joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ccf7e
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret 4

Function at 0x6dc000
Capabilities:
Execute syscall

Disassembly:
mov eax, dword [0x1000aae8]
lea edx, [esp + 4]
int 0x2e
ret 0x28

Function at 0x6ee1f8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001df38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
call dword [0x1001f040]
lea ecx, [esp + 4]
call fcn.006fabe0
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0
call fcn.006fabe0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
push edx
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call fcn.006fac04
mov eax, dword [esp + 0x28]
lea ecx, [esp + 8]
push eax
call fcn.006fac04
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 0x2c]
mov dword [esp + 0xc], ecx
lea ecx, [esi + 0x24]
lea edx, [esp + 4]
push edx
push 1
push eax
call fcn.006ef4f8
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
call dword [eax + 0x1c]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 2
call fcn.006fabda
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.006fabda
mov ecx, dword [esp + 0x14]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x6f8178
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x6f8193
cmp ebx, 8
jg 0x6f8193
mov eax, 1
jmp 0x6f8195
xor eax, eax
mov esi, dword [esp + 0x14]
push 0x10028540
push eax
push esi
call fcn.006f69d8
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x6f81cc
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x1002323a]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x10023238]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x1002323c]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x1002323e]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x6f822d
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x6f8239
cmp ebx, 8
jl 0x6f8239
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x6f82b2
cmp eax, 0xffffffff
je 0x6f82b2
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x6f827d
push esi
call fcn.006f84c8
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x6f8285
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x6f8618
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x6f885c
push ebx
cmp eax, 3
jb 0x6f8693
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
xor eax, eax
and edx, 0x3ff
mov al, byte [ecx + esi + 0x1af72]
and eax, 0x7fff
shl edx, 5
xor eax, edx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebp, ebp
je 0x6f86d5
mov edx, dword [esi + 0x6af84]
sub edx, ebp
cmp edx, 0x7efa
ja 0x6f86d5
mov eax, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6afa0]
cmp ecx, eax
jbe 0x6f86bd
mov dword [esi + 0x6afa0], eax
push ebp
push esi
call fcn.006f82c8
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x6f86d5
mov edi, eax
cmp edi, 3
jb 0x6f87ce
mov ecx, dword [esi + 0x6af84]
mov ebx, dword [esi + 0x6af88]
lea eax, [edi - 3]
sub ecx, ebx
push eax
push ecx
push esi
call fcn.006f79c8
mov edx, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6af98]
add esp, 0xc
sub edx, edi
mov ebx, eax
cmp edi, ecx
mov dword [esi + 0x6af90], edx
mov eax, edx
ja 0x6f877c
cmp eax, 3
jb 0x6f877c
dec edi
mov ebp, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
inc ebp
xor eax, eax
mov ecx, ebp
mov dword [esi + 0x6af84], ebp
and edx, 0x3ff
mov al, byte [esi + ecx + 0x1af72]
and ecx, 0x7fff
and eax, 0x7fff
shl edx, 5
xor eax, edx
dec edi
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x6f871c
jmp 0x6f87f8
mov edx, dword [esi + 0x6af84]
xor eax, eax
add edx, edi
push 0x1002859c
mov dword [esi + 0x6af84], edx
push 1
mov al, byte [edx + esi + 0x1af70]
lea ecx, [edx + esi]
xor edx, edx
mov dword [esi + 0x6af7c], eax
mov dl, byte [ecx + 0x1af71]
and eax, 0x3ff
and edx, 0x7fff
push esi
shl eax, 5
xor edx, eax
xor edi, edi
mov dword [esi + 0x6af7c], edx
call fcn.006f69d8
add esp, 0xc
jmp 0x6f87fe
mov eax, dword [esi + 0x6af84]
xor ecx, ecx
mov cl, byte [eax + esi + 0x1af70]
push ecx
push 0
push esi
call fcn.006f79c8
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
dec ecx
mov ebx, eax
mov dword [esi + 0x6af90], ecx
inc dword [esi + 0x6af84]
test ebx, ebx
je 0x6f8838
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x6f8815
lea ecx, [eax + esi + 0x1af70]
jmp 0x6f8817
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.006f7778
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x6f884d
push esi
call fcn.006f84c8
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x6f863c
pop ebx
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x6f886f
lea ecx, [eax + esi + 0x1af70]
jmp 0x6f8871
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.006f7778
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x6f9548
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x6f9553
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x6f9656
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10023288]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10023288]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10023288]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10023288]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10023288]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10023288]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10023288]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10023288]
xor eax, edx
inc ecx
dec edi
jne 0x6f956e
pop edi
test esi, esi
je 0x6f9678
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10023288]
xor eax, edx
inc ecx
dec esi
jne 0x6f965a
pop esi
pop ebx
not eax
ret
Function at 0x6f9838
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push esi
call dword [0x1001f064]
cmp eax, 1
je 0x6f9856
mov eax, 0x1000000
pop esi
add esp, 0x44
ret
lea eax, [esp + 0x14]
push eax
push esi
call dword [0x1001f0ec]
test eax, eax
jne 0x6f9870
mov eax, 0x200
pop esi
add esp, 0x44
ret
mov eax, dword [esp + 0x14]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x6f9883
mov ebp, 1
test al, 2
je 0x6f988a
or ebp, 2
test al, 4
je 0x6f9891
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x6f989b
or ebp, 0x10
test al, 0x20
je 0x6f98a2
or ebp, 0x20
test ecx, ecx
je 0x6f98ae
or ebp, 0x40000000
jmp 0x6f98b4
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x6f98c4
or ebp, 0x800000
push ebx
push edi
push 0
push esi
call dword [0x1001f004]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x6f9973
mov edi, dword [0x1001f008]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x1001f00c]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x60]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x58], 0x54ad
jne 0x6f9973
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x6f9973
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x6f996d
cmp eax, 0x454e
je 0x6f996d
cmp eax, 0x454c
je 0x6f996d
cmp eax, 0x4550
jne 0x6f9973
or ebp, 0x400000
mov eax, dword [esp + 0x5c]
pop edi
test eax, eax
pop ebx
je 0x6f997f
mov dword [eax], ebp
mov eax, dword [esp + 0x58]
pop ebp
test eax, eax
je 0x6f998e
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x58]
test esi, esi
je 0x6f99ce
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.006f9768
mov edx, dword [esp + 0x34]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.006f9768
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.006f9768
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x6f9a05
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call dword [0x1001f010]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov dword [esi], eax
xor eax, eax
pop esi
add esp, 0x44
ret

Function at 0x6fe878
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x705608
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x71a1b7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10020b8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [0x10022210]
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x71a1d0
push eax
call edi
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x71a1dd
push eax
call edi
mov dword [esi + 0x1c], ebx
mov eax, dword [esi + 0x154]
cmp eax, ebx
je 0x71a1f0
push eax
call edi
mov dword [esi + 0x154], ebx
mov eax, dword [esi + 0x158]
cmp eax, ebx
je 0x71a203
push eax
call edi
mov dword [esi + 0x158], ebx
mov eax, dword [esi + 0x15c]
cmp eax, ebx
je 0x71a216
push eax
call edi
mov dword [esi + 0x15c], ebx
add esi, 0x30
mov dword [esp + 0xc], esi
lea ecx, [esi + 0xd4]
mov dword [esp + 0x18], ebx
call fcn.0072fd30
lea ecx, [esi + 0x5c]
mov dword [esp + 0x18], 0xffffffff
call fcn.0072fc10
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x71a267
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10020bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [0x10022210]
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x71a280
push eax
call edi
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x71a28d
push eax
call edi
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x71a29a
push eax
call edi
mov dword [esi + 0x1c], ebx
add esi, 0x30
mov dword [esp + 0xc], esi
lea ecx, [esi + 0xd4]
mov dword [esp + 0x18], ebx
call fcn.0072fd30
lea ecx, [esi + 0x5c]
mov dword [esp + 0x18], 0xffffffff
call fcn.0072fc10
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x71c430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10020cc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push 0x160
call fcn.007375c0
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x18], ebx
je 0x71c51c
push ebp
lea ebp, [esi + 0x30]
push edi
mov edi, ebp
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x5c]
call fcn.0072f960
lea ecx, [edi + 0xd4]
mov byte [esp + 0x20], 1
call fcn.0072fd10
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, 0x48
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x154], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x150], ebx
mov edx, dword [esp + 0x28]
mov edi, ebp
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax]
inc ecx
mov dword [eax], ecx
mov ecx, 0x48
xor eax, eax
mov dword [esi + 0xc], edx
mov dword [esi], 0x160
rep stosd dword es:[edi], eax
mov dword [ebp], pe_nt_image_headers32
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x71fdf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
test edx, edx
jbe 0x71fe12
mov ecx, dword [esp + 4]
push esi
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
dec edx
jne 0x71fe02
pop esi
ret
Function at 0x730cb0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x7381f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xfd6e70
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfd6e7a
pushal
call 0xfd6e80
pop ebp
sub ebp, 0x10
sub ebp, 0xbd6e70
jmp 0xfd6e96
mov eax, 0xbd6e70
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0xdf8afe8f
xor byte [eax], dl
inc eax
dec ecx
jne 0xfd6ead
jmp 0xfd6ec0
add al, 0x42
add al, 6
mov bl, 0x8f
invalid
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0xff8ecd67
sub eax, 0xff4e9b64
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x3ba37e7e
add dword [ebp - 0x4c], 0x12aec6cd
mov dword [ebp - 0x48], 0xd7198437
sub dword [ebp - 0x48], 0xa4e637f2
mov dword [ebp - 0x44], 0xd69d24d3
add dword [ebp - 0x44], 0x75af1f5b
mov dword [ebp - 0x40], 0xe2974ad7
sub dword [ebp - 0x40], 0xe2974ad7
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4852190a
add eax, 0xb7ee6782
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x15b33143
sub dword [ebp - 0x4c], 0xa140c7ed
mov dword [ebp - 0x48], 0x5c58161c
sub dword [ebp - 0x48], 0x1aebb4a7
mov dword [ebp - 0x44], 0xd88026d1
sub dword [ebp - 0x44], 0x7510ba65
mov dword [ebp - 0x40], 0x10c8e52a
sub dword [ebp - 0x40], 0x10c8e52a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x375d1
push 0
call eax
mov ecx, 0xfd63c981
sub ecx, 0xfd637e6d
xor edi, edi
add edi, eax
mov esi, 0xd2e9bb8a
add esi, 0x2d575476
add esi, dword [ebp - 0x3c]
mov ebx, 0xea4012ea
add ebx, 0xd8799560
mov edx, dword [esi]
add dword [ebp - 0x18], 0x4ff177fe
xor edx, ebx
xor dword [ebp - 0x38], ecx
mov dword [edi], edx
sub dword [ebp - 0x1c], edi
add edi, 0x799efbe3
add edi, 0x86610421
add esi, 4
loop 0x403322
add eax, 0xf5b47785
sub eax, 0xf5b35862
xor ebx, ebx
add ebx, eax
add eax, 0x3fa84c40
add eax, 0xc057b3c5
mov ecx, 0x2d834007
sub ecx, 0x2d434007
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x7720c522
Capabilities:
Encode data using xor

Disassembly:
call 0x7720c49b
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x7720c4cb
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x7720c4e7
xor edx, 0
jmp 0x7720c4f2
xor edx, edx
jmp 0x7720c509
jmp 0x7720c515
xor eax, eax
push 0x8427d7c0
call 0x7720c522
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x7720c55e
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x7720c537
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x7720c575
add eax, 0
jno 0x7720c57a
add esi, 0
ret 0x10

Function at 0x7720d2e3
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x7720d305
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x7720d4a7
cmp edi, dword [ebp + 0x10]
jb 0x7720d4a7
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.7720cdcf
inc edi
jmp 0x7720d38e
jmp 0x7720d39b
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.7720cdcf
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.7720cdcf
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x7720d3ef
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x7720d3d3
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.7720d41d
add dword [eax], 0x39
jle 0x7720d3f9
sub al, 0xf5
mov ch, al
call fcn.7720d432
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10