joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ae4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x406004]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
push esi
push edi
cmp eax, 0x24
jae 0x402b1f
or eax, 0xffffffff
jmp 0x402bcc
push 0xff
push ecx
lea esi, [ecx + 0x14]
add eax, 0xffffffdc
lea edi, [esp + 0x28]
mov dword [esp + 0x1c], eax
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x38]
push edx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
movsd dword es:[edi], dword [esi]
push dword [ebp + 0x14]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00402c28
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
add eax, 0x24
mov esi, dword [esp + 0x38]
push edi
push eax
lea eax, [esp + 0x54]
push esi
push eax
call fcn.00402d35
push 8
push dword [esp + 0x40]
lea eax, [esp + 0x64]
push eax
call fcn.00402bdd
lea eax, [esp + 0x78]
add esp, 0x38
xor edx, edx
mov dword [esp + 0x10], eax
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax + ecx]
xor eax, dword [esp + ecx + 0x20]
add ecx, 4
or edx, eax
cmp ecx, 0x10
jb 0x402b86
lea eax, [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [eax + ecx], 0
add ecx, 4
cmp ecx, 0x30
jb 0x402ba5
test edx, edx
je 0x402bca
push edi
push esi
call fcn.00402e2e
pop ecx
pop ecx
jmp 0x402b17
xor eax, eax
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.00401e48
mov esp, ebp
pop ebp
ret

Function at 0x402bdd
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
lea esi, [ebx + 0x10]
push 0x20
pop ebp
mov ecx, esi
sub edi, esi
mov edx, ebp
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x402bf5
push dword [esp + 0x1c]
push ebx
call fcn.00402ad1
pop ecx
pop ecx
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
sub ebp, 1
jne 0x402c0c
push dword [esp + 0x1c]
push ebx
call fcn.00402ad1
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402c28
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [0x406004]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push 0x30
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x4041f0]
mov ecx, dword [0x4041f4]
mov dword [esi], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 4], ecx
push 1
push esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
call fcn.00402ad1
mov ebp, dword [esp + 0x44]
add esp, 0x14
mov ebx, ebp
mov ecx, esi
sub ebx, esi
push 0x10
pop edi
mov edx, edi
mov al, byte [ebx + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x402c81
push dword [esp + 0x38]
push esi
call fcn.00402ad1
pop ecx
pop ecx
lea edx, [ebp + 0x10]
mov ecx, esi
sub edx, esi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x402c9f
push dword [esp + 0x38]
push esi
call fcn.00402ad1
mov ebx, dword [esp + 0x3c]
mov edx, ebx
xor byte [esi], 0x14
pop ecx
pop ecx
lea ecx, [esi + 1]
push 0xf
sub edx, ecx
pop edi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x402cc7
push 1
push esi
call fcn.00402ad1
pop ecx
pop ecx
lea edx, [ebx + 0xf]
mov ecx, esi
push 5
sub edx, esi
pop edi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x402ce6
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
lea ecx, [esi + 4]
push 8
mov dword [esp + 0x14], eax
sub edx, ecx
pop edi
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x402d0d
push 1
push esi
call fcn.00402ad1
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401e48
add esp, 0xc
ret

Function at 0x402e03
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
test edx, edx
je 0x402e2d
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x402e1d
pop edi
pop esi
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403e59
pop dword [ebp - 0x3c]
mov eax, 0xf4251f16
add eax, 0xc1b1f43
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xc8b78172
sub dword [ebp - 0x4c], 0x7a653c27
mov dword [ebp - 0x48], 0x1110d1a5
sub dword [ebp - 0x48], 0xdedd8560
mov dword [ebp - 0x44], 0xfa60fe9d
add dword [ebp - 0x44], 0x51eb4591
mov dword [ebp - 0x40], 0xe016cb32
add dword [ebp - 0x40], 0x1fe934ce
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xa3f7983e
sub eax, 0xa3b717b2
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4f219ab3
sub dword [ebp - 0x4c], 0xdaaf315d
mov dword [ebp - 0x48], 0x60c79791
add dword [ebp - 0x48], 0xe0a4c9e4
mov dword [ebp - 0x44], 0xead59641
sub dword [ebp - 0x44], 0x876629d5
mov dword [ebp - 0x40], 0xdf1bb5f9
sub dword [ebp - 0x40], 0xdf1bb5f9
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x62ca9a15
sub eax, 0x628a1941
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x33c89
push 0
call eax
mov ecx, 0x3c25
xor edi, edi
add edi, eax
mov edx, 0xf107953b
add edx, 0xf397ac5
add edx, dword [ebp - 0x3c]
mov esi, 0x53034018
sub esi, 0xc8831af8
sub dword [ebp - 4], ebx
mov ebx, dword [edx]
mov dword [ebp - 0x28], 0xb65b2254
xor ebx, esi
add dword [ebp - 8], 0x14f14265
mov dword [edi], ebx
sub dword [ebp - 0x10], esi
add edi, 0x363fcf29
add edi, 0xc9c030db
add edx, 0x9aa14bc4
sub edx, 0x9aa14bc0
loop 0x403f77
add eax, 0x4453b174
sub eax, 0x4452ce0d
mov ebx, eax
add eax, 0xaf5e6b86
sub eax, 0xaf5e6b81
mov ecx, 0x9ee17b49
sub ecx, 0x9ea17b49
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1001f5b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001f78
push 0
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x1001f7b
and eax, 0x10
ret 4

Function at 0x100264f
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
jne 0x1002660
call fcn.01002623
cmp eax, 2
jne 0x100269e
test byte [esp + 4], 4
jne 0x1002683
push 4
push 0x40
push 0
push 0x1001251
push 0x522
push 0
call fcn.01005662
cmp eax, 6
jne 0x100269e
cmp word [0x100aa64], 0
jne 0x1002699
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x100269e
call fcn.01005662
ret 4

Function at 0x1002b44
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
mov cl, byte [edi]
test cl, cl
je 0x1002ba9
push ebx
push esi
lea esi, [edi + 1]
mov al, byte [esi]
xor ebx, ebx
cmp al, 0x3a
jne 0x1002b67
cmp byte [edi + 2], 0x5c
jne 0x1002b67
lea esi, [edi + 3]
jmp 0x1002ba2
cmp cl, 0x5c
jne 0x1002ba2
cmp al, cl
jne 0x1002ba2
push 2
lea esi, [edi + 2]
pop ebx
jmp 0x1002ba2
cmp byte [esi], 0x5c
jne 0x1002b99
cmp byte [esi - 1], 0x3a
je 0x1002b99
test ebx, ebx
je 0x1002b8a
dec ebx
jmp 0x1002b99
and byte [esi], 0
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0
jne 0x1002b78
pop esi
pop ebx
pop edi
ret 4

Function at 0x1002ebf
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
sub esp, 0x104
push ebp
push esi
mov esi, dword [0x100ac40]
xor ebp, ebp
cmp esi, ebp
push edi
mov edi, esi
je 0x1002f13
push ebx
mov ebx, dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [0x100b884], ebp
jne 0x1002f02
cmp dword [0x100b490], ebp
jne 0x1002f02
push 0x80
push dword [esi]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.kernel32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x1002edd
pop ebx
cmp dword [0x100b880], ebp
je 0x1002f63
cmp dword [0x100b884], ebp
jne 0x1002f63
cmp dword [0x100b490], ebp
jne 0x1002f63
push 0x100ac44
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1002f4e
lea eax, [esp + 0xc]
push eax
call fcn.01005bf7
push 0x1001284
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
call fcn.01005662
cmp word [0x100aa64], 1
je 0x1002f7a
cmp dword [0x100b880], ebp
je 0x1002f7a
call fcn.01005662
pop edi
pop esi
mov dword [0x100b880], ebp
pop ebp
add esp, 0x104
ret
Function at 0x1002f8a
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
push edi
lea eax, [esp + 0x14]
push 0x1001348
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
inc edi
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005bb8
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryA]
je 0x1003025
cmp edi, 0x190
jl 0x1002f9f
push esi
push 0
push 0x1001344
push dword [esp + 0x124]
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x1003016
xor ebp, ebp
push esi
inc ebp
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 8
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1002fee
xor eax, eax
inc eax
mov dword [0x100b880], eax
mov ebp, eax
jmp 0x1003016

Function at 0x1003e8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push ebx
call dword [sym.imp.kernel32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1003ecc
push ebp
push 0x10
push ebp
push ebp
push 0x4b5
push ebp
call fcn.01005662
call fcn.01003573
mov dword [0x100aa5c], eax
xor eax, eax
jmp 0x1003f33
push edi
push ebx
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
push 0x10013c4
push esi
call fcn.01005bb8
push ebp
push 0x4000080
push 1
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1003f26
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1003f26
test al, 0x10
je 0x1003f26
xor eax, eax
mov dword [0x100aa5c], ebp
inc eax
jmp 0x1003f32
call fcn.01003573
mov dword [0x100aa5c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1003f39
Capabilities:
Get common file path
Get disk information
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
jne 0x1003f55
xor eax, eax
inc eax
jmp 0x1004139
push esi
push edi
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
call esi
test eax, eax
jne 0x1003f99
push ebx
push 0x10
push ebx
push ebx
push 0x4bc
push ebx
call fcn.01005662
call fcn.01003573
mov dword [0x100aa5c], eax
xor eax, eax
jmp 0x1004137
lea eax, [ebp - 4]
push eax
push ebx
call fcn.01005662
mov edi, eax
cmp edi, ebx
jne 0x1003ffe
push 0x7f
mov byte [ebp - 0x318], bl
xor eax, eax
pop ecx
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01003573
push ebx
mov dword [0x100aa5c], eax
push 0x200
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ebx
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageA]
push ebx
push 0x10
lea eax, [ebp - 0x318]
push eax
push dword [ebp + 8]
push 0x4b0
jmp 0x1004067
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
test eax, eax
jne 0x100407b
push 0x7f
mov byte [ebp - 0x318], bl
pop ecx
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01003573
push ebx
mov dword [0x100aa5c], eax
push 0x200
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ebx
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageA]
push ebx
push 0x10
lea eax, [ebp - 0x318]
push eax
push dword [ebp + 8]
push 0x4f9
push ebx
call fcn.01005662
lea eax, [ebp - 0x118]
push eax
call esi
jmp 0x1003f92
lea eax, [ebp - 0x118]
push eax
call esi
push 3
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_lstrcpynA]
mov ecx, 0x200
xor eax, eax
cmp dword [ebp - 4], ecx
je 0x10040a8
shl ecx, 1
inc eax
cmp ax, 8
jb 0x100409a
cmp ax, 8
jne 0x10040c3
push ebx
push 0x10
push ebx
push ebx
push 0x4c5
push ebx
call fcn.01005662
jmp 0x1003f92
test byte [0x100b494], 8
je 0x10040ed
test byte [ebp - 0xf], 0x80
je 0x10040ed
mov edx, dword [0x100b498]
movzx eax, ax
mov eax, dword [eax*4 + 0x100bbc0]
mov ecx, edx
shr ecx, 2
shl eax, 1
add ecx, edx
jmp 0x10040fd
mov ecx, dword [0x100b498]
movzx eax, ax
mov eax, dword [eax*4 + 0x100bbc0]
mov esi, dword [ebp + 0xc]
and esi, 1
je 0x1004122
test byte [ebp + 0xc], 2
je 0x1004122
lea edx, [ecx + eax]
cmp edx, edi
jbe 0x100412e
lea edx, [ebp - 0xc]
push edx
push ecx
push eax
push dword [ebp + 0x10]
call fcn.01005662
jmp 0x1004137
cmp esi, ebx
je 0x100412a
cmp eax, edi
jmp 0x1004110
cmp ecx, edi
jmp 0x1004110
xor eax, eax
mov dword [0x100aa5c], ebx
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004835
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
inc ebx
push esi
mov edi, ebx
call fcn.01005c50
test eax, eax
jne 0x100484f
mov eax, ebx
jmp 0x10048aa
cmp dword [0x100ac3c], 0
jne 0x100489c
test byte [0x100b898], bl
jne 0x100489c
push 6
push 0
push 0x1003869
push dword [0x100aa4c]
mov dword [0x100ae64], esi
push 0x7d3
push dword [0x100b4a4]
call fcn.01005662
sub eax, 6
je 0x100489a
dec eax
je 0x10048b0
sub eax, 0x832
jne 0x100489c
mov dword [0x100ac3c], ebx
mov edi, ebx
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
xor edi, edi
jmp 0x10048a8

