joyce8/EMBER2024-capa huggingface dataset:
Function at 0x730202ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
push edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi + 0x1c]
call fcn.7301d4be
mov ecx, dword [edi + 0x1c]
lea eax, [ebp - 4]
push eax
call fcn.7301d50a
mov edi, eax
test edi, edi
jns 0x73041488
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 0x121
test esi, esi
jne 0x73041498
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call 0x7304159d

Function at 0x73020355
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
test esi, esi
je 0x73020365
cmp dword [esi], 0
jne 0x730414a5
pop esi
ret

Function at 0x7302050e
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x18], eax
push esi
mov esi, ecx
mov dword [ebp - 0xc], ecx
push edi
mov ebx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], esi
test byte [0x7308c948], 0x10
mov edi, 0x73008a10
jne 0x730414f7
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x73020558
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x73020561
mov dword [eax], ecx
test byte [0x7308c948], 0x10
jne 0x7304150c
cmp dword [ebp + 0xc], ebx
je 0x7304151e
test eax, eax
je 0x7304152f
call 0x73019d07
test eax, eax
jne 0x73041540
lea ecx, [ebp - 0x14]
call fcn.7301f6d2
mov esi, dword [ebp - 0x14]
mov edi, eax
test edi, edi
js 0x7304156d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.7301f56c
mov edi, eax
test edi, edi
js 0x73041579
cmp dword [esi + 0xc], ebx
je 0x730205d6
mov edx, esi
mov ecx, 0x73037c10
call fcn.730189b4
mov edi, eax
test edi, edi
js 0x73041585
cmp dword [esi + 8], ebx
add byte [eax], al
fcomp dword [edx + 0x20]
jae 0x73041515
add byte [eax], al
add byte [eax + 0x5c], cl

Function at 0x7302067c
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0xffffffffffffffff
mov edi, edx
mov dword [ebp - 4], ebx
push dword [esi + 0x28]
call dword [0x7308d1f0]
test eax, eax
jne 0x730415cb
mov eax, dword [esi + 0x20]
test eax, eax
jns 0x730415dc
mov dword [ebp - 4], 0x13b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ecx], eax
add byte [eax], al
Function at 0x73020e25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push esi
push edi
test byte [0x7308c948], 0x10
mov edi, 0x730044f8
jne 0x730419bc
push dword [ebp + 8]
call dword [0x7308d274]
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.73020dc7
mov esi, dword [ebp - 8]
push esi
mov ecx, dword [esi + 0x18]
call fcn.73014915
test byte [0x7308c948], 0x10
jne 0x730419ce
mov eax, dword [esi]
push esi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x7308d3fc]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.7302a750
mov esp, ebp
pop ebp
ret 0xc
or byte [ecx + 0x20], dh
add byte [eax], al
push 0x3d732071

Function at 0x73024a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
test byte [0x7308c948], 0x10
mov ebx, dword [ebp + 0xc]
jne 0x73041a85
lea eax, [ebp - 8]
mov ecx, esi
push eax
push 0xe
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.7301ee7a
mov edi, dword [ebp - 4]
mov esi, eax
test esi, esi
jne 0x73024abf
lea eax, [ebp - 0x14]
push eax
call dword [0x7308d234]
mov eax, dword [ebp - 0x14]
push ebx
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x10]
push edi

Function at 0x73024aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebx + 0x18], eax
call fcn.73024c8f
mov esi, eax
test esi, esi
jne 0x73024abf
cmp dword [ebp - 8], eax
je 0x73024abf
mov ecx, dword [ebp - 0xc]
push ebx
push edi
call fcn.73024d44
mov esi, eax
test edi, edi
je 0x73024aca
push edi
call dword [0x7308d17c]
test byte [0x7308c948], 0x10
jne 0x73041aa1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x73024b11
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
in al, 0x89
push ebp
in al, dx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x18], edx
test byte [0x7308c948], 0x10
jne 0x73041ab4
mov edi, dword [ebp + 8]
test edi, edi
je 0x73024c35
mov ecx, ebx
call fcn.7301eb2e
mov esi, eax
test esi, esi
jne 0x73024c35
mov eax, dword [ebx + 0x24]
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
mov esi, dword [eax]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [esi + 0xc]
add dword [ecx], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x73025766
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x730257a3
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x7302579c
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x730257a8
add edx, 0x28
cmp edx, esi
jne 0x7302578d
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x730257a5
Function at 0x730376b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x730376ee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x730376e6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x730376f0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x730376d6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x730377d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x730377e6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x73037801
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401940
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040f250
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call fcn.0040f8f0
mov dword [esp], 2
call fcn.0040f250
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xd41078]
test esi, esi
jle 0x401ac0
mov eax, dword [0xd4107c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4019d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a57
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019c0
mov dword [esp], ebx
call fcn.00402390
mov edi, eax
test eax, eax
je 0x401ae7
mov eax, dword [0xd4107c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004024d0
mov edx, dword [0xd4107c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ac7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a50
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a60
add dword [0xd41078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xd4107c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401940
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019de
mov eax, dword [0xd4107c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401940
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401940
lea esi, [esi]
nop
Function at 0x4a39b0
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
push ebp
mov edx, 0x400
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0xd8]
mov ebp, dword [esp + 0xdc]
mov eax, dword [0xd41044]
mov dword [esp + 0x6c], eax
xor eax, eax
mov ebx, dword [esp + 0xe0]
mov edi, dword [esp + 0xe4]
mov eax, esi
call fcn.00419c30
mov edx, 0xd3bd10
mov eax, esi
call fcn.0042b5b0
mov edx, 0x400
mov eax, ebp
call fcn.00419bd0
mov edx, dword [ebx]
mov eax, dword [edi]
mov ecx, 3
fld dword [0xd3c400]
mov dword [esp + 0x2c], 8
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 8
fstp qword [esp + 0x30]
fld dword [0xd3c3fc]
mov dword [esp + 0x20], 8
mov dword [esp + 0x1c], 6
fstp qword [esp + 0x14]
fld dword [0xd3c40c]
mov dword [esp + 8], 0x9c
mov dword [esp + 0x3c], edx
mov edx, 9
fstp qword [esp + 0xc]
fld dword [0xd3c3f8]
mov dword [esp + 0x50], 4
mov dword [esp + 0x4c], 9
fstp qword [esp]
mov dword [esp + 0x48], 3
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0x34
call fcn.0041d650
mov dword [ebx], eax
mov eax, dword [esp + 0x6c]
sub eax, dword [0xd41044]
jne 0x4a3aae
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4bf090
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd41044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xbc]
mov esi, dword [esp + 0xc0]
mov dword [esp + 0x3c], eax
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd41044]
jne 0x4bf259
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x74], eax
mov eax, dword [esp]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004bcf40
call fcn.00401690
nop
nop
Function at 0x535570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd41044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov esi, dword [esp + 0xb8]
mov edi, dword [esp + 0xbc]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd41044]
jne 0x53570f
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xbc], edi
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xb8], esi
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xac], edx
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00534de0
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x542620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd41044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov esi, dword [esp + 0xb8]
mov edi, dword [esp + 0xbc]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd41044]
jne 0x5427bf
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xbc], edi
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xb8], esi
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xac], edx
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00542000
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x58e2a0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0xd41044]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
not eax
cmp esi, 3
jbe 0x58e380
lea edx, [esi - 4]
shr edx, 2
lea ebx, [ecx + edx*4 + 4]
nop
mov edx, eax
xor al, byte [ecx]
add ecx, 4
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa892c0]
mov eax, edx
xor dl, byte [ecx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa892c0]
mov edx, eax
xor al, byte [ecx - 2]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa892c0]
mov eax, edx
xor dl, byte [ecx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa892c0]
cmp ecx, ebx
jne 0x58e2d0
and esi, 3
test esi, esi
je 0x58e366
mov edx, eax
xor al, byte [ebx]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa892c0]
mov eax, edx
cmp esi, 1
je 0x58e366
xor al, byte [ebx + 1]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa892c0]
mov eax, edx
cmp esi, 2
je 0x58e366
xor al, byte [ebx + 2]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa892c0]
mov eax, edx
not eax
mov edx, dword [esp + 0xc]
sub edx, dword [0xd41044]
jne 0x58e384
add esp, 0x14
pop ebx
pop esi
ret
mov ebx, ecx
jmp 0x58e321
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
Function at 0x5acd40
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x22c
movzx ebx, byte [esi]
mov eax, dword [0xd41044]
mov dword [esp + 0x21c], eax
xor eax, eax
lea ebp, [esp + 0x1b]
cmp bl, 0x40
jg 0x5ace10
lea edi, [esp + 0x1c]
mov ecx, ebp
xor eax, eax
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
sub ecx, edi
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
test bl, bl
je 0x5acdf0
xor edi, edi
jmp 0x5acdcc
cmp bl, 0x5c
je 0x5acdd1
mov dword [esp], edi
add esi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov byte [esp + eax + 0x1a], bl
mov edi, eax
movzx ebx, byte [esi]
cmp eax, 0x200
je 0x5acdf0
test bl, bl
je 0x5acdf0
cmp bl, 0x2f
jne 0x5acda0
test edi, edi
je 0x5acda5
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5acf10
movzx ebx, byte [esi]
jmp 0x5acda5
xor eax, eax
mov edx, dword [esp + 0x21c]
sub edx, dword [0xd41044]
jne 0x5acf3d
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bl, 0x5a
jg 0x5ace50
cmp byte [esi + 1], 0x3a
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
je 0x5ace78
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x5acd96
lea eax, [ebx - 0x61]
cmp al, 0x19
jbe 0x5ace15
mov dword [esp + 0x1b], 0
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x218], 0
jmp 0x5ace34
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
lea edi, [esi + 2]
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0x3a
movzx esi, byte [esi + 2]
mov eax, esi
test al, al
je 0x5acdf0
mov ebx, 2
jmp 0x5acee8
cmp al, 0x5c
je 0x5aceee
mov dword [esp], ebx
add edi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov ebx, eax
mov eax, esi
movzx esi, byte [edi]
mov byte [esp + ebx + 0x1a], al
mov eax, esi
test al, al
je 0x5acdf0
cmp ebx, 0x200
je 0x5acdf0
mov eax, esi
cmp al, 0x2f
jne 0x5aceb0
cmp ebx, 2
je 0x5aceb4
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5acf30
movzx esi, byte [edi]
jmp 0x5aceb4
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5acde7
mov eax, 0xffffffe9
jmp 0x5acdf2
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5acf01
jmp 0x5acf1f
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x41972c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41993a
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4197f8
mov eax, dword [0x41ccc8]
cmp byte [eax + 0x915], 0
jne 0x4197f8
lea edx, [ebp - 4]
mov eax, edi
call fcn.0040af0c
mov edx, dword [ebp - 4]
mov eax, 0x419950
call fcn.00405074
test eax, eax
jne 0x41979c
push ebx
push 0x41995c
push 0x41995c
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404df0
jmp 0x4197c0
mov al, byte [0x419960]
push eax
lea eax, [ebp - 8]
push eax
mov edx, 0x419950
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0040caa8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404b2c
push 0x40010
push 0
mov eax, dword [ebp - 4]
call fcn.00404f30
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x41caf0]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [0xe1f534]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0xe1f538]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x41ccc8]
cmp byte [eax], 1
jne 0x41989b
mov eax, dword [0x41ccc8]
cmp byte [eax + 0x917], 2
je 0x41989b
mov eax, dword [0xe1f524]
call fcn.00405844
mov esi, eax
test esi, esi
jl 0x419877
inc esi
xor ebx, ebx
mov eax, dword [0xe1f524]
mov eax, dword [eax + ebx*4]
xor edx, edx
call fcn.004084b4
mov eax, dword [0x41ccc8]
mov al, byte [eax + 0x917]
sub al, 1
jb 0x41984d
je 0x41985c
jmp 0x419873
mov eax, dword [0xe1f524]
mov eax, dword [eax + ebx*4]
call fcn.004085d8
jmp 0x419873
push 4
push 0
mov eax, dword [0xe1f524]
mov eax, dword [eax + ebx*4]
call fcn.00404f30
push eax
call sub.kernel32.dll_MoveFileExA
inc ebx
dec esi
jne 0x41982b
mov eax, dword [0xe1f528]
call fcn.00405844
mov ebx, eax
cmp ebx, 0
jl 0x41989b
mov eax, dword [0xe1f528]
mov eax, dword [eax + ebx*4]
call fcn.004196b4
dec ebx
cmp ebx, 0xffffffff
jne 0x419888
test edi, edi
jne 0x419904
cmp dword [0x41cae8], 0
je 0x419904
push 0
push 0
push 0x41996c
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402e74
push dword [ebp - 0x10]
push 0x41996c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404df0
mov eax, dword [ebp - 0xc]
call fcn.00404f30
push eax
mov eax, dword [0x41cae8]
call fcn.00404f30
push eax
push 0x419970
push 0
call fcn.0040d670
push 4
push 0
mov eax, dword [0x41cae8]
call fcn.00404f30
push eax
call sub.kernel32.dll_MoveFileExA
cmp dword [0x41cb04], 0
je 0x419918
mov eax, dword [0x41cb04]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
call fcn.00404a7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419941
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ab8
ret