joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x42b1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x42b1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x42bdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0042bf04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0042bf20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0042beec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
push ecx
push dword [ebp + 8]
call fcn.0042bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
push ecx
push dword [ebp + 8]
call fcn.0042bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
push ecx
push dword [ebp + 8]
call fcn.0042bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0042bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0042becb
cmp ecx, 0x2b
jne 0x42be0f
leave
ret 0xc

Function at 0x42d4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x42d544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x13c50
push 0
call dword [eax + 0x20]
test eax, eax
je 0x42d5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x13c50
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x13c50
call fcn.0042d3fa
push 0x13c50
push dword [ebp + 0xc]
call fcn.0042b1a8
test eax, eax
jne 0x42d5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x13c50
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.0042d5dd
test eax, eax
je 0x42d5d6
jmp 0x42d574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x42d5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x42d60b
Capabilities:
Terminate process

Disassembly:
call fcn.0042d618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x100b151
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
inc edi
mov dword [esi + 8], edi
call fcn.0100af5f
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100b177
push 0x1388
push dword [esi + 0x38]
call ebx
push dword [esi + 0x3c]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [esi + 0x64]
call ebx
cmp eax, 0x102
jne 0x100b1a2
push 0
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x64], 0
pop edi
pop esi
pop ebx
ret

Function at 0x100b6c7
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
call fcn.0100b132
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x18], ebx
cmp dword [esi + 0x64], ebx
jne 0x100b71d
push edi
push dword [esi + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
call edi
push dword [esi + 0x3c]
call edi
lea eax, [esi + 0x68]
push eax
push ebx
push esi
push 0x100b239
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x64], eax
pop edi
jmp 0x100b72f
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1013fa5
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x228
mov eax, 0x101c61f
call fcn.01019f0c
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x230], eax
call sub.MFC42u.dll_CString::CString
and dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::CString
lea eax, [ebp - 0x218]
push eax
mov esi, 0x104
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
jbe 0x1014047
push 0x10016f0
mov ecx, edi
call fcn.0101947a
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.010194aa
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.010194aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.010194aa
xor eax, eax
call fcn.01019f9e
ret 0xc
push 0x4b6
lea ecx, [ebp - 0x220]
call sub.MFC42u.dll_CString::LoadStringW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0101947a
push dword [0x1024374]
lea ecx, [ebp - 0x224]
call sub.MFC42u.dll_CString::CString_1
mov esi, eax
push 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call sub.MFC42u.dll_CString::Right
push dword [esi]
mov ecx, eax
call fcn.01008914
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x228]
inc bl
call fcn.010194aa
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.010194aa
test bl, bl
je 0x10140f5
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.01019486
lea ecx, [ebp - 0x224]
jmp 0x101416a
push dword [0x1024374]
lea ecx, [ebp - 0x234]
call sub.MFC42u.dll_CString::CString_1
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 5
call sub.MFC42u.dll_operator
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 6
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 7
call fcn.01019486
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 6
call fcn.010194aa
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 5
call fcn.010194aa
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.010194aa
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x101418c
push dword [ebp - 0x230]
lea eax, [ebp - 0x21c]
push eax
call fcn.010134a2
push esi
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x10141f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10141f1
push 0x1002e05
mov ecx, edi
call fcn.010197fe
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.010194aa
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.010194aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.010194aa
mov eax, esi
jmp 0x101403f
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.01019486
xor esi, esi
inc esi
jmp 0x10141bd
Function at 0x10145ba
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 8]
mov eax, ecx
lea edx, [eax + 2]
push esi
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10145c9
sub eax, edx
sar eax, 1
pop esi
jne 0x10145e8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
jmp 0x10145fb
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
push ecx
push dword [eax]
push dword [ebp + 8]
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x10
leave
ret 8

Function at 0x1014f60
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1014fc7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 4
jb 0x1014fc0
push esi
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1014fc0
cmp dword [ebp + 8], 4
jne 0x1014fc0
cmp dword [ebp - 4], 0xe011cfd0
jne 0x1014fc0
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x1015b0e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x58
mov eax, 0x101c73e
call fcn.01019e99
mov esi, ecx
mov edi, dword [esi + 0x37c]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x1015b61
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1015b61
push dword [esi + 0x37c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1015b61
push 0
push 0
push 0x301
push dword [esi + 0x37c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1015cb5
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::CString
and dword [ebp - 4], 0
push 0x10016f0
lea ecx, [ebp - 0x10]
call fcn.0101947a
mov ecx, esi
call fcn.010142b0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1015ca9
mov edx, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call dword [edx + 0x18]
and dword [ebp - 0x5c], 0
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
mov dword [ebp - 0x64], 4
push 0xffffffffffffffff
mov ebx, 0x100c
jmp 0x1015c36
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0x104b
push dword [esi + 0x14]
call edi
test eax, eax
je 0x1015c31
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x20]
jge 0x1015c24
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x1c], 0
jle 0x1015c24
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
push 0
lea edx, [ebp - 0x28]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x44]
call dword [eax + 0x28]
test eax, eax
je 0x1015c19
cmp dword [ebp - 0x14], 0
je 0x1015c0e
push 0x1002df0
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator_2
push dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jl 0x1015be3
push 0x10072ac
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator_2
push 2
push dword [ebp - 0x18]
push ebx
push dword [esi + 0x14]
call edi
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x1015bb7
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1015ca9
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1015ca3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
lea edi, [eax + eax + 2]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1015ca3
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x1015ca3
push edi
push dword [ebp - 0x10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010194aa
call fcn.01019f85
ret
Function at 0x1018d3e
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push edi
lea eax, [ebp - 0x10]
mov edi, ecx
and dword [edi + 0x3e0], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x1018ebd
mov eax, dword [ebp - 0x10]
push 2
pop ecx
cmp eax, ecx
jl 0x1018ebd
push esi
xor esi, esi
inc esi
dec eax
cmp eax, esi
jl 0x1018ebc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + esi*4]
movzx ecx, word [eax]
cmp cx, 0x2d
je 0x1018da4
cmp cx, 0x2f
jne 0x1018ec6
inc eax
inc eax
push 0x10073c4
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1018edb
push 0x10073b8
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1018edb
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jge 0x1018ebc
push 0x10073b0
push dword [ebp - 8]
inc esi
inc dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018e1c
mov dword [0x10268ac], 1
push dword [ebx + esi*4]
lea ecx, [edi + 0x3f0]
call fcn.0101947a
or dword [ebp - 4], 2
jmp 0x1018e9e
push 0x10073a0
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018e4e
mov dword [0x10268ac], 1
push dword [ebx + esi*4]
lea ecx, [edi + 0x3ec]
call fcn.0101947a
or dword [ebp - 4], 4
jmp 0x1018e9e
push 0x100738c
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018e80
mov dword [0x10268b0], 1
push dword [ebx + esi*4]
lea ecx, [edi + 0x3e4]
call fcn.0101947a
or dword [ebp - 4], 8
jmp 0x1018e9e
push 0x1007378
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1018e9a
or dword [ebp - 4], 0x10
jmp 0x1018e9e
or dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
inc esi
inc dword [ebp - 0xc]
dec eax
cmp esi, eax
jle 0x1018d8e
cmp dword [ebp - 4], 0
je 0x1018ebc
push dword [ebp - 4]
call fcn.010192ff
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret 4
cmp esi, 1
jne 0x1018eae
push dword [ebx + 4]
lea ecx, [edi + 0x3e8]
call fcn.0101947a
jmp 0x1018eae
mov dword [edi + 0x3e0], 1
jmp 0x1018ebc
Function at 0x1019d9e
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1021d48
call fcn.0101a364
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10290c0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1019b59
cmp eax, esi
jne 0x1019b4c
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1019b5c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1019b33
xor esi, esi
inc esi
mov eax, dword [0x10290bc]
cmp eax, esi
jne 0x1019b6f
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1019b9e
mov eax, dword [0x10290bc]
test eax, eax
jne 0x1019b98
mov dword [0x10290bc], esi
push 0x10016b8
push 0x10016ac
call fcn.01019a95
pop ecx
pop ecx
test eax, eax
je 0x1019b9e
jmp 0x1019cc2
mov dword [0x1028d8c], esi
mov eax, dword [0x10290bc]
cmp eax, esi
jne 0x1019bc2
push 0x10016a8
push 0x1001558
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10290bc], 2
cmp dword [ebp - 0x20], ebx
jne 0x1019bcf
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10290cc], ebx
je 0x1019bf0
push 0x10290cc
call fcn.0101a2d9
pop ecx
test eax, eax
je 0x1019bf0
push ebx
push 2
push ebx
call dword [0x10290cc]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1019cc2
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1019c5a
cmp cx, bx
je 0x1019c15
cmp dword [ebp - 0x1c], ebx
jne 0x1019c5a
movzx ecx, word [eax]
cmp cx, bx
je 0x1019c2a
cmp cx, 0x20
ja 0x1019c2a
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1019c15
test byte [ebp - 0x40], 1
je 0x1019c36
movzx ecx, word [ebp - 0x3c]
jmp 0x1019c39
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1028d88], eax
cmp dword [0x1028d7c], ebx
jne 0x1019c9f
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1019c6b
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1019bff
cmp dword [0x1028d8c], ebx
jne 0x1019cad
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1028d88]
jmp 0x1019cce
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0101a3a9
ret
call fcn.0101a4b1
jmp 0x1019af6
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40288e
pop dword [ebp - 0x24]
mov eax, 0x584469d2
add eax, 0xa7fbbebc
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x9dad8bc5
add dword [ebp - 0x34], 0xb0a4b986
mov dword [ebp - 0x30], 0x3427f100
sub dword [ebp - 0x30], 0x1f4a4bb
mov dword [ebp - 0x2c], 0xc476cb51
add dword [ebp - 0x2c], 0x87d578dd
mov dword [ebp - 0x28], 0x9e655917
add dword [ebp - 0x28], 0x619aa6e9
lea eax, [ebp - 0x34]
push eax
mov eax, 0x772cf394
sub eax, 0x76ec8330
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xfb05958d
sub dword [ebp - 0x34], 0x86932c37
mov dword [ebp - 0x30], 0xeb6c6c66
sub dword [ebp - 0x30], 0xaa000af1
mov dword [ebp - 0x2c], 0xf19c1670
add dword [ebp - 0x2c], 0x71d355fc
mov dword [ebp - 0x28], 0xfa912d85
add dword [ebp - 0x28], 0x56ed27b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x39d8e
push 0
call eax
mov ecx, 0x569a73d9
sub ecx, 0x569a1ed8
xor esi, esi
add esi, eax
mov edi, 0xf03b9ff0
sub edi, 0xeffa9ff0
add edi, dword [ebp - 0x24]
mov ebx, 0x5a9c1e5b
sub ebx, 0x6550dd21
xor dword [ebp - 0x18], ecx
mov edx, dword [edi]
add dword [ebp - 8], edi
xor edx, ebx
add dword [ebp - 0x1c], esi
mov dword [esi], edx
add dword [ebp - 0xc], 0xcc1127f4
add esi, 4
add edi, 0x74b943d7
sub edi, 0x74b943d3
loop 0x4029ad
add eax, 0xe67679c8
sub eax, 0xe67532f1
mov ebx, eax
add eax, 0x3a634f74
add eax, 0xc59cb091
mov ecx, 0xf0fa8b4d
sub ecx, 0xf0ba8b4d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40596d
pop dword [ebp - 0x2c]
mov eax, 0x40596d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x7bf5d9b1
sub dword [ebp - 0x3c], 0x2da39466
mov dword [ebp - 0x38], 0xea7072b9
sub dword [ebp - 0x38], 0xb83d2674
mov dword [ebp - 0x34], 0x41ea2423
add dword [ebp - 0x34], 0xa62200b
mov dword [ebp - 0x30], 0xed53434c
add dword [ebp - 0x30], 0x12acbcb4
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xb2bebaad
sub eax, 0xb27e4a4d
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x566d4539
sub dword [ebp - 0x3c], 0xe1fadbe3
mov dword [ebp - 0x38], 0x583cb432
add dword [ebp - 0x38], 0xe92fad43
mov dword [ebp - 0x34], 0x453d1c5e
sub dword [ebp - 0x34], 0xe1cdaff2
mov dword [ebp - 0x30], 0x5351902a
sub dword [ebp - 0x30], 0x5351902a
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xca339b21
add eax, 0x360cd5df
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x386b7
push 0
call eax
mov ecx, 0x8324cb15
add ecx, 0x7cdb83bb
mov esi, eax
mov edx, 0xa640dffc
sub edx, 0xa5ffdffc
add edx, dword [ebp - 0x2c]
mov edi, 0x9774baba
sub edi, 0x409ea353
sub dword [ebp - 0x28], eax
mov ebx, dword [edx]
xor dword [ebp - 0x18], 0xa3a815f2
xor ebx, edi
xor dword [ebp - 0x1c], 0x84f32a6d
mov dword [esi], ebx
add dword [ebp - 4], eax
add esi, 0x5f9d09eb
sub esi, 0x5f9d09e7
add edx, 4
loop 0x405a8a
add eax, 0xeee8f9fa
sub eax, 0xeee7cbe7
mov ebx, eax
add eax, 5
mov ecx, 0x83076212
add ecx, 0x7d389dee
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x78bb1eb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78bbe5b0]
jne 0x78bb1ebd
repz ret
jmp fcn.78bb557c

Function at 0x78bbc4b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x78bbc4c1
pop dword [ebp - 0x40]
mov eax, 0x78bbc4c1
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xab420662
add dword [ebp - 0x50], 0xa3103ee9
mov dword [ebp - 0x4c], 0x94a3c4e
add dword [ebp - 0x4c], 0x28e90ff7
mov dword [ebp - 0x48], 0x577c500c
add dword [ebp - 0x48], 0xf4cff422
mov dword [ebp - 0x44], 0x32698f7e
sub dword [ebp - 0x44], 0x32698f7e
lea eax, [ebp - 0x50]
push eax
mov eax, 0x3b3ab82c
sub eax, 0xc280a7a4
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xceac697a
sub dword [ebp - 0x50], 0x5a3a0024
mov dword [ebp - 0x4c], 0x348abbc6
sub dword [ebp - 0x4c], 0xf31e5a51
mov dword [ebp - 0x48], 0xa98c9e32
add dword [ebp - 0x48], 0xb9e2ce3a
mov dword [ebp - 0x44], 0x2939117b
sub dword [ebp - 0x44], 0x2939117b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x117d8b1b
sub eax, 0x98c37ab3
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3b3ba
push 0
call eax
mov ecx, 0xe5200e47
sub ecx, 0xe51fcb57
xor esi, esi
add esi, eax
mov edi, 0x78bc3600
add edi, dword [ebp - 0x40]
mov ebx, 0x64864632
sub ebx, 0x182b4969
mov edx, dword [edi]
sub dword [ebp - 0x10], 0xf8edd8eb
xor edx, ebx
xor dword [ebp - 0x24], 0x616caa2a
mov dword [esi], edx
add esi, 0x24d78217
sub esi, 0x24d78213
add edi, 0xadeaf28b
add edi, 0x52150d79
loop 0x78bbc5da
add eax, 0xfe93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x78ba0000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4015c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4015d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401614
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401610
lea ebx, [ebx]
cmp esi, eax
jae 0x401614
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401600
cmp esi, eax
jb 0x40161a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret