joyce8/EMBER2024-capa huggingface dataset:
Function at 0x813a34
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x813af0
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x813a63
mov eax, dword [ebp - 8]
call fcn.00409f5c
jmp 0x813ada
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a384
xor eax, eax
push ebp
push 0x813ac5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, ebx
call fcn.0040ac6c
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov esi, eax
test esi, esi
jle 0x813ab3
mov edx, esi
dec edx
mov eax, dword [ebp - 8]
call fcn.0040ae00
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040ac6c
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
jmp 0x813abb
mov eax, dword [ebp - 8]
call fcn.00409f5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x813ada
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x813af7
lea eax, [ebp - 4]
call fcn.00409f5c
ret

Function at 0x813b00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x813bb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409f5c
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
call sub.kernel32.dll_GetVolumeInformationW
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 8]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.004233fc
push dword [ebp - 0x14]
push 0x813bcc
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.004233fc
push dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040af60
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a33c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x813bb9
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00409fbc
lea eax, [ebp - 4]
call fcn.00409f5c
ret
Function at 0x82b2e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [0x84cf50]
mov edx, 0x82b354
mov eax, dword [0x867918]
call fcn.005436a0
push 0
mov eax, dword [0x867918]
call fcn.0054c944
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x84d7f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
jmp 0x82b326
xor eax, eax
call fcn.004c6e60
mov eax, dword [ebx]
call fcn.0040c28c
mov edx, eax
mov eax, dword [ebx]
mov ecx, 0x3e8
call fcn.007719c0
test al, al
je 0x82b31f
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x82b374
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x82b59a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
shr ecx, 1
lea ebx, [ebp - 4]
mov edx, dword [eax + 8]
mov eax, ebx
call fcn.0040a0e4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042281c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040a384
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x82b5b4
call fcn.0040b258
test eax, eax
jle 0x82b40c
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x82b5b4
mov eax, dword [ebp - 4]
call fcn.0043f1f4
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a384
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0082d2e8
mov byte [0x84cc0c], 1
mov eax, dword [ebp - 0xc]
call fcn.0082b2e0
mov eax, dword [ebp - 4]
mov edx, 0x82b5f4
call fcn.0040b010
jne 0x82b423
mov eax, dword [ebp - 0xc]
call fcn.0082b2e0
mov eax, dword [ebp - 4]
mov edx, 0x82b644
call fcn.0040b010
mov eax, dword [ebp - 4]
mov edx, 0x82b694
call fcn.0040b010
jne 0x82b4cb
xor eax, eax
push ebp
push 0x82b4c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x867938]
call fcn.0082be44
mov edx, eax
add edx, 2
mov eax, dword [0x867918]
call fcn.0060cac0
mov eax, dword [0x867938]
call fcn.0082bb6c
mov edx, eax
add edx, 2
mov eax, dword [0x867918]
call fcn.0060ca94
mov eax, dword [0x867918]
call fcn.00542f0c
mov edx, eax
inc edx
mov eax, dword [0x867938]
mov eax, dword [eax + 4]
call fcn.00542c48
mov eax, dword [0x867918]
call fcn.00542f4c
mov edx, eax
inc edx
mov eax, dword [0x867938]
mov eax, dword [eax + 4]
call fcn.00542c80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x82b4cb
mov eax, dword [ebp - 4]
mov edx, 0x82b6d8
call fcn.0040b010
jne 0x82b4ea
lea ecx, [ebp - 0x14]
mov edx, 0x32
mov eax, dword [ebp - 0xc]
call fcn.0082b134
mov eax, dword [ebp - 4]
mov edx, 0x82b710
call fcn.0040b010
jne 0x82b504
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0082e8d4
mov eax, dword [ebp - 4]
mov edx, 0x82b748
call fcn.0040b010
jne 0x82b51b
mov eax, dword [ebp - 0xc]
call fcn.0082b2e0
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x82b784
call fcn.0040b258
test eax, eax
jle 0x82b572
movzx eax, byte [0x82b7b4]
push eax
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
mov edx, 0x82b784
mov eax, dword [ebp - 4]
call fcn.0042ae5c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.0040a384
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040ac6c
push eax
push 0x82b7b8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x82b5a1
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00409fbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409fbc
ret
Function at 0x82cf5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x82d071
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x3cc]
call fcn.00543ca8
mov eax, dword [0x867918]
mov edx, dword [eax]
call dword [edx + 0xac]
mov eax, dword [0x84ce0c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
call fcn.008076b0
lea eax, [ebp - 4]
mov edx, dword [0x867928]
call fcn.0040ad78
mov eax, dword [ebp - 4]
call fcn.0080e540
test al, al
je 0x82cffe
lea ecx, [ebp - 8]
mov edx, 0x64
mov eax, ebx
call fcn.0082b134
push 1
push 0x82d080
push 0x82d080
mov eax, dword [0x867928]
call fcn.0040ac6c
push eax
push 0x82d084
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x867918]
mov dword [eax + 0xc], 1
mov eax, ebx
call fcn.0082b2e0
lea ecx, [ebp - 0xc]
mov edx, 0x64
mov eax, ebx
call fcn.0082b134
push 1
push 0x82d080
push 0x82d080
lea edx, [ebp - 0x10]
mov eax, dword [0x84cc04]
call fcn.00424050
mov eax, dword [ebp - 0x10]
call fcn.0040ac6c
push eax
push 0x82d084
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x867918]
mov dword [eax + 0xc], 1
mov eax, ebx
call fcn.0082b2e0
Function at 0x10528058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105281a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1052807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052806a
add dl, dl
jne 0x10528089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105280dc
xor eax, eax
add dl, dl
jne 0x10528096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052817d
add dl, dl
jne 0x105280a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105280b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105280bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105280c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105280d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10528075
mov eax, 1
add dl, dl
jne 0x105280ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105280f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105280e1
sub eax, ebx
mov ebx, 1
jne 0x10528128
mov ecx, 1
add dl, dl
jne 0x1052810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10528119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10528105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10528075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1052813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1052814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10528136
cmp eax, 0x7d00
jae 0x1052816d
cmp eax, 0x500
jb 0x10528168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10528075
cmp eax, 0x7f
ja 0x10528170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10528075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1052819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10528075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4dde14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00484424
xor edx, edx
push ebp
push 0x4dde86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dde90
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x573749f2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3409221a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4252d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e31f
and dword [ebp - 4], 0
cmp dword [0x44f1f0], 0
mov ebx, eax
jne 0x425386
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425437
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425437
push eax
call fcn.0041e2ad
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f1f0], eax
call esi
push eax
call fcn.0041e2ad
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f1f4], eax
call esi
push eax
call fcn.0041e2ad
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f1f8], eax
call esi
push eax
call fcn.0041e2ad
pop ecx
mov dword [0x44f200], eax
test eax, eax
je 0x425386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e2ad
pop ecx
mov dword [0x44f1fc], eax
mov eax, dword [0x44f1fc]
cmp eax, ebx
je 0x4253de
cmp dword [0x44f200], ebx
je 0x4253de
push eax
call fcn.0041e328
push dword [0x44f200]
mov esi, eax
call fcn.0041e328
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4253de
test edi, edi
je 0x4253de
call esi
test eax, eax
je 0x4253d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4253d5
test byte [ebp - 0xc], 1
jne 0x4253de
or dword [ebp + 0x10], 0x200000
jmp 0x425417
mov eax, dword [0x44f1f4]
cmp eax, ebx
je 0x425417
push eax
call fcn.0041e328
pop ecx
test eax, eax
je 0x425417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425417
mov eax, dword [0x44f1f8]
cmp eax, ebx
je 0x425417
push eax
call fcn.0041e328
pop ecx
test eax, eax
je 0x425417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f1f0]
call fcn.0041e328
pop ecx
test eax, eax
je 0x425437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4017fc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x42dbc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42dc6d
test eax, edx
je 0x42dc70
push 0
push 0
cmp word [eax - 0xa], 2
je 0x42dbed
push edx
mov edx, eax
mov eax, esp
call fcn.00445d98
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x42dc03
push eax
lea eax, [esp + 8]
call fcn.00445d98
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42dc12
movzx eax, word [eax]
sub eax, ecx
jmp 0x42dc39
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42dc53
add ecx, 4
js 0x42dc2a
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x42dc50
push eax
mov eax, ecx
mov edx, 2
call fcn.00445164
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42dc37
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42dc39
xor eax, eax
ret
test eax, eax
je 0x42dc80
test edx, edx
jne 0x42dbd4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4350bb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00445498
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ede
mov edi, eax
cmp edi, 0x104
jbe 0x4350de
mov eax, edi
add eax, eax
call fcn.00443330
mov esi, eax
jmp 0x4350e0
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ede
push edi
push esi
call fcn.004c92ea
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x435119
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x435103
mov eax, esp
cmp esi, eax
je 0x435126
mov eax, esi
call fcn.0044334c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x435160
cmp bl, 0
je 0x43515c
cmp bl, 0x41
jl 0x435157
cmp bl, 0x5a
jg 0x435157
or bl, 0x20
xor al, bl
inc esi
jmp 0x43513b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4350a0
Function at 0x4665f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665f6
ret
Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409058
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409144
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00406a24
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov edx, 0x40915c
call fcn.00408900
push 0
mov eax, dword [ebp - 4]
call fcn.00403438
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409112
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409078
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004086f8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c18
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00406dfc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.004086c8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404594
call fcn.00405830
call fcn.00402eb4
jmp 0x409078
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40914b
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx