joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a1eb
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ecx
pop esi
ja 0x48a1f8
mov edx, esi
fstp xword [ecx + 0x556c871b]
les esp, [eax]
xchg ecx, eax
mov dword [ebp + 0x45d4ce27], edx
in al, 0x7a
popfd
fmul st(0)
stc
xchg dword [esi + 0x40], ecx
test al, 0x66
push esp
sub edi, esp
jle 0x48a261
cmp byte [esi], ch
pop ss
std
dec ecx
or eax, 0x917370c8
lahf
popal
in eax, dx
pop ecx
int3
jge 0x48a27e
int1
lodsb al, byte [esi]
retf
add eax, edi
jl 0x48a21d
or byte [eax - 1], 0
jmp 0x48a2cf
add esp, esp
dec eax
xor eax, 0xffffffea
jbe 0x48a207
mov cl, 0xd0
xchg esi, eax
jecxz 0x48a215
pop es
sbb dh, ah
pushfd
lea esi, [ebx]
mov al, 0xf3
bound esp, qword [esi]
xor cl, byte [esi]
adc byte [esp + esi*8], cl
pop ds
rcl edi, 0x9c
jecxz 0x48a2a5
invalid
mov eax, 0x53dd55da
std
pop ecx
push cs
dec esi
dec esi
bnd jns 0x48a272
enter 0x503c, 0x68
inc esi
mov bl, 0x1c
pushal
mov edx, 0x767400ff
out 0xf8, eax
pop esp
mov es, word [eax + 0x51452bfd]
and eax, 0x85194324
xchg byte [esi], cl
push cs
push ebp
mov al, 0x70
inc edi
and dword [ebx + 0x6c], esp
out 0x6f, eax
inc dword [eax]
scasb al, byte es:[edi]
test eax, 0xdfcec4b6
xor dword [esi - 0x270954ca], ecx
jp 0x48a2d7
push ds
stosb byte es:[edi], al
jno 0x48a2ea
push 0xe51d7c47
and eax, 0xb1430c18
add eax, 0x27803d48
xchg byte [0xcb5811bf], bl
enter 0xfffffffffffff94d, 0x32
int1
push esi
push ebp
sub al, bh
nop
bound ecx, qword ds:[ecx]
stc
jo 0x48a38d
enter 0xffffffffffffc438, 0x6b
push ebp
mov dword [0x906fa158], eax
mov cl, 0x43
sub byte [edi + eax*2 - 0x6027deda], 0xfa
imul edx, ebx, 0x58a669ae
invalid
cmp ebx, ebx
retf
jle 0x48a356
add eax, ecx
or al, 0x41
cmp byte [0x2b5294ea], bh
sbb al, 0xc4
xchg ecx, eax
mov ebx, 0xc699c493
xor ebp, edx
movq mm1, qword [esi - 0x4b]
insd dword es:[edi], dx
in al, 0x2e
jb 0x48a371
jb 0x48a371
inc ebx
adc byte [edi + 0x76], bh
push es
push es
invalid
Function at 0x45ef94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f06c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d588c], 0
jne 0x45f050
lea eax, [ebp - 4]
mov edx, 0x45f084
call fcn.00403c2c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fd4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x45f050
mov eax, ebx
call fcn.004027b0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45f049
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45f033
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45f094
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45f033
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4d588c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f050
mov eax, dword [ebp - 0xc]
call fcn.004027c8
ret
mov ebx, dword [0x4d588c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f073
lea eax, [ebp - 4]
call fcn.00403b94
ret

Function at 0x47c05b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4d3b4e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47c0b3
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4d3b6f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47c0a9
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47c0b7
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4a9d88
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4a9dcc
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.004091b4
add esp, 0x200
pop ebx
ret

Function at 0x4b3804
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004b28fc
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
invalid
invalid
invalid

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2b671b67
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x21131df4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x69101028
Capabilities:
Encode data using xor

Disassembly:
push ebp
movzx eax, al
shl eax, 4
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 8
mov dword [ebp - 0x10], eax
lea eax, [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ebx, edx
xor ecx, ecx
lea edi, [esi + eax]
mov al, byte [edi + ecx]
inc ecx
xor byte [ebx], al
inc ebx
cmp ecx, 4
jne 0x6910104c
add dword [ebp - 0x10], 4
add edx, 4
cmp edx, dword [ebp - 0x14]
jne 0x69101042
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x691011a4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, 0x10
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], esi
je 0x69101373
cmp eax, 0x10
jne 0x69101361
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov ecx, 4
lea edx, [ebp - 0x1c]
lea esi, [eax + 0xf0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
call fcn.69101028
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x18]
mov ecx, edx
mov byte [ebp - 0x21], 0
mov eax, ecx
movzx esi, byte [eax]
inc byte [ebp - 0x21]
add eax, 4
mov bl, byte [esi + str.cw]
mov byte [eax - 4], bl
cmp byte [ebp - 0x21], 4
jne 0x69101207
inc ecx
cmp edi, ecx
jne 0x69101201
mov al, byte [ebp - 0x17]
mov cl, byte [ebp - 0x1b]
cmp dword [ebp - 0x28], 0xe
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x1a]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x19]
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x11], al
je 0x69101321
lea eax, [edx + 0x10]
mov dword [ebp - 0x30], eax
mov al, byte [edx]
mov cl, byte [edx + 1]
mov bl, 0x1b
add edx, 4
xor ecx, eax
mov byte [ebp - 0x21], al
mov al, byte [edx - 2]
xor al, byte [edx - 1]
movzx edi, byte [ebp - 0x21]
mov byte [ebp - 0x22], al
mov esi, eax
mov eax, ecx
shr al, 7
xor esi, ecx
add ecx, ecx
imul eax, ebx
xor edi, esi
xor edi, eax
mov al, byte [edx - 3]
xor al, byte [edx - 2]
xor ecx, edi
mov edi, eax
shr al, 7
imul eax, ebx
mov byte [edx - 4], cl
mov ecx, esi
xor cl, byte [edx - 3]
add edi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
xor ecx, edi
movzx edi, byte [edx - 1]
shr al, 7
mov byte [edx - 3], cl
mov ecx, esi
xor cl, byte [edx - 2]
imul eax, ebx
xor esi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
add eax, eax
xor eax, ecx
mov cl, byte [ebp - 0x21]
xor cl, byte [edx - 1]
mov byte [edx - 2], al
mov eax, ecx
add ecx, ecx
shr al, 7
imul eax, ebx
xor esi, eax
xor ecx, esi
mov byte [edx - 1], cl
cmp dword [ebp - 0x30], edx
jne 0x6910127c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.69101028
inc dword [ebp - 0x28]
jmp 0x691011f9
mov ecx, dword [ebp + 8]
mov eax, 0xe
lea edx, [ebp - 0x1c]
call fcn.69101028
mov eax, 0xf
mov edi, dword [ebp + 8]
mov dl, byte [edi + eax + 0xf0]
cmp dl, 0xff
jne 0x69101354
mov byte [edi + eax + 0xf0], 0
sub eax, 1
jae 0x69101336
jmp 0x6910135f
mov edi, dword [ebp + 8]
inc edx
mov byte [edi + eax + 0xf0], dl
xor eax, eax
mov ebx, dword [ebp - 0x20]
mov dl, byte [ebp + eax - 0x1c]
inc eax
inc dword [ebp - 0x20]
xor byte [ebx], dl
jmp 0x691011be
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6910a670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
mov dword [esp], eax
call fcn.69110cf8
mov dword [esp + 4], ebx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.69110cf8
mov dword [esp + 4], ebx
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.69110cf8
add eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [edi + edi]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], edi
je 0x6910a734
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.69110cf8
lea ecx, [ebx + eax]
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call fcn.6910abfc
mov ecx, dword [ebp - 0x2c]
cmp eax, 0xa6caa1c5
jne 0x6910a722
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.69110cf8
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], ebx
add eax, ebx
movzx edx, word [edx]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
call fcn.69110cf8
jmp 0x6910a736
mov dword [esp], ecx
inc edi
call fcn.6910abfc
cmp eax, 0xffe885ef
jne 0x6910a6c2
jmp 0x6910a6fa
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6910a780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x691157c2]
xor edx, edx
test eax, eax
je 0x6910a837
mov edx, dword [0x69115778]
test edx, edx
jne 0x6910a837
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], 0
mov esi, dword [eax + ecx + 0x78]
add esi, eax
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x24]
add edi, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 0x20]
add ebx, eax
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
add edi, eax
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x18], edi
je 0x6910a827
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov esi, dword [edi + ecx*4]
cmp word [eax + esi], 0x775a
jne 0x6910a822
mov edi, dword [ebp - 0x1c]
test ebx, ebx
movzx esi, word [edi + ecx*2]
jne 0x6910a804
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + esi*4]
add ebx, eax
jmp 0x6910a822
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + esi*4]
add edi, eax
mov esi, edi
sub esi, ebx
cmp ebx, edi
jbe 0x6910a818
mov esi, ebx
sub esi, edi
test edx, edx
je 0x6910a820
cmp edx, esi
jbe 0x6910a822
mov edx, esi
inc dword [ebp - 0x10]
jmp 0x6910a7d6
mov dword [0x69115778], edx
add esp, 0x14
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
ret
Function at 0x6910aba8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x6910abf4
mov ecx, ebx
mov eax, 0x1505
mov dl, byte [ecx]
test esi, esi
jne 0x6910abcd
test dl, dl
jne 0x6910abdb
jmp 0x6910abf4
mov edi, ecx
sub edi, ebx
cmp esi, edi
jbe 0x6910abf4
cmp dl, 1
adc ecx, 0
cmp dl, 0x60
jbe 0x6910abe9
cmp dword [ebp + 0x10], 0
je 0x6910abe9
sub edx, 0x20
imul eax, eax, 0x21
movzx edx, dl
inc ecx
add eax, edx
jmp 0x6910abc1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6910abfc
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov eax, 0x1505
mov ebp, esp
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x6910ac16
imul eax, eax, 0x21
add eax, edx
jmp 0x6910ac07
pop ebp
ret

Function at 0x6910c43c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, byte [edx + esi*4]
mov byte [eax + esi*4], cl
mov cl, byte [edx + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov cl, byte [edx + esi*4 + 2]
mov byte [eax + esi*4 + 2], cl
mov cl, byte [edx + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
inc esi
cmp esi, 8
jne 0x6910c44b
mov dl, byte [eax + 0x1e]
mov edi, esi
movzx ebx, byte [eax + 0x1c]
movzx ecx, byte [eax + 0x1d]
mov byte [ebp - 0xd], dl
mov dl, byte [eax + 0x1f]
mov byte [ebp - 0xe], dl
and edi, 7
jne 0x6910c4c2
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ecx + str.cw]
mov bl, byte [ebx + str.cw]
mov cl, byte [edx + str.cw]
movzx edx, byte [ebp - 0xe]
mov byte [ebp - 0xe], bl
mov ebx, esi
mov dl, byte [edx + str.cw]
shr ebx, 3
mov byte [ebp - 0xd], dl
mov edx, edi
xor dl, byte [ebx + 0x69116298]
mov ebx, edx
jmp 0x6910c4ed
cmp edi, 4
jne 0x6910c4ed
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ebp - 0xe]
mov bl, byte [ebx + str.cw]
mov cl, byte [ecx + str.cw]
mov dl, byte [edx + str.cw]
mov byte [ebp - 0xd], dl
mov dl, byte [edi + str.cw]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
xor dl, byte [eax + 2]
inc esi
add eax, 4
xor bl, byte [eax - 4]
xor cl, byte [eax - 3]
mov byte [eax + 0x1e], dl
mov dl, byte [ebp - 0xe]
xor dl, byte [eax - 1]
mov byte [eax + 0x1c], bl
mov byte [eax + 0x1d], cl
mov byte [eax + 0x1f], dl
cmp esi, 0x3c
jne 0x6910c46f
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6910c934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x6910c95f
cmp dword [ebp + 0xc], 0
jne 0x6910c966
xor eax, eax
jmp 0x6910ca3e
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x6910c95f
lea eax, [ebx + ecx]
mov dword [ebp - 0x40], edx
mov edi, dword [eax + esi*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
add edi, ebx
mov dword [ebp - 0x3c], ecx
mov dword [esp], edi
call fcn.6910aba8
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x6910ca38
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x6910c9e5
mov eax, dword [ebp - 0x24]
jmp 0x6910ca3e
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x6910c9e0
mov dword [esp], edi
call fcn.69111820
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x69115418]
test eax, eax
je 0x6910c95f
lea edx, [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
sub esp, 0x10
test eax, eax
jns 0x6910c9e0
jmp 0x6910c95f
inc esi
jmp 0x6910c98d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x69110cf8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp dword [eax + 0x14], edx
ja 0x69110d3e
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x69110d3c
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x69110d37
mov esi, dword [eax + 0x10]
add esi, ebx
cmp esi, edx
jbe 0x69110d37
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x69110d3e
add eax, 0x28
jmp 0x69110d1c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x437ce9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x437cf8
pop dword [ebp - 0x10]
mov eax, 0x437cf8
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x75dc3fe6
sub dword [ebp - 0x20], 0x2789fa9b
mov dword [ebp - 0x1c], 0x1468579c
add dword [ebp - 0x1c], 0x1dcaf4a9
mov dword [ebp - 0x18], 0xd6e9b18e
sub dword [ebp - 0x18], 0x8a9d6d60
mov dword [ebp - 0x14], 0x153061e6
add dword [ebp - 0x14], 0xeacf9e1a
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x6d0f3bc7
sub dword [ebp - 0x20], 0xf89cd271
mov dword [ebp - 0x1c], 0x5ad621a8
sub dword [ebp - 0x1c], 0x1969c033
mov dword [ebp - 0x18], 0xff00a3ad
sub dword [ebp - 0x18], 0x9b913741
mov dword [ebp - 0x14], 0x9453244
add dword [ebp - 0x14], 0xf6bacdbc
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x49722
push 0
call eax
mov ecx, 0x3856
mov ebx, eax
mov edi, 0x5373875b
add edi, 0xacd3d8a5
add edi, dword [ebp - 0x10]
mov edx, 0x95ca221e
sub edx, 0xbb982833
mov esi, dword [edi]
add dword [ebp - 8], 0x549cebb7
xor esi, edx
xor dword [ebp - 4], 0xccef0e46
mov dword [ebx], esi
xor dword [ebp - 0xc], 0xfc322d7e
add ebx, 0x2b606400
sub ebx, 0x2b6063fc
add edi, 0xe226b85c
add edi, 0x1dd947a8
loop 0x437e05
add eax, 0x9578215c
add eax, 0x6a88b2cf
xor ebx, ebx
add ebx, eax
add eax, 0x773d0c58
add eax, 0x88c2f3ad
mov ecx, 0x61dcee4
add ecx, 0xfa22311c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402c00
pop dword [ebp - 0x18]
mov eax, 0x40d1e1d8
add eax, 0xbf6e4a28
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xf75cb208
sub dword [ebp - 0x28], 0xa90a6cbd
mov dword [ebp - 0x24], 0x9cd052a2
add dword [ebp - 0x24], 0x9562f9a3
mov dword [ebp - 0x20], 0x961f4315
add dword [ebp - 0x20], 0xb62d0119
mov dword [ebp - 0x1c], 0x15f4b60c
sub dword [ebp - 0x1c], 0x15f4b60c
lea eax, [ebp - 0x28]
push eax
mov eax, 0x5e3b5977
add eax, 0xa20516ed
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x6e2384ac
sub dword [ebp - 0x28], 0xf9b11b56
mov dword [ebp - 0x24], 0x305d63fd
add dword [ebp - 0x24], 0x110efd78
mov dword [ebp - 0x20], 0x856ac3d4
add dword [ebp - 0x20], 0xde04a898
mov dword [ebp - 0x1c], 0xd8b9b469
sub dword [ebp - 0x1c], 0xd8b9b469
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a27a
push 0
call eax
mov ecx, 0x4c7cae56
add ecx, 0xb383a787
xor ebx, ebx
add ebx, eax
mov edx, 0x4c218aa8
add edx, 0xb41f7558
add edx, dword [ebp - 0x18]
mov edi, 0x17cf12f0
mov esi, dword [edx]
sub dword [ebp - 4], 0xc49ceac7
xor esi, edi
xor dword [ebp - 0x14], edx
mov dword [ebx], esi
sub dword [ebp - 8], 0x54827bd8
add ebx, 4
add edx, 0xf92b5d23
sub edx, 0xf92b5d1f
loop 0x402d19
add eax, 0x76742850
add eax, 0x898d21f7
mov ebx, eax
add eax, 0x61595137
sub eax, 0x61595132
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40288e
pop dword [ebp - 0x1c]
mov eax, 0x2f12230c
sub eax, 0x2ed1fa7e
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2c4b5afd
sub dword [ebp - 0x2c], 0xddf915b2
mov dword [ebp - 0x28], 0x5076914b
sub dword [ebp - 0x28], 0x1e434506
mov dword [ebp - 0x24], 0xbe81a71e
add dword [ebp - 0x24], 0x8dca9d10
mov dword [ebp - 0x20], 0x4d4a9893
sub dword [ebp - 0x20], 0x4d4a9893
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xc75c3825
add eax, 0x38e4383f
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xefaccf7d
add dword [ebp - 0x2c], 0x84c599d9
mov dword [ebp - 0x28], 0x82e8b63a
sub dword [ebp - 0x28], 0x417c54c5
mov dword [ebp - 0x24], 0xe96a7770
sub dword [ebp - 0x24], 0x85fb0b04
mov dword [ebp - 0x20], 0xb702bfd3
sub dword [ebp - 0x20], 0xb702bfd3
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x15088aab
add eax, 0xeb37e5fd
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34e12
push 0
call eax
mov ecx, 0x4122
xor esi, esi
add esi, eax
mov edi, 0x17bcd603
sub edi, 0x177bd603
add edi, dword [ebp - 0x1c]
mov ebx, 0xc6461f0f
sub ebx, 0x7462c49f
mov edx, dword [edi]
add dword [ebp - 4], edi
sub edx, ebx
xor dword [ebp - 4], ecx
mov dword [esi], edx
sub dword [ebp - 8], eax
add esi, 0x83f6cc9e
add esi, 0x7c093366
add edi, 4
loop 0x4029ac
add eax, 0x6edf5660
add eax, 0x9121a0fb
xor ebx, ebx
add ebx, eax
add eax, 0x95f28b7a
add eax, 0x6a0d748b
mov ecx, 0x15f7dfdd
sub ecx, 0x15b7dfdd
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret