joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4011b5
pop dword [ebp - 0x1c]
mov eax, 0x1ca43d56
add eax, 0xe39bd45f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x883b92bd
add dword [ebp - 0x2c], 0xc616b28e
mov dword [ebp - 0x28], 0xb16fdf7d
add dword [ebp - 0x28], 0x80c36cc8
mov dword [ebp - 0x24], 0x3db493cd
sub dword [ebp - 0x24], 0xf1684f9f
mov dword [ebp - 0x20], 0x390ca7c5
add dword [ebp - 0x20], 0xc6f3583b
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd54de248
sub dword [ebp - 0x2c], 0x60db78f2
mov dword [ebp - 0x28], 0x934afdda
add dword [ebp - 0x28], 0xae21639b
mov dword [ebp - 0x24], 0xec6568d6
add dword [ebp - 0x24], 0x770a0396
mov dword [ebp - 0x20], 0xc3044cf0
sub dword [ebp - 0x20], 0xc3044cf0
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b9f7
push 0
call eax
mov ecx, 0xb85ca7a4
sub ecx, 0xb85c5751
mov edx, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x1c]
mov edi, 0x6ce92081
add dword [ebp - 8], edi
mov esi, dword [ebx]
xor dword [ebp - 0x10], 0x9184f007
xor esi, edi
add dword [ebp - 0x18], 0x6cb2ab80
mov dword [edx], esi
add edx, 0x4019a968
add edx, 0xbfe6569c
add ebx, 0xe7de5670
add ebx, 0x1821a994
loop 0x4012c1
add eax, 0x1341f
mov ebx, eax
add eax, 5
mov ecx, 0xb1c18f25
add ecx, 0x4e7e70db
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x41bfc0
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
mov ax, word [0x482bfc]
mov eax, dword [0x485f88]
and eax, 0xa4c4ca32
mov ecx, dword [0x48ce8c]
imul ecx, eax
mov dword [0x48ce8c], ecx
mov eax, dword [0x4884d4]
mov ecx, dword [0x48b444]
xor ecx, eax
mov eax, dword [0x48eadc]
or eax, ecx
or eax, 0x96ad2df8
mov dword [0x48eadc], eax
mov eax, dword [0x48b92c]
imul eax, eax, 0xc6588a50
mov dword [0x48b92c], eax
mov dword [esp], esi
call fcn.0044e6c0
mov cx, word [0x483026]
or ecx, 0xc89b
mov word [0x483026], cx
mov cx, word [0x483eae]
movzx ecx, byte [eax + esi - 1]
cmp ecx, 0x22
jne 0x41c12c
mov ecx, dword [0x4875bc]
sar ecx, 9
imul ecx, ecx, 0x75b57dd1
add ecx, 0x3f91fd74
cmp ecx, 0x113aab0f
jg 0x41c06b
or dword [0x4869dc], 0xd07bef08
mov byte [esi], 0x22
mov ecx, dword [0x489b6c]
lea edx, [ecx - 1]
mov dword [0x489b6c], edx
mov dword [0x487340], ecx
mov byte [esi + eax - 1], 0
mov ecx, dword [0x4886c0]
mov edx, dword [0x48c2fc]
xor edx, ecx
or edx, 0x6feb73cb
mov dword [0x48cae4], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [0x48cd3c]
inc ecx
mov dword [0x48cd3c], ecx
xor ecx, 0x9962917
and dword [0x48b668], ecx
mov ecx, dword [0x48a0b0]
imul ecx, ecx, 0xa42461ac
mov dword [0x48a0b0], ecx
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x22
jne 0x41c0b0
mov ecx, dword [0x487bcc]
dec ecx
mov dword [0x487bcc], ecx
mov dx, word [0x482cec]
sub edx, ecx
mov word [0x482cec], dx
add esi, eax
mov eax, dword [0x4860d4]
cmp eax, 0x5943e752
jl 0x41c1f9
mov eax, dword [0x486370]
mov ecx, 0xea2f8968
sub ecx, eax
add dword [0x48ca68], ecx
jmp 0x41c1f9
mov cx, word [0x483976]
xor ecx, 0xfeff
mov word [0x483976], cx
mov byte [esi], 0x20
mov ecx, dword [0x486754]
lea edx, [ecx - 1]
mov dword [0x486754], edx
cmp ecx, 0x64824c50
jg 0x41c1a0
mov ecx, dword [0x488850]
cmp ecx, 0xd1ca55df
jne 0x41c174
and dword [0x48e2c0], 0x1623d3f3
jmp 0x41c1a0
mov cx, word [0x484482]
dec ecx
mov word [0x484482], cx
