx
call sub.cygwin1.dll_fwrite
mov eax, dword [esi + edi]
add esp, 0xfffffffc
add dword [eax + 0xf8], ebx
mov eax, dword [esi + edi]
mov edx, dword [eax + 0xf8]
mov eax, edx
mov byte [ebp - 0x1fd], dl
shr eax, 0x18
mov byte [ebp - 0x200], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1ff], al
mov eax, edx
shr eax, 8
mov byte [ebp - 0x1fe], al
push 4
lea eax, [ebp - 0x200]
mov dword [ebp - 0x204], eax
push eax
mov eax, dword [esi + 0x46256c]
push eax
call fcn.0043f6d4
add esp, 0x20
add esp, 0xfffffff4
push 0
call sub.cygwin1.dll_time
mov edx, eax
add esp, 0x10
mov eax, dword [esi + edi]
mov dword [eax + 0x108], edx
mov eax, dword [esi + edi]
mov edx, dword [eax + 0xf4]
cmp dword [eax + 0xf8], edx
jbe 0x42983a
test edx, edx
je 0x42983a
add esp, 0xfffffffc
lea ebx, [esi + 0x46257c]
push ebx
push 0x429664
push 0x7ff4
call fcn.0041fb30
add esp, 0xfffffff8
lea eax, [esi + 0x46259c]
push eax
push ebx
mov eax, dword [esi + edi]
push eax
push 0x429684
push 0x427dcb
push 0x100
call fcn.00437adc
mov eax, dword [esi + edi]
add esp, 0x30
add esp, 0xfffffff4
mov eax, dword [eax + 0x12c]
push eax
call sub.cygwin1.dll_fclose
mov eax, dword [esi + edi]
push eax
push 0x45c254
push 0x427d91
mov ecx, dword [ebp - 0x204]
push ecx
call sub.cygwin1.dll_sprintf
add esp, 0x20
mov eax, dword [ebp - 0x204]
add esp, 0xfffffff4
push eax
call sub.cygwin1.dll_unlink
add esp, 0xfffffff4
mov eax, dword [esi + 0x46256c]
push eax
call fcn.0043e450
add esp, 0x20
mov ecx, dword [ebp + 8]
add esp, 0xfffffff4
push ecx
call fcn.00422aa4
lea esp, [ebp - 0x228]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret