joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005400
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x10005459
lea eax, [ebp + 8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1000542a
mov eax, 0x80004005
pop esi
pop ebp
ret
push 0x4c
push str.3CAF6447_E4C6_4E72_83C6_F9ACAF79F65E
push 1
push str._______Butterflyimg
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp + 8]
neg eax
sbb esi, esi
and esi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80004005
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1001681d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100164dd
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x408910
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
dec ecx
call fcn.00408942
dec ecx
sub eax, 0x837478d2
xor dword [ebx], esi
inc ecx
add ecx, 0xe668b015
add ebx, 1
mov eax, eax
cmp ebx, edx
jne fcn.00408910
mov ecx, 0x3d53463d
ret
Function at 0x406fcb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x805448]
jne 0x406fd5
repz ret
jmp fcn.004090bb

Function at 0x40875f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x805448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405dad
and dword [ebp - 0x14], 0
cmp dword [0x8075b8], 0
mov dword [ebp - 0x18], eax
jne 0x408812
push 0x4022d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4088ba
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022c4
push ebx
call edi
test eax, eax
je 0x4088ba
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4022b4
push ebx
mov dword [0x8075b8], eax
call edi
push eax
call esi
push 0x4022a0
push ebx
mov dword [0x8075bc], eax
call edi
push eax
call esi
push 0x402284
push ebx
mov dword [0x8075c0], eax
call edi
push eax
call esi
mov dword [0x8075c8], eax
test eax, eax
je 0x408812
push 0x40226c
push ebx
call edi
push eax
call esi
mov dword [0x8075c4], eax
mov eax, dword [0x8075c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40886b
cmp dword [0x8075c8], ecx
je 0x40886b
push eax
call esi
push dword [0x8075c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40886b
test ebx, ebx
je 0x40886b
call edi
test eax, eax
je 0x408862
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408862
test byte [ebp - 8], 1
jne 0x40886b
or dword [ebp + 0x10], 0x200000
jmp 0x40889e
mov eax, dword [0x8075bc]
cmp eax, dword [ebp - 0x18]
je 0x40889e
push eax
call esi
test eax, eax
je 0x40889e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40889e
mov eax, dword [0x8075c0]
cmp eax, dword [ebp - 0x18]
je 0x40889e
push eax
call esi
test eax, eax
je 0x40889e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8075b8]
call esi
test eax, eax
je 0x4088ba
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4088bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406fcb
leave
ret
Function at 0x8018c0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0xb8b644], 0x37
jne 0x801979
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x402c18
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 4]
push ecx
push 0x402c2c
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x402c4c
push 0x402c68
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea edx, [esp + 0x810]
push edx
push 0
push 0x402ca4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov eax, dword [0xb8c638]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x80c694]
mov byte [eax + esi], dl
add esp, 0xc0c
ret
Function at 0x801b30
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb8b644]
sub esp, 0x5cc
push ebx
push ebp
push esi
mov esi, dword [0x80c694]
shr eax, 3
push edi
test eax, eax
je 0x801d03
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x801b64
mov esi, dword [esp + 0x14]
cmp dword [0xb8b644], 0x1c
jne 0x801b81
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov edx, dword [0x805dc0]
mov eax, dword [0x805dc4]
mov ecx, dword [0x805dc8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [0x805dcc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x28]
mov esi, ebx
shr esi, 5
cmp dword [0xb8b644], 0x1b
mov dword [esp + 0x10], eax
jne 0x801bfd
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1dc]
push ecx
push 0
push 0x402b08
push 0x402b74
push 0x402ba8
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x30]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0xb8b5b4], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x10], eax
cmp dword [0xb8b644], 0x1be
jne 0x801c42
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x20]
cmp dword [0xb8b644], 0x979
mov dword [0xb8b5b8], 0xff6b3619
mov dword [0xb8b5bc], 0xffffffff
jne 0x801c82
mov edx, dword [esp + 0x2c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x801bba
cmp dword [0xb8b644], 0x8d4
jne 0x801cba
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0xb8b644], 0x17
jne 0x801cf2
push 0
push 0
push 0
push 0x402bf4
push 0x402c10
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x98]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x801b60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5cc
ret
Function at 0x406fcb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420448]
jne 0x406fd5
repz ret
jmp fcn.004090bb

Function at 0x40875f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405dad
and dword [ebp - 0x14], 0
cmp dword [0x4225b8], 0
mov dword [ebp - 0x18], eax
jne 0x408812
push 0x4022d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4088ba
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022c4
push ebx
call edi
test eax, eax
je 0x4088ba
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4022b4
push ebx
mov dword [0x4225b8], eax
call edi
push eax
call esi
push 0x4022a0
push ebx
mov dword [0x4225bc], eax
call edi
push eax
call esi
push 0x402284
push ebx
mov dword [0x4225c0], eax
call edi
push eax
call esi
mov dword [0x4225c8], eax
test eax, eax
je 0x408812
push 0x40226c
push ebx
call edi
push eax
call esi
mov dword [0x4225c4], eax
mov eax, dword [0x4225c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40886b
cmp dword [0x4225c8], ecx
je 0x40886b
push eax
call esi
push dword [0x4225c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40886b
test ebx, ebx
je 0x40886b
call edi
test eax, eax
je 0x408862
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408862
test byte [ebp - 8], 1
jne 0x40886b
or dword [ebp + 0x10], 0x200000
jmp 0x40889e
mov eax, dword [0x4225bc]
cmp eax, dword [ebp - 0x18]
je 0x40889e
push eax
call esi
test eax, eax
je 0x40889e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40889e
mov eax, dword [0x4225c0]
cmp eax, dword [ebp - 0x18]
je 0x40889e
push eax
call esi
test eax, eax
je 0x40889e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4225b8]
call esi
test eax, eax
je 0x4088ba
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4088bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406fcb
leave
ret
Function at 0x41c040
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0x7a6644], 0x37
jne 0x41c0f9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x402c18
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 4]
push ecx
push 0x402c2c
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x402c4c
push 0x402c68
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea edx, [esp + 0x810]
push edx
push 0
push 0x402ca4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov eax, dword [0x7a7638]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x427694]
mov byte [eax + esi], dl
add esp, 0xc0c
ret
Function at 0x41c2b0
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7a6644]
sub esp, 0x5cc
push ebx
push ebp
push esi
mov esi, dword [0x427694]
shr eax, 3
push edi
test eax, eax
je 0x41c483
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x41c2e4
mov esi, dword [esp + 0x14]
cmp dword [0x7a6644], 0x1c
jne 0x41c301
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov edx, dword [0x420dc0]
mov eax, dword [0x420dc4]
mov ecx, dword [str.M1uId]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [0x420dcc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x28]
mov esi, ebx
shr esi, 5
cmp dword [0x7a6644], 0x1b
mov dword [esp + 0x10], eax
jne 0x41c37d
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1dc]
push ecx
push 0
push 0x402b08
push 0x402b74
push 0x402ba8
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x30]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0x7a65b4], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x10], eax
cmp dword [0x7a6644], 0x1be
jne 0x41c3c2
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x20]
cmp dword [0x7a6644], 0x979
mov dword [0x7a65b8], 0xff6b3619
mov dword [0x7a65bc], 0xffffffff
jne 0x41c402
mov edx, dword [esp + 0x2c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x41c33a
cmp dword [0x7a6644], 0x8d4
jne 0x41c43a
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0x7a6644], 0x17
jne 0x41c472
push 0
push 0
push 0
push 0x402bf4
push 0x402c10
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x98]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x41c2e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5cc
ret
Function at 0x4021e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
jmp 0x401ffa
mov esi, dword [edx + 0x28]
nop
jmp 0x402008
movzx ecx, word [edx + 0x26]
jmp 0x402019
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x402029
cmp al, 0x61
jl 0x402031
nop
nop
sub al, 0x20
nop
ror edi, 0xd
nop
add edi, eax
nop
jmp 0x402045
dec ecx
jne 0x40200c
nop
push edx
nop
jmp 0x402058
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x4021fb
nop
jmp 0x40207c
jmp 0x402087
add eax, edx
jmp 0x402094
mov ebx, dword [eax + 0x20]
jmp 0x4020a4
push eax
nop
jmp 0x4020b7
mov ecx, dword [eax + 0x18]
add ebx, edx
nop
test ecx, ecx
je 0x4021d2
nop
jmp 0x4020d3
xor edi, edi
jmp 0x4020e0
dec ecx
nop
jmp 0x4020ec
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
jmp 0x4020ff
xor eax, eax
nop
lodsb al, byte [esi]
nop
ror edi, 0xd
nop
add edi, eax
jmp 0x40211b
cmp al, ah
jne 0x4020f3
nop
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jne 0x4020bd
nop
nop
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
jmp 0x40213f
add ebx, edx
jmp 0x40214f
mov cx, word [ebx + ecx*2]
nop
jmp 0x40215f
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
nop
jmp 0x402176
add eax, edx
jmp 0x402182
mov dword [esp + 0x24], eax
nop
pop ebx
pop ebx
popal
nop
jmp 0x402198
pop ecx
jmp 0x4021aa
pop edx
nop
push ecx
nop
jmp 0x4021bb
jmp eax
nop
jmp fcn.004021e6
pop eax
nop
jmp 0x4021fb
pop edi
jmp 0x40220e
pop edx
nop
mov edx, dword [edx]
nop
jmp 0x401fee

Function at 0x405d7c
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
add dword [edx], eax
add byte [edi], bl
push 9
push 0x79c400
call 0x3fdf00
cmp dword [0x40a094], 0
pop eax
pop edx
je 0x405dba
push 0x405d50
push 0x405d5b
push ebx
push 0xccc400
call 0x72a59
adc dword [eax], eax
invalid
mov dword [0x40c318], 0x73a90322
clc
mov esp, 0xa60c0000
inc eax
add byte [edx], ah
add ebp, dword [ecx + 0xbcf873]
add byte [esi], cl
mov eax, dword [0xe86040e0]
stosb byte es:[edi], al
wait
fcompp
push 0xadfa5d5f
push 0x405d24
inc ebx
push 0x40c3f0
call fcn.00405c59
mov dword [ebp - 0x2b], fcn.004095f0
add esp, 0x18
out 0x5d, al
cld
leave
inc esi
xor eax, 0x55000002
mov ebp, esp
push esi
xor dword [ebx + edx*2], ebp
mov ebx, dword [ebp + 0x35]
cmp esi, dword [ecx + 4]
jge 0x405dbe
mov eax, dword [ebx]
push dword [eax + esi*4]
inc esi
call fcn.00407e98
cmp esi, dword [ebx + 4]
pop ecx
inc ecx
out dx, eax
mov eax, dword [ebx]
mov dword [ecx - 0x79a72c8], ebx
call 0xa729bbaf
and byte [eax + eax], bl
push ebp
mov ebp, esp
push 0x2940c4a7
call 0xfff5aefb
push 0x53c3f0
call 0xf8405dfb
leave
ret
Function at 0x407fc3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
mov ebx, dword [ebp + 8]
push 0x104
push ebx
push 0
call 0xf7629900
test eax, eax
je 0x407ff0
lea eax, [ebp + 0x76]
push eax
push ebx
push 0xa910
push ebx
call 0x4096f6
test dword [0x6d317b75], esp
jmp 0x407ff7
xor dword [ebp - 0x15], ebp
add ecx, dword [ebx - 0x5e7407bb]
cld
leave
xchg ebp, eax
ja 0x407ff7
mov esp, dword [ecx + 0x7795c9fc]
stc
outsb dx, byte [esi]
pop ecx
xor al, byte [edi - 0x67d19b9f]
aam 0x69
adc eax, 0x6e65475c
popal
add dword [ecx], esi
adc byte [edi + ecx*2 - 0x4b], bl
outsb dx, byte [esi]
aas
xor dh, byte [eax + 0x61]
add byte fs:[edi + esi*2 + 0x69], bl
std
xor esi, dword [edx]
jo 0x408084
sbb dword cs:[esi + 0x69], ebp
add byte [ebp - 0x77], dl
push ebx
mov ebx, dword [ebp + 8]
push 0x127f87
push ebx
call 0x70407fc3
mov dword [esi + 0x16ede824], ebx
add al, ch
push 0x2f
push ebx
call 0xfc559215
pop ecx
test dword [edi + 0x5a], ebx
pop ecx
add dword [eax], eax
add byte [eax], al
je 0x4080c6
push ebx
push 0
push 0
xchg ecx, eax
leave
push 0
call 0x4689b0
test eax, eax
js 0x4080c4
push 0xfa8009
sub eax, 0xffffffcd
daa
add byte [eax], al
int 0
mov al, byte [0xec1185e8]
add byte [ecx - 0x32], bl
rcr byte [edx + 0x74], 0xe3
in al, dx
add byte [ebx - 0x18], dl
pop ss
sbb dword [eax], eax
add dl, dl
sal byte [edi + esi + 0x68], 0xe7
add byte [eax + 0x19], 0x53
call 0x4099a0
rol al, cl
je 0x4080c4
push 0x194080e7
push ebx
call 0x13096f5
push 0
push ebx
call 0xe4409200
pop ecx
test eax, eax
pop edx
je 0x4080b2
push 0x1d
push ebx
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438c9f
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
push edi
pop edi
or edi, ebx
mov ebx, edi
call fcn.00438cdf
inc edi
or ebx, edi
xor dword [eax], edx
add ebx, 0x9b25744e
or edi, ebx
inc edi
inc eax
and ebx, ebx
cmp eax, esi
jne fcn.00438c9f
sub esp, 4
mov dword [esp], 0x8a15a74
mov edi, dword [esp]
add esp, 4
or ebx, ebx
push edi
pop edi
ret