imul ecx, ecx, 0xffffb534
or ecx, 0xfffffe6f
mov dx, word [0x4808e4]
add edx, ecx
mov word [0x4808e4], dx
nop
mov cx, word [0x4815c0]
or dword [0x48ae40], 0x5111abd7
mov ecx, dword [0x48dea4]
mov edx, 0xca17a3a1
sub edx, ecx
mov ecx, dword [0x48771c]
xor ecx, edx
xor ecx, 0x9a67c9c1
mov dword [0x48771c], ecx
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x20
jne 0x41c1a0
and dword [0x4871d8], 0x813b2841
add esi, eax
mov eax, dword [0x4871c0]
xor eax, 0x16e7193a
add dword [0x4861a8], eax
mov ax, word [0x480d18]
xor eax, 0xeb7f
mov word [0x480d18], ax
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x421df0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x14
or dword [0x489854], 0x8091049
mov ax, word [0x482256]
add eax, 0xffffc1df
mov word [0x482256], ax
mov ax, word [0x4838d6]
xor eax, 0x7f38
mov word [0x4838d6], ax
mov eax, dword [0x48708c]
add eax, eax
mov cx, word [0x4834b6]
sub ecx, eax
mov word [0x4834b6], cx
mov eax, dword [0x48cdec]
add eax, 0x5eb58100
mov cx, word [0x4845ee]
dec ecx
mov word [0x4845ee], cx
movsx ecx, cx
xor ecx, eax
mov dword [0x48ee88], ecx
lea eax, [esp + 4]
mov dword [esp], eax
call dword [0x47f548]
sub esp, 4
mov eax, dword [0x4849c8]
mov dword [0x48c7c0], eax
movzx eax, word [esp + 0x12]
mov ecx, dword [0x488ce4]
xor ecx, 0x392c4c82
cmp ecx, 0xf48de4cf
jl 0x421ea3
mov ecx, dword [0x4880b4]
imul ecx, ecx, 0x63e08b7d
add dword [0x48c5dc], ecx
jmp 0x421ead
mov dword [0x4874a8], 0x9727876c
xor edi, edi
mov ecx, 0x15
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [0x48c1b8]
shl edx, 5
and edx, 0x54082000
or edx, 0x2b75dee2
and dword [0x48ac90], edx
xor dword [0x48990c], 0xb547c2dd
lea edi, [edi + eax*2]
add eax, eax
mov edx, dword [0x48c108]
imul edx, edx, 0x17b29f33
or edx, 0x2a6
mov si, word [0x4810e4]
add esi, edx
mov word [0x4810e4], si
dec ecx
jne 0x421ec0
xor dword [0x486a64], 0x29c50a7f
mov dword [esp], 0
call fcn.00451b7c
mov esi, eax
xor esi, edi
mov ax, word [0x4800ec]
shl eax, 0xa
xor eax, 0x7150
mov cx, word [0x482168]
and ecx, eax
mov word [0x482168], cx
call dword [0x47f508]
xor eax, esi
and dword [0x4893a0], 0xb162dfd9
mov dword [esp], eax
call fcn.00451c99
mov eax, dword [0x48bdb8]
sar eax, 2
mov ecx, dword [0x48a214]
shl ecx, 2
xor ecx, eax
add dword [0x485a60], ecx
add esp, 0x14
pop esi
pop edi
ret
Function at 0x42f240
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ax, word [0x48051c]
lea edx, [eax + 1]
mov word [0x48051c], dx
cwde
mov edx, 0x3f4206e8
sub edx, eax
add dword [0x48d664], edx
or dword [0x488050], 0x873a4570
mov ax, word [0x480cb6]
imul eax, eax, 0xffff866d
or eax, 0x6c29
mov dx, word [0x48424c]
sub edx, eax
mov word [0x48424c], dx
mov eax, dword [0x48b1f8]
lea edx, [eax + 1]
mov dword [0x48b1f8], edx
cmp eax, 0x9eb57c7f
jl 0x42f2b5
or dword [0x489a44], 0xc5a115
mov edx, dword [esp + 0x20]
lea eax, [ecx + ebp*4]
mov esi, dword [0x48e4cc]
add esi, 0x4bbbb70b
cmp esi, 0xbfb1b6ac
jl 0x42f309
mov dword [esp], eax
mov si, word [0x48109a]
movsx esi, si
lea esi, [esi*4 + 0x95cce9a]
xor esi, 0x4e1eeed5
cmp esi, 0x7726b084
jl 0x42f320
mov si, word [0x4808f2]
dec esi
mov word [0x4808f2], si
mov esi, dword [0x48e3b4]
jmp 0x42f32a
mov dword [esp], eax
mov esi, dword [0x48de44]
imul esi, esi, 0x792758cf
mov dword [0x48de44], esi
jmp 0x42f32a
add dword [0x48a810], 0x44c4c7fe
mov esi, edx
shr esi, 8
mov ebx, edx
shr ebx, 0x10
mov edi, dword [0x489c1c]
dec edi
mov dword [0x489c1c], edi
or edi, 0xb94b
xor edi, 0x4200
mov ax, word [0x4827aa]
and eax, edi
mov word [0x4827aa], ax
mov edi, edx
shr edi, 0x18
cmp ecx, dword [esp]
je 0x42f412
shl ebp, 2
nop
nop
nop
nop
mov ax, word [0x47fab4]
and eax, 0x6916
mov word [0x47fab4], ax
shl edi, 0x18
shl ebx, 0x10
and ebx, 0xff0000
or ebx, edi
shl esi, 8
movzx eax, si
or eax, ebx
movzx esi, dl
or esi, eax
xor dword [ecx], esi
mov edi, dword [0x488ddc]
shld edx, esi, 0x1a
shr eax, 0xe
shr ebx, 0x16
mov si, word [0x47fd02]
mov di, word [0x481054]
xor edi, esi
movsx esi, di
mov edi, dword [0x4887e4]
sar edi, 6
or edi, esi
and dword [0x489614], edi
movzx edi, al
add ebx, eax
add dword [0x487cdc], 0xaf918927
movzx esi, bl
add esi, edi
mov eax, dword [0x487034]
mov edi, 0xffff6325
sub edi, eax
mov ax, word [0x481852]
add edi, eax
mov word [0x481852], di
add ecx, 4
mov edi, edx
shr edi, 0x18
add ebp, 0xfffffffc
jne 0x42f370
inc dword [0x487908]
mov ax, word [0x481a4c]
add eax, 0x1cfc
mov word [0x481a4c], ax
shl edi, 0x18
shl ebx, 0x10
and ebx, 0xff0000
shl esi, 8
movzx ecx, si
movzx eax, dl
or eax, edi
or eax, ebx
or eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441270
Capabilities:
Hash data with md5

Disassembly:
mov ax, word [0x481b26]
add eax, 0x6b4e
mov word [0x481b26], ax
mov dword [ecx], 0
add dword [0x489d64], 0x26240950
mov dword [ecx + 4], 0
mov ax, word [0x481e46]
xor eax, 0x82ac
mov word [0x481e46], ax
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x48e070]
lea edx, [eax + 1]
mov dword [0x48e070], edx
mov dx, word [0x483ebc]
movsx edx, dx
and edx, 0x3990f69e
xor edx, eax
cmp edx, 0x8a006d42
jne 0x4412e2
mov dword [0x489b28], 0xf2f459ff
push esi
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x48b7a8]
add eax, 0xa10af1a3
mov edx, dword [0x48bc90]
mov esi, dword [0x48ddbc]
sar esi, 4
or edx, 0x8fd91f11
xor edx, 0x7026e0ee
or edx, esi
cmp eax, edx
pop esi
jle 0x441337
mov eax, dword [0x48db4c]
lea edx, [eax + 1]
mov dword [0x48db4c], edx
cmp eax, 0x4188c108
jg 0x441341
and dword [0x48962c], 0xc1d50000
jmp 0x441341
xor dword [0x48a94c], 0x74455f62
mov dword [ecx + 0x10], 0x98badcfe
mov ax, word [0x4809a8]
lea edx, [eax - 1]
mov word [0x4809a8], dx
cwde
or eax, 0xe25cc948
xor dword [0x485f58], eax
mov dword [ecx + 0x14], 0x10325476
mov ax, word [0x4830d0]
inc eax
mov word [0x4830d0], ax
cwde
imul eax, eax, 0x731c73a
xor dword [0x487f00], eax
ret

Function at 0x44a540
Capabilities:
Terminate process

Disassembly:
sub esp, 8
mov eax, dword [0x48ce40]
lea ecx, [eax - 1]
mov dword [0x48ce40], ecx
mov ecx, dword [0x4887e8]
lea edx, [ecx + 1]
mov dword [0x4887e8], edx
lea eax, [eax + ecx - 0x72d2a062]
mov ecx, dword [0x48a3f8]
imul ecx, eax
mov dword [0x48a3f8], ecx
mov eax, dword [0x48f0dc]
mov cx, word [0x47f8ae]
movsx ecx, cx
and ecx, 0x1e9d6048
lea ecx, [ecx*8 + 0xb107d9e]
xor dword [0x48c4fc], ecx
mov cx, word [0x480d52]
xor ecx, 0x7f51
mov word [0x480d52], cx
mov dword [esp], eax
mov dword [esp + 4], 0x4e20
call dword [0x47f598]
sub esp, 8
mov ecx, dword [0x4898c8]
xor ecx, 0x74639dc2
mov edx, dword [0x485e80]
sub edx, ecx
mov dword [0x485e80], edx
cmp eax, 0x80
je 0x44a5f6
test eax, eax
jne 0x44a639
mov ax, word [0x482f18]
xor eax, 0x78
mov word [0x482f18], ax
jmp 0x44a649
mov ax, word [0x481dc2]
lea ecx, [eax - 1]
mov word [0x481dc2], cx
cwde
xor eax, 0xbdb3c916
mov ecx, dword [0x4882e0]
cmp eax, ecx
jg 0x44a649
mov eax, dword [0x48dc54]
dec eax
mov dword [0x48dc54], eax
xor eax, 0x4362
mov cx, word [0x482e34]
imul ecx, eax
mov word [0x482e34], cx
jmp 0x44a649
mov eax, dword [0x488ebc]
imul eax, eax, 0x786d74de
mov dword [0x488ebc], eax
mov ax, word [0x48130c]
xor eax, 0xe174
mov word [0x48130c], ax
mov dword [esp], 1
call fcn.00452526
int3
Function at 0x4594f2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47ebe0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00455b4d
mov dword [ebp - 0x14], eax
cmp dword [0x4902e4], esi
jne 0x4595e5
push 0x800
push esi
push 0x470218
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x459572
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4596c5
push esi
push esi
push 0x470218
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4596c5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4596c5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4902e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4902e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4902ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4902f4], eax
test eax, eax
je 0x4595e2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4902f0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45960a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4595fd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x45961f
push 4
pop eax
jmp 0x4596c7
cmp dword [ebp - 0x14], esi
je 0x45961f
push dword [0x4902e4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x459604
mov eax, dword [0x4902f0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x45967d
cmp dword [0x4902f4], edi
je 0x45967d
push eax
call ebx
push dword [0x4902f4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x45967d
test eax, eax
je 0x45967d
call ecx
test eax, eax
je 0x459672
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x459672
test byte [ebp - 8], 1
jne 0x45967d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4596ad
mov eax, dword [0x4902e8]
cmp eax, edi
je 0x4596aa
push eax
call ebx
test eax, eax
je 0x4596aa
call eax
mov esi, eax
test esi, esi
je 0x4596aa
mov eax, dword [0x4902ec]
cmp eax, edi
je 0x4596aa
push eax
call ebx
test eax, eax
je 0x4596aa
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4902e4]
call ebx
test eax, eax
je 0x4596c5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4596c7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004596f6
mov esp, ebp
pop ebp
ret
Function at 0xa60058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a601a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa6007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6006a
add dl, dl
jne 0xa60089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa600dc
xor eax, eax
add dl, dl
jne 0xa60096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6017d
add dl, dl
jne 0xa600a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa600b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa600bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa600c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa600d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa60075
mov eax, 1
add dl, dl
jne 0xa600ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa600f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa600e1
sub eax, ebx
mov ebx, 1
jne 0xa60128
mov ecx, 1
add dl, dl
jne 0xa6010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa60119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa60105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa60075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa6013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa60136
cmp eax, 0x7d00
jae 0xa6016d
cmp eax, 0x500
jb 0xa60168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa60075
cmp eax, 0x7f
ja 0xa60170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa60075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa6019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa60075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x402c00
pop dword [ebp - 0x4c]
mov eax, 0x402c00
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x59b1db28
add dword [ebp - 0x5c], 0xf4a06a23
mov dword [ebp - 0x58], 0x78f8de06
add dword [ebp - 0x58], 0xb93a6e3f
mov dword [ebp - 0x54], 0x54340a38
add dword [ebp - 0x54], 0xf81839f6
mov dword [ebp - 0x50], 0x37b89541
add dword [ebp - 0x50], 0xc8476abf
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x92dfff53
sub dword [ebp - 0x5c], 0x1e6d95fd
mov dword [ebp - 0x58], 0x472ac830
sub dword [ebp - 0x58], 0x5be66bb
mov dword [ebp - 0x54], 0x6af2d915
add dword [ebp - 0x54], 0xf87c9357
mov dword [ebp - 0x50], 0x56a9872c
add dword [ebp - 0x50], 0xa95678d4
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xdefa041e
add eax, 0x21467cb6
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c616
push 0
call eax
mov ecx, 0x6d398717
sub ecx, 0x6d392853
xor edx, edx
add edx, eax
mov ebx, 0x234751f8
sub ebx, 0x230641f8
add ebx, dword [ebp - 0x4c]
mov edi, 0xfcb165f3
xor dword [ebp - 4], edx
mov esi, dword [ebx]
xor dword [ebp - 0x18], ebx
sub esi, edi
xor dword [ebp - 0x10], edx
mov dword [edx], esi
sub dword [ebp - 0x38], 0xd845d79
add edx, 0x2f92adde
sub edx, 0x2f92adda
add ebx, 0x37f1a2fd
add ebx, 0xc80e5d07
loop 0x402d14
add eax, 0x16de3
mov ebx, eax
add eax, 0x8ee018a7
sub eax, 0x8ee018a2
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1047a5c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x1047a635
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x1047a67f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [0x102961cc]
add esp, 8
test eax, eax
jne 0x1047a67d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x1047a681
jmp 0x1047a62c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1048479a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x104847aa
xor eax, eax
jmp 0x10484973
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x1048492b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x10298554]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x104847b3
cmp dword [ebp + 0x10], 0
je 0x1048496d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x10298554]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x10484931
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret