joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x248], ax
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x450], dx
push 0x206
push 0
lea eax, [ebp - 0x44e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x40974f
mov edx, dword [ebp + 0xc]
push edx
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.004062c0
push 0x40b3b4
push 0x104
lea ecx, [ebp - 0x450]
push ecx
call fcn.00406310
jmp 0x40979e
lea edx, [ebp - 0x450]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409780
push 0x40b3b8
push 0x104
lea eax, [ebp - 0x450]
push eax
call fcn.00406310
jmp 0x40979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b3d8
push str.SHGetFolderPath_failed
call fcn.004080a0
add esp, 0xc
jmp 0x409874
lea ecx, [ebp - 0x450]
push ecx
push 0x104
lea edx, [ebp - 0x248]
push edx
call fcn.004062c0
push str.AdobeARMHelper.exe
push 0x104
lea eax, [ebp - 0x248]
push eax
call fcn.00406310
push 0xffffffffffffffff
lea ecx, [ebp - 0x248]
push ecx
call fcn.004095f0
add esp, 8
test eax, eax
jne 0x4097fc
push 0x357
lea edx, [ebp - 0x248]
push edx
push str.Service_workflow_failed__file_not_valid:
call fcn.004080a0
add esp, 0xc
jmp 0x409874
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x540
mov dword [ebp - 0x20], 5
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x248]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40985b
push 0
push 0x40b48c
push str.ShellExecuteEx_succeeded
call fcn.004080a0
add esp, 0xc
jmp 0x409874
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40b4c4
push str.ShellExecuteEx_failed
call fcn.004080a0
add esp, 0xc
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x404169], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401368
xor eax, eax
jmp 0x401383
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402630
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp fcn.0040263d

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100046a1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c680]
jne 0x100046ab
repz ret
jmp fcn.1000913c

Function at 0x10011104
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001c680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10009c5f
and dword [ebp - 0x14], 0
cmp dword [0x1001e594], 0
mov dword [ebp - 0x18], eax
jne 0x100111b7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001125f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1001125f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001e594], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001e598], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001e59c], eax
call edi
push eax
call esi
mov dword [0x1001e5a4], eax
test eax, eax
je 0x100111b7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001e5a0], eax
mov eax, dword [0x1001e5a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10011210
cmp dword [0x1001e5a4], ecx
je 0x10011210
push eax
call esi
push dword [0x1001e5a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10011210
test ebx, ebx
je 0x10011210
call edi
test eax, eax
je 0x10011207
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10011207
test byte [ebp - 8], 1
jne 0x10011210
or dword [ebp + 0x10], 0x200000
jmp 0x10011243
mov eax, dword [0x1001e598]
cmp eax, dword [ebp - 0x18]
je 0x10011243
push eax
call esi
test eax, eax
je 0x10011243
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10011243
mov eax, dword [0x1001e59c]
cmp eax, dword [ebp - 0x18]
je 0x10011243
push eax
call esi
test eax, eax
je 0x10011243
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001e594]
call esi
test eax, eax
je 0x1001125f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10011261
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046a1
leave
ret
Function at 0x46e37f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xcc6a96e8
dec esp
mov al, byte [0x70b0ac22]
cld
or eax, 0x7fad3312
inc esi
fsub qword [edx + 0x7e641d4b]
pop ebp
in al, 0x1a
cmp byte [esi + edx*2 + 0x4354c606], dl
sbb al, 0xaa
scasd eax, dword es:[edi]
mov es, word [ebx]
adc dh, byte [edi]
xor al, 0xe7
xor al, 0xe7
cmc
test eax, 0xaedc58a9
idiv byte [eax]
pop esp
xor dword [eax], ebx
jecxz 0x46e363
mov byte [0x7a7dbcc5], al
mov dword [esi + esi*8 + 0x2489adfa], eax
leave
aad 0x20
arpl word [ebx + 0x4c], si
jnp 0x46e3dc
or bh, dh
mov bl, 0x3a
aaa
push ecx
rep lodsb al, byte [esi]
cmp eax, 0x6d8abdbc
lea ecx, [esi]
inc esi
loopne 0x46e357
mov bl, 0x9a
and esi, esi
invalid
lodsd eax, dword [esi]
in al, 0x3e
ja 0x46e3e0
call [edx - 0x922080]
out 0xa3, al
lcall 0xa3e6, 0xff6ddf80
dec edi
insd dword es:[edi], dx
xor al, 0xc4
loope 0x46e42d
ljmp 0xdade:0xabfee12a
and edi, esp
pushal
out dx, eax
mov ah, 0x16
and al, 0x3e
xchg ebx, eax
das
test byte [ecx - 0x1cb74431], al
cmp dword [ebp + ebx*8 + 0x4f5daf64], edx
fcmovnbe st(0), st(4)
push esp
sbb eax, 0x547e6fee
xchg ebp, eax
jnp 0x46e49e
or dword [esp + edi*8 - 0x17e18198], 0xbccf2a70
sahf
int3
ret

Function at 0x483240
Capabilities:
Encode data using xor

Disassembly:
inc dword [edx + 0x31]
sbb eax, 0x25b6a1d
dec esp
cdq
call [0xfdd729fb]
invalid
aam 0xae
xor byte [ecx], bl
inc ebp
push edx
dec ecx
insb byte es:[edi], dx
jne 0x483203
inc edi
dec ebp
sub cl, byte [edi]
sub byte [esi + 0x75ad81a2], ch
fsub qword [ebx - 0x3c5d3221]
mov dh, 0xd4
invalid

Function at 0x548c7f
Capabilities:
Encode data using xor

Disassembly:
sub bh, byte [edi]
out 0xf9, al
rcl ch, cl
sub al, 0xf1
pop edi
and dword [ebp + 0x64], eax
xor eax, 0x7db30886
push ecx
sub al, 0x41
sub al, 0x75
sbb cl, byte [edi - 0x297633ff]
ret
loope 0x548c86
lahf
arpl word [edx - 0xf692874], si
or al, 0xe1
mov dh, 0x9f
push edi
nop
pop edi
lodsb al, byte [esi]
je 0x548c5d
xchg esi, eax
invalid
rol byte [edx - 0x3a], 1
jns 0x548d04
and dh, byte [eax + eax*2]
or eax, 0xf6393109
cmp esi, esi
inc ebp
inc ebp
aaa
mov bl, 0xa2
int1
jecxz 0x548cd2
xchg esi, eax
inc edi
ja 0x548c9d
invalid
mov edx, 0x56b453ea
adc dl, dl
bound ebx, qword [edx]
or eax, 0x641c202f
mov bl, 0x34
inc ebp
outsd dx, dword [esi]
jle 0x548cf3
jb 0x548cea
or cl, bl
out 0x65, al
push eax
test dword [ecx - 0x34], 0xdabb6178
jo 0x548ccb
invalid
popal
mov ebx, 0xb3dc70da
mov al, 0xd5
push edx
mov bl, 0xb0
aad 0x52
push eax
sub dword [ebx], eax
mov ecx, es
xchg esp, eax
out 0x80, eax
loope 0x548ce1
aad 0xc6
pop ss
or al, 0x79
and edi, dword [esi + 0x703033ba]
mov esi, 0x703033ba
jbe 0x548ca0
sbb esp, dword [ebx]
xor ch, dh
fstp dword [ebp - 0x716c0b63]
xlatb
out 0xfb, eax
pushfd
cld
and dword [edi], eax
lea ebp, [ecx]
cmp al, ch
inc esi
in al, 0x2c
inc esp
invalid
Function at 0x555b0f
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi - 0x20], ebx
ja 0x555b87
jae 0x555b36
and dword [edx + 0x2333eeb7], ebp
stosb byte es:[edi], al
mov bh, 0xee
out dx, al
xor esp, dword [ebx]
jge 0x555b42
xlatb
outsd dx, dword [esi]
adc eax, 0xde778af0
adc dl, byte [eax + 0x33d7527c]
wait
lock xor dword [ebp + 0x63], esi
outsd dx, dword [esi]
push ebp
aad 0x65
loope 0x555b13
cmp ecx, dword [edx]
add dword [ecx], ebx
add al, byte [0x64b2c400]
or al, byte [ecx]
sbb dword [edx], eax
add eax, 0x64b2c400
dec edx
aam 0x56
mov eax, dword [0xce3be55d]
pop edx
aas
movsd dword es:[edi], dword [esi]
je 0x555b17
movsb byte es:[edi], byte [esi]
aas
ja 0x555b7e
jo 0x555b48
cmp ebx, dword [ebp + 0x44]
mov esi, 0x2d065c75
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
mov dh, 0x5b
cmc
stosb byte es:[edi], al
insd dword es:[edi], dx
mov al, 0x35
fld dword [edx + 0x47]
daa
push es
popal
invalid
xor eax, 0x478314f3
or edx, ecx
out dx, eax
cmc
xlatb
mov ah, 0xb
sub dword [edx], 0xffffff95
invalid

Function at 0x55d7ff
Capabilities:
Encode data using xor

Disassembly:
sub bh, al
in eax, dx
fidiv dword [ecx]
mov ch, 0xc7
adc al, 0x21
dec ecx
test eax, 0x80f5f115
cmp eax, 0x8c6127ef
pop dword [ebp - 0x191ec6b3]
loope 0x55d7e7
and dword [ecx - 0x57], ecx
adc eax, 0x3d80f5f1
out dx, eax
daa
popal
mov word [edi - 0x1ec6b27b], cs
loope 0x55d7e7
push ebp
loope 0x55d7e7
push ebp
pop edx
sar dword [ebx - 0x44dd39a7], 0xca
dec edi
popal
mov dl, 0xe5
fisubr word [esi]
push esi
arpl word [esi], ax
rcl dword [ebx + 0x17], cl
cmp ah, byte [edx]
bound eax, qword [eax]
add dword [esi], 0x39
sub eax, 0xd499f4c0
xchg byte [edi + 0x134893fb], dh
push ecx
xchg edx, eax
loop 0x55d871
xchg dword [edx], esp
test byte [0xfd0b908f], 0xe2
push edx
add dh, bh
dec edi
xor byte [edi], 0xff
jg 0x55d7ef
ret
loop 0x55d881
in al, 0x75
jae 0x55d888
fmul st(1)
dec ebx
or dh, ah
adc bl, byte [edx + 0x52c0a21c]
mov byte [0x7ffc52c0], al
jno 0x55d8ac
push edx
cld
jg 0x55d8f6
mov ch, 0x11
mov ch, 0x11
cmp eax, 0xec22fcc2
or esp, edi
or eax, 0x9bb565e1
jne 0x55d819
adc dword [edx], eax
fadd qword [si - 0x7c]
pushfd
pop ebx
sub edi, esi
inc ecx
jg 0x55d8d5
or eax, 0x44f8ec70
in al, 1
xor al, 0x84
invalid
dec esi
sbb eax, ecx
dec ebp
popfd
aas
enter 0xffffffffffff9d4d, 0x3f
xchg edx, eax
adc eax, dword [edi]
xchg ebp, eax
inc ebx
loopne 0x55d87f
and eax, 0x1cdfd637
out dx, al
fbld tbyte [esi]
cli
dec eax
pop eax
in al, dx
push ss
mov byte [0x353f4b33], al
push cs
xchg esi, eax
xchg dword [edi + 0x7421c3a], esp
cmpsd dword [esi], dword es:[edi]
cmp bl, byte [edx + eax*2]
pop es
pop ebp
cmp eax, 0xce480cb2
frstor dword [esp + eax*2 + 0x733263ee]
add byte [ebx + 0x76], 4
jecxz 0x55d8d2
xor dword [esi - 0x4b], esi
rol dword [ebp - 0x35], 0x24
sbb esp, edi
sal ch, cl
dec eax
adc al, 0x77
mov ebp, 0xe7b0e070
jl 0x55d908
sub esi, edx
mov esp, dword [esi]
imul edi, eax, 0x73
retf
Function at 0x59dbbf
Capabilities:
Encode data using xor

Disassembly:
sub ecx, ecx
unpckhps xmm3, xmm6
bound esp, qword [eax]
popfd
retf
xor al, 3
lcall 0xa50b, 0xd2fc1068
jge 0x59db5c
fadd dword [ebx]
mov esp, 0x56b56fa0
aad 0xcb
jl 0x59dc53
invalid
inc eax
jl 0x59dcb8
std
scasb al, byte es:[edi]
dec ebx
add byte [ebx + 0x1e], cl
and ch, byte [edx]
xchg edi, eax
xor ah, byte [ecx - 0x5f5dc134]
int3
mov bh, 0x74
cmp eax, 0x10132841
pop es
cmp ebp, esi
sub byte [eax], dh
retf
sbb eax, dword [eax + 0x4e]
cmp byte [eax - 0x4700104e], bh
movsd dword es:[edi], dword [esi]
js 0x59dc94
xchg edx, eax
invalid

Function at 0x5a64ff
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x69c86129
adc ch, bl
pop eax
invalid

Function at 0x5f446f
Capabilities:
Encode data using xor

Disassembly:
clc
cli
ret
in eax, 0xc0
jo 0x5f4442
or ebp, dword gs:[esi + ebx]
xchg esi, eax
sub eax, 0x12e71a7c
out 0x49, al
and al, 0x2e
push eax
and byte [esi], 0xbf
pushal
xchg dword [edi], eax
jne 0x5f44bd
mov byte [0x24656df3], al
les ebx, [0x3813d788]
xlatb
adc edi, dword [eax]
xlatb
adc edi, dword [eax]
xor ch, byte [eax]
cmpsb byte [esi], byte es:[edi]
push ebx
cdq
sbb al, 0x44
aas
jl 0x5f4467
jo 0x5f444b
push esp
xor byte [0xc54a24d2], 0xaf
adc eax, 0xb26cb483
insb byte es:[edi], dx
invalid
push ecx
jecxz 0x5f44cf
movlps xmm0, qword [0x85d2f492]
adc al, byte [0x85d2f492]
mov byte [0x6bd5f392], al
sub ebp, eax
ror dword [ebx], cl
clc
or eax, 0x248013d2
push cs
or eax, 0x51469304
rcl byte [ebx], cl
and byte [esi + ecx], 0xd
add al, 0x93
inc esi
push ecx
je 0x5f4558
push ebp
mov word [edx + edx*4], ss
out dx, al
mov byte [0x43b4ffb7], al
lodsd eax, dword [esi]
sub dh, byte [ebp - 0x11321bfd]
shl byte [0x365361d4], 0x63
int1
popal
push ebx
arpl cx, si
adc edx, dword ss:[ecx - 0x71]
adc ecx, edx
imul ebx, dword [ecx + edx*2 + 0x12], 0xa9c054ad
mul byte [eax]
mov ds, edi
loope 0x5f44f1
retf 0x5c69
out 0xf4, al
imul esp, dword [edi + 0x648f60df], 0x1a21f751
jne 0x5f44bf
int1
cmp esi, dword [edi - 0x3d]
cmp ecx, dword [ecx]
das
xchg edx, eax
ja 0x5f44d1
and edx, 0xa3d3c7a4
jmp 0xddac86a8
bound esi, qword [ebx + ebx]
in eax, 4
pushfd
inc edx
xor al, 0xa6
outsb dx, byte [esi]
mov cl, 0xcb
push esp
or edx, dword [eax - 0x37ec4129]
ret 0xe589
bound ebx, qword [ecx + ebp*8 + 0x56]
push edx
test dword [ebp - 0x50], edi
out 0x21, al
mov byte [0x8b84b726], al
inc edi
sub dh, ah
adc al, 0x9e
push edx
je 0x5f4536
jae 0x5f44fb
xlatb
xchg ebx, eax
js 0x5f4536
hlt
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x404b33
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4016c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x2c
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x4011c8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call sub.MSVBVM60.DLL___vbaOnError
mov dword [ebp - 4], 3
push 0x402d04
call fcn.00404c1c
mov dword [ebp - 4], 4
mov eax, dword [ebp + 0x10]
cmp word [eax], 0xffff
jne 0x404bb5
mov dword [ebp - 4], 5
mov dword [ebp - 0x24], 0x1d
jmp 0x404bc0
mov dword [ebp - 4], 7
and dword [ebp - 0x24], 0
mov dword [ebp - 4], 9
lea eax, [ebp - 0x24]
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x38], eax
push 4
push dword [ebp - 0x38]
push 0x1d
xor eax, eax
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
push eax
call fcn.0040307c
call sub.MSVBVM60.DLL___vbaSetSystemError
push 0x404bfe
jmp 0x404bfd
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x402c00
pop dword [ebp - 0x30]
mov eax, 0x402c00
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xb1cca620
add dword [ebp - 0x40], 0x9c859f2b
mov dword [ebp - 0x3c], 0x37175aa6
sub dword [ebp - 0x3c], 0x4e40e61
mov dword [ebp - 0x38], 0xdcece693
add dword [ebp - 0x38], 0x6f5f5d9b
mov dword [ebp - 0x34], 0x230d332c
add dword [ebp - 0x34], 0xdcf2ccd4
lea eax, [ebp - 0x40]
push eax
mov eax, 0x8cfd95e0
sub eax, 0x8cbd1554
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xd6235e1f
sub dword [ebp - 0x40], 0x61b0f4c9
mov dword [ebp - 0x3c], 0x43264572
add dword [ebp - 0x3c], 0xfe461c03
mov dword [ebp - 0x38], 0x402a2269
add dword [ebp - 0x38], 0x23454a03
mov dword [ebp - 0x34], 0x3de8bb1b
sub dword [ebp - 0x34], 0x3de8bb1b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x184367a0
add eax, 0xe7fd1934
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0a6
push 0
call eax
mov ecx, 0x5568
mov edi, eax
mov edx, 0xec8df23d
sub edx, 0xec4ce23d
add edx, dword [ebp - 0x30]
mov esi, 0x9d3c938e
xor dword [ebp - 0xc], ecx
mov ebx, dword [edx]
xor dword [ebp - 8], 0xa3122809
sub ebx, esi
sub dword [ebp - 8], 0xc86497c2
mov dword [edi], ebx
sub dword [ebp - 0x14], ecx
add edi, 4
add edx, 4
loop 0x402d11
add eax, 0x14873
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401000
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0x401121
call dword [sym.imp.kernel32.dll_SetConsoleTitleA]
push 0x31
push 6
call fcn.00401095
push 0x40114f
push 6
call fcn.004010b6
push 6
push 0x40117b
call fcn.004010e8
push 0x401163
push 6
call fcn.004010b6
push 0x401136
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
call dword [sym.imp.msvcrt.dll_getchar]
xor eax, eax
leave
ret
Function at 0x40674b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x40676f
xor eax, eax
test eax, eax
je 0x406781
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406781
xor ecx, ecx
jmp 0x406784
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ce4c], 0
push esi
jne 0x4068a7
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406881
mov dword [ecx*4 + 0x42ce48], eax
inc ecx
cmp ecx, 0x100
jl 0x40687c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4068d8
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ce48]
xor eax, esi
inc ecx
dec edx
jne 0x4068ba
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx