joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00406dc2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00406dc2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00406dc2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00406dc2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00406dc2
mov dword [0x41203c], eax
call fcn.00406dc2
test eax, eax
jge 0x402550
push 8
call fcn.00406dc2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00406dc2
pop ecx
push 1
call fcn.00406dc2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00406dc2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00406dc2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00406dc2
jmp 0x402495

Function at 0x406dc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406dd1
pop dword [ebp - 0x28]
mov eax, 0x406dd1
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x36ca5
push 0
mov eax, 0xb7fa9aed
add eax, 0x484645eb
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x1d4c43d1
sub ecx, 0x1d4c05d6
xor ebx, ebx
add ebx, eax
mov esi, 0xaaa82475
add esi, 0x5599174f
add esi, dword [ebp - 0x28]
mov edx, 0x91c86301
mov edi, dword [esi]
xor dword [ebp - 8], 0xb4bc4210
xor edi, edx
sub dword [ebp - 0x10], 0x2ca9d4f9
mov dword [ebx], edi
add dword [ebp - 0xc], 0x3afe3f0e
add ebx, 0x2a6a4097
sub ebx, 0x2a6a4093
add esi, 0x3c89a509
sub esi, 0x3c89a505
loop 0x406e27
add eax, 0x5cbadb2a
add eax, 0xa3460f95
xor ebx, ebx
add ebx, eax
add eax, 0x3c817c2d
add eax, 0xc37e83d8
mov ecx, 0x3994e151
add ecx, 0xc6ab1eaf
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00404502
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00404502
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00404502
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00404502
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00404502
mov dword [0x41203c], eax
call fcn.00404502
test eax, eax
jge 0x402550
push 8
call fcn.00404502
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00404502
pop ecx
push 1
call fcn.00404502
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00404502
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00404502
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00404502
jmp 0x402495

Function at 0x404502
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x404511
pop dword [ebp - 0x10]
mov eax, 0x404511
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x38eb6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x46e0
xor edx, edx
add edx, eax
mov edi, 0x8fc7de4f
sub edi, 0x8f86a28b
add edi, dword [ebp - 0x10]
mov esi, 0xef5d6892
xor dword [ebp - 8], 0x90c969a1
mov ebx, dword [edi]
sub dword [ebp - 4], ecx
sub ebx, esi
sub dword [ebp - 8], 0x70d73337
mov dword [edx], ebx
xor dword [ebp - 0xc], ecx
add edx, 0x76339d97
sub edx, 0x76339d93
add edi, 0xd9267ef4
sub edi, 0xd9267ef0
loop 0x40455c
add eax, 0x10e53
xor ebx, ebx
add ebx, eax
add eax, 0x7424c723
sub eax, 0x7424c71e
mov ecx, 0x81e070fd
sub ecx, 0x81a070fd
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40633c
pop dword [ebp - 0x1c]
mov eax, 0x5417f72c
add eax, 0xac286c10
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x58e19c44
add dword [ebp - 0x2c], 0xf570a907
mov dword [ebp - 0x28], 0x36c20a86
add dword [ebp - 0x28], 0xfb7141bf
mov dword [ebp - 0x24], 0x97d7d469
sub dword [ebp - 0x24], 0x4b8b903b
mov dword [ebp - 0x20], 0x1da218ce
add dword [ebp - 0x20], 0xe25de732
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x3fd71bbe
add dword [ebp - 0x2c], 0x349b4d98
mov dword [ebp - 0x28], 0x5143ab85
add dword [ebp - 0x28], 0xf028b5f0
mov dword [ebp - 0x24], 0x89f0c0a
add dword [ebp - 0x24], 0x5ad06062
mov dword [ebp - 0x20], 0xb1a5a81e
add dword [ebp - 0x20], 0x4e5a57e2
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37fcd
push 0
call eax
mov ecx, 0x4d7a
mov edx, eax
mov ebx, 0xdf154d95
add ebx, 0x212bb26b
add ebx, dword [ebp - 0x1c]
mov edi, 0x3c7a3907
add edi, 0x78eacceb
sub dword [ebp - 8], 0x6dc0b8ea
mov esi, dword [ebx]
add dword [ebp - 8], 0x1cd2702f
xor esi, edi
sub dword [ebp - 0x18], edi
mov dword [edx], esi
sub dword [ebp - 0x14], eax
add edx, 0xa372397b
add edx, 0x5c8dc689
add ebx, 0x19c8b4b3
add ebx, 0xe6374b51
loop 0x40644e
add eax, 0xe2a74229
add eax, 0x1d59e692
mov ebx, eax
add eax, 0x192f87a8
add eax, 0xe6d0785d
mov ecx, 0x53aa8316
sub ecx, 0x536a8316
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040632d
jmp 0x406676

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x1127c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x112ab
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.000116d0
jmp 0x112c9
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00011204
mov edi, eax
test ebx, ebx
je 0x112c9
cmp dword [esi], 0
je 0x112c9
dec ebx
jmp 0x112b2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x11330
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1601c], 0x8088405
inc edx
mov dword [0x1601c], edx
mul edx
mov eax, edx
ret

Function at 0x11348
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1601c], 0x8088405
inc edx
mov dword [0x1601c], edx
fld qword [0x15038]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
ret

Function at 0x11fb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.000118fc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete byte [ebp - 1]
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x12060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x120a8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.000118fc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x120a8
cmp dword [ebp - 0x10], 4
je 0x120ad
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x12114
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x12148
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.000118fc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x1214c
xor eax, eax
jmp 0x1214e
mov al, 1
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x12158
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x12186
mov eax, dword [ebp - 8]
call fcn.000118fc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x12190
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x121b9
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x12630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x126b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x126c0
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.0001127c
mov eax, dword [ebp - 0x10c]
call fcn.000118fc
lea edx, [ebp - 0x105]
call fcn.000125ac
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x126b7
lea eax, [ebp - 0x10c]
call fcn.000115ec
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403203
pop dword [ebp - 0xc]
mov eax, 0x403203
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x52124cc
add dword [ebp - 0x1c], 0x4931207f
mov dword [ebp - 0x18], 0xe96f94f6
add dword [ebp - 0x18], 0x48c3b74f
mov dword [ebp - 0x14], 0x519a0f8b
add dword [ebp - 0x14], 0xfab234a3
mov dword [ebp - 0x10], 0x7c9cd48f
sub dword [ebp - 0x10], 0x7c9cd48f
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x231a41d8
add eax, 0xdd263eb4
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xda77a66b
add dword [ebp - 0x1c], 0x99fac2eb
mov dword [ebp - 0x18], 0x45e6382f
add dword [ebp - 0x18], 0xfb862946
mov dword [ebp - 0x14], 0xa62a15b5
sub dword [ebp - 0x14], 0x42baa949
mov dword [ebp - 0x10], 0x70a84ec4
add dword [ebp - 0x10], 0x8f57b13c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x37d62b00
sub eax, 0x3795aa2c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3609d
push 0
call eax
mov ecx, 0x7e6098c3
sub ecx, 0x7e6052fc
xor edx, edx
add edx, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0xc]
mov esi, 0xb4eb8cf8
xor dword [ebp - 4], edi
mov edi, dword [ebx]
sub dword [ebp - 4], esi
add edi, esi
xor dword [ebp - 8], 0x177855ea
mov dword [edx], edi
mov dword [ebp - 4], 0xb5dd0991
add edx, 0x6dfb3627
sub edx, 0x6dfb3623
add ebx, 0x671eaf68
add ebx, 0x98e1509c
loop 0x403316
add eax, 0x7befae56
sub eax, 0x7beea467
mov ebx, eax
add eax, 5
mov ecx, 0xb3afa68a
add ecx, 0x4c905976
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x418100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00405a30
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [esp + 8]
sub edx, 0x41
lea ebx, [esp + 4]
call fcn.00414a90
mov ebx, dword [esp + 4]
call fcn.00414b90
cmp eax, 0xffffffff
jne 0x41817f
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret
push esi
call fcn.00417ed0
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret

Function at 0x4027e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [0x403050]
test eax, eax
je 0x4027fd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x61616161
push eax
mov dword [ebp - 0x44], 0x61616161
mov dword [ebp - 0x40], 0x61616161
mov dword [ebp - 0x3c], 0x61616161
mov dword [ebp - 0x38], 0x61616161
mov dword [ebp - 0x34], 0x61616161
mov dword [ebp - 0x30], 0x61616161
mov dword [ebp - 0x2c], 0x61616161
mov byte [ebp - 0x28], 0
call sub.KERNEL32.DLL_FindAtomA
add esp, 0xc
test ax, ax
jne 0x402954
sub esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x78]
push 0x14
call sub.msvcrt.dll_malloc
lea ecx, [ebp - 0xa8]
mov dword [0x403050], eax
add esp, 0x10
mov dword [eax], 0
mov edx, eax
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 4], sub.msvcrt.dll_abort
mov dword [eax + 8], sub.msvcrt.dll_abort
mov edi, ecx
test eax, eax
jne 0x402940
lea ecx, [ebp - 0xa7]
mov byte [ebp - 0xa8], 0x30
cmp ecx, edi
jbe 0x4028bb
lea esi, [esi]
dec ecx
inc esi
mov al, byte [ecx]
mov byte [ebx], al
inc ebx
cmp ecx, edi
ja 0x4028b0
mov eax, 0x20
mov byte [ebx], 0
sub eax, esi
push edi
lea edx, [ebp - 0x48]
push eax
push 0x61
push edx
call sub.msvcrt.dll_memset
add esp, 0x10
xor edx, edx
cmp edx, esi
jae 0x4028f6
nop
lea esi, [esi]
mov eax, edx
sub eax, esi
cmp byte [ebp + edx - 0x78], 0x30
je 0x402935
mov cl, 0x41
inc edx
mov byte [ebp + eax - 0x28], cl
cmp edx, esi
jb 0x4028e0
sub esp, 0xc
lea eax, [ebp - 0x48]
mov byte [ebp - 0x28], 0
push eax
call sub.KERNEL32.DLL_AddAtomA
add esp, 0xc
mov edx, dword [0x403050]
lea eax, [edx + 4]
mov dword [0x403054], eax
lea eax, [edx + 8]
mov dword [0x403058], eax
lea eax, [edx + 0xc]
add edx, 0x10
mov dword [0x40305c], eax
mov dword [0x403060], edx
jmp 0x4027f5
mov cl, 0x61
jmp 0x4028ed
mov eax, edx
and eax, 1
add eax, 0x30
mov byte [ecx], al
inc ecx
shr edx, 1
jne 0x402940
jmp 0x4028a9
lea edx, [ebp - 0x48]
push ebx
and eax, 0xffff
push 0x21
push edx
push eax
call sub.KERNEL32.DLL_GetAtomNameA
xor edx, edx
pop ecx
lea esi, [esi]
cmp byte [ebp + edx - 0x48], 0x61
setne al
add eax, 0x30
mov byte [ebp + edx - 0x48], al
inc edx
cmp edx, 0x1f
jbe 0x402970
push eax
lea eax, [ebp - 0x48]
push 2
push 0
push eax
call sub.msvcrt.dll_strtoul
add esp, 0x10
mov dword [0x403050], eax
jmp 0x402909
Function at 0x401db8
Capabilities:
Encode data using xor

Disassembly:
push 0x401f10
call fcn.00401db2
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
bound edx, qword [ebp + 0x3aad3556]
fisttp word [eax - 0x41]
jo entry0
sbb bh, byte [edx - 0x2c]
sbb edi, edx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
dec ecx
add byte [esi + 0x4a018350], al
jne 0x401e5a
popal
add byte [ebp + 0x136], cl
add byte [eax], al
add dword [eax], eax
pop es
add byte [eax + 0x49], ah
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
Function at 0x405b6c
Capabilities:
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0040399a
adc ebp, dword [eax - 0x74b67942]
pop ss
fdivp st(7)
call dword [ebx]
test al, 0xbe
xchg byte [ecx - 0x75], cl
dec ecx
mov esi, dword [ebx + ecx*4]
xor al, 0x8b
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x405b87
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x405b87
call fcn.0040399a
sbb eax, 0x8b2d8ca8
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040399a
adc cl, ch
call 0x8b65b8d
push dword [ebp + 4]
push dword [ebp]
call fcn.0040419a
add byte [ebp + ecx + 0x68], dh
jl 0x405b7f
inc eax
add byte [esi - 0x18], dl
xchg esp, eax
or byte [eax], al
add bl, ch
push es
push edi
call fcn.00405d7b
cmp word [edi], 0
jne 0x405bfa
cmp word [0x456730], 0x5c
jne 0x405c05
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ccb
cmp word [ebp - 0x22c], 0x2e
jne 0x405c4f
cmp word [ebp - 0x22a], 0
je 0x405cae
cmp word [ebp - 0x22a], 0x2e
jne 0x405c4f
cmp word [ebp - 0x228], 0
je 0x405cae
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040645a
test byte [ebp - 0x258], 0x10
je 0x405c7a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405cae
push dword [ebp + 0xc]
push edi
call fcn.00405b6c
jmp 0x405cae
push dword [ebp - 4]
push edi
call fcn.00405b24
test eax, eax
jne 0x405ca6
cmp dword [ebp - 4], eax
je 0x405c9e
push edi
push 0xfffffffffffffff1
call fcn.004054c2
push 0
push edi
call fcn.00406220
jmp 0x405cae
inc dword [0x4702e8]
jmp 0x405cae
push edi
push 0xfffffffffffffff2
call fcn.004054c2
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405c27
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405cd6
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405d28
cmp dword [ebp - 8], esi
jne 0x405cea
inc dword [0x4702e8]
jmp 0x405d28
push edi
call fcn.0040679d
test eax, eax
je 0x405d28
push edi
call fcn.00405d2f
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405b24
test eax, eax
jne 0x405d20
cmp dword [ebp - 4], esi
je 0x405ce2
push edi
push 0xfffffffffffffff1
call fcn.004054c2
push esi
push edi
call fcn.00406220
jmp 0x405d28
push edi
push 0xffffffffffffffe5
call fcn.004054c2
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10004cc0
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
mov eax, 0x1001e220
je 0x10004cd0
mov eax, esi
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test esi, esi
je 0x10004cf9
mov al, byte [esi - 1]
test al, al
je 0x10004cef
cmp al, 0xff
je 0x10004cef
dec al
mov byte [esi - 1], al
pop esi
ret
dec esi
push esi
call fcn.1001348e
add esp, 4
pop esi
ret

Function at 0x10005730
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
add edx, 0xfffffffc
xor ecx, ecx
test edx, edx
jl 0x10005754
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [ecx + esi]
add ecx, 4
xor eax, edi
cmp ecx, edx
jle 0x10005746
pop edi
pop esi
ret