Function at 0x1004b46
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004bd3
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.01002f8a
test eax, eax
je 0x1004c3c
lea eax, [ebp - 0x128]
push eax
mov esi, 0x100ac44
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1004bc6
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004bbb
dec eax
je 0x1004bb4
dec eax
je 0x1004bad
dec eax
jne 0x1004bc6
push 0x1001400
jmp 0x1004bc0
push 0x10013f8
jmp 0x1004bc0
push 0x10013f0
jmp 0x1004bc0
push 0x10013e8
push esi
call fcn.01005bb8
push 0x1001251
push esi
call fcn.01005bb8
jmp 0x1004be2
push dword [ebp + 8]
mov esi, 0x100ac44
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
push esi
call fcn.01003e8c
test eax, eax
jne 0x1004c02
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x1004c1b
mov dword [0x100b880], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01005662
test eax, eax
je 0x1004c27
xor eax, eax
mov dword [0x100aa5c], ebx
inc eax
jmp 0x1004c3e
call fcn.01003573
mov dword [0x100aa5c], eax
jmp 0x1004c3c
cmp dword [0x100b880], ebx
je 0x1004c3c
push esi
mov dword [0x100b880], ebx
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x1005662
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1005671
pop dword [ebp - 0x3c]
mov eax, 0x1005671
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x98246cc8
sub dword [ebp - 0x4c], 0x49d2277d
mov dword [ebp - 0x48], 0x41ea17d1
add dword [ebp - 0x48], 0xf0493474
mov dword [ebp - 0x44], 0x11e30fc2
add dword [ebp - 0x44], 0x3a69346c
mov dword [ebp - 0x40], 0x8b16cabe
add dword [ebp - 0x40], 0x74e93542
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xec37dc0
sub dword [ebp - 0x4c], 0x9a51146a
mov dword [ebp - 0x48], 0xd00fa58e
add dword [ebp - 0x48], 0x715cbbe7
mov dword [ebp - 0x44], 0x7637d750
add dword [ebp - 0x44], 0xed37951c
mov dword [ebp - 0x40], 0xa48d7e30
add dword [ebp - 0x40], 0x5b7281d0
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xf2c23e2b
add eax, 0xe3dd295
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x35283
push 0
call eax
mov ecx, 0x3f65
mov esi, eax
mov edi, 0x10e6000
add edi, dword [ebp - 0x3c]
mov edx, 0xc33cd115
sub edx, 0x7fbaade8
xor dword [ebp - 0x10], edi
mov ebx, dword [edi]
sub dword [ebp - 0x38], edx
xor ebx, edx
add dword [ebp - 8], edx
mov dword [esi], ebx
xor dword [ebp - 0x10], edx
add esi, 4
add edi, 0x24df62f1
add edi, 0xdb209d13
loop 0x100577d
add eax, 0xf067
mov ebx, eax
add eax, 0xae96842a
add eax, 0x51697bdb
mov ecx, 0xd5f76794
add ecx, 0x2b08986c
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x1005ae4
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005b0b
inc esi
mov al, byte [esi]
test al, al
je 0x1005b04
cmp al, 0x22
jne 0x1005af9
cmp byte [esi], 0x22
jne 0x1005b1c
jmp 0x1005b1b
cmp al, 0x20
jle 0x1005b1c
inc esi
cmp byte [esi], 0x20
jg 0x1005b0f
jmp 0x1005b1c
cmp al, 0x20
jg 0x1005b22
inc esi
mov al, byte [esi]
test al, al
jne 0x1005b17
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005b3c
movzx eax, word [ebp - 0x14]
jmp 0x1005b3f
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1005c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005c63
xor eax, eax
jmp 0x1005c6b
shr eax, 4
not eax
and eax, 1
ret 4
Function at 0x1005da8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
and dword [ebp + 0x74], 0
cmp dword [0x100a2cc], 0xfffffffe
mov dword [ebp + 0x6c], 0xc
jne 0x1005e8f
and dword [0x100a2cc], 0
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x1005e8f
cmp dword [ebp - 0x28], 1
jne 0x1005e8f
cmp dword [ebp - 0x34], 4
jne 0x1005e8f
cmp dword [ebp - 0x30], 0xa
jae 0x1005e8f
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1005e8f
lea eax, [ebp + 0x70]
push eax
push 0x20019
push 0
push 0x1001498
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e8f
push edi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x1001251
push dword [ebp + 0x70]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp + 0x70]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1005e8f
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.01005ca2
test eax, eax
je 0x1005e8f
and dword [ebp + 0x74], 0x3ff
cmp dword [ebp + 0x74], 1
je 0x1005e85
cmp dword [ebp + 0x74], 0xd
jne 0x1005e8f
mov dword [0x100a2cc], 1
mov eax, dword [0x100a2cc]
add ebp, 0x78
leave
ret

Function at 0x1005e99
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1005ecf
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005ed3
xor eax, eax
jmp 0x1005ee9
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_MulDiv]
leave
ret 4

Function at 0x1007115
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007150
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x100712d
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x100716c
dec esi
je 0x1007165
dec esi
jne 0x1007171
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc