joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e048]
jne 0x40100a
repz ret
jmp fcn.00401d18

Function at 0x407665
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401e90
and dword [ebp - 4], 0
cmp dword [0x40f9f4], 0
mov ebx, eax
jne 0x407716
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4077c7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4077c7
push eax
call fcn.00401e1e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f9f4], eax
call esi
push eax
call fcn.00401e1e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f9f8], eax
call esi
push eax
call fcn.00401e1e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f9fc], eax
call esi
push eax
call fcn.00401e1e
pop ecx
mov dword [0x40fa04], eax
test eax, eax
je 0x407716
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401e1e
pop ecx
mov dword [0x40fa00], eax
mov eax, dword [0x40fa00]
cmp eax, ebx
je 0x40776e
cmp dword [0x40fa04], ebx
je 0x40776e
push eax
call fcn.00401e99
push dword [0x40fa04]
mov esi, eax
call fcn.00401e99
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40776e
test edi, edi
je 0x40776e
call esi
test eax, eax
je 0x407765
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407765
test byte [ebp - 0xc], 1
jne 0x40776e
or dword [ebp + 0x10], 0x200000
jmp 0x4077a7
mov eax, dword [0x40f9f8]
cmp eax, ebx
je 0x4077a7
push eax
call fcn.00401e99
pop ecx
test eax, eax
je 0x4077a7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4077a7
mov eax, dword [0x40f9fc]
cmp eax, ebx
je 0x4077a7
push eax
call fcn.00401e99
pop ecx
test eax, eax
je 0x4077a7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f9f4]
call fcn.00401e99
pop ecx
test eax, eax
je 0x4077c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4077c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x464c9b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x402d46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x401670
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xf4], ebx
push 1
pop edi
push edi
call fcn.00402e30
mov eax, dword [0x4ab1b8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x314]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00402df4
mov esi, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
push esi
call dword [eax + 0xa0]
fnclex
cmp eax, ebx
jge 0x464d43
push 0xa0
push 0x419f4c
push esi
push eax
call fcn.00402e12
push dword [ebp - 0x2c]
push 0x41c898
push edi
call fcn.00402f0e
mov si, ax
neg si
sbb esi, esi
inc esi
neg esi
call fcn.00464bb5
xor ecx, ecx
test ax, ax
setg cl
neg ecx
and esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.00402e36
lea ecx, [ebp - 0x30]
call fcn.00402dfa
cmp si, bx
je 0x464e34
push dword [0x4ab1a4]
push edi
call fcn.00402e48
mov ecx, eax
sub ecx, edi
jo 0x464fd8
call fcn.00402e2a
mov dword [ebp - 0x11c], eax
push dword [0x4ab1a4]
push edi
call fcn.00402e42
mov ecx, eax
call fcn.00402e2a
mov dword [ebp - 0x20], eax
cmp ax, word [ebp - 0x11c]
jg 0x464e34
movsx esi, ax
push esi
push dword [0x4ab1a4]
call fcn.00402ea2
cmp dword [eax + 4], 0xfe
jne 0x464e0b
push esi
push dword [0x4ab1a4]
call fcn.00402ea2
cmp dword [eax + 8], 0xe
jne 0x464e0b
push esi
push dword [0x4ab1a4]
call fcn.00402ea2
cmp dword [eax + 0x10], ebx
jne 0x464e0b
call fcn.0047c3bc
test ax, ax
je 0x464e1a
push 1
pop eax
add ax, word [ebp - 0x20]
jo 0x464fd8
jmp 0x464dba
lea eax, [ebp - 0x44]
push eax
call fcn.00464aec
lea eax, [ebp - 0x44]
push eax
call fcn.00402e5a
lea ecx, [ebp - 0x44]
call fcn.00402f1a
call fcn.00415a34
mov esi, eax
call fcn.00402e24
mov ecx, esi
call fcn.00402e2a
cmp ax, bx
jne 0x464e68
mov dword [ebp - 0x28], ebx
push ebx
push ebx
push edi
push ebx
push 0x4ab1a4
push 0x18
push ebx
call fcn.00402f2c
add esp, 0x1c
jmp 0x464f8e
or dword [ebp - 0x28], 0xffffffff
jmp 0x464f8e
call fcn.00402de2
push 0x464fc5
jmp 0x464fc4
ret
call fcn.00402f32
Function at 0x4c0cb0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x4c0e12
cmp edi, esi
je 0x4c0e12
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x4c0e02
add edi, 4
jmp 0x4c0d63
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4c0d78
mov dword [ebp - 4], 2
jmp 0x4c0d99
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4c0d8f
mov dword [ebp - 4], 1
jmp 0x4c0d99
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4c0e12
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x4c0dd0
mov byte [ecx + 2], 0x3d
jmp 0x4c0ddd
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x4c0dec
mov byte [ecx], 0x3d
jmp 0x4c0df2
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4c0d60
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0xf840fbb
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x101064bb
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10044315
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
xor eax, eax
mov esi, dword fs:[eax + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0xc]
lodsd eax, dword [esi]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
mov edi, dword [ebx + 0x3c]
mov edi, dword [ebx + edi + 0x78]
mov esi, dword [ebx + edi + 0x20]
add esi, ebx
mov edx, dword [ebx + edi + 0x24]
add edx, ebx
xor ecx, ecx
dec ecx
inc ecx
mov eax, dword [esi]
add esi, 4
cmp byte [ebx + eax + 1], 0x69
jne 0x10044346
cmp word [ebx + eax + 0xb], 0x63
jne 0x10044346
movzx eax, word [edx + ecx*2]
mov esi, dword [ebx + edi + 0x1c]
add esi, ebx
add ebx, dword [esi + eax*4]
mov dword [ebp - 4], ebx
push 0x40
push 0x3000
push 0x14d8f7
push 0
call dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402340
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x4023b0
mov ebx, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov esi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00401390
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x4028a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4028b1
pop dword [ebp - 0x34]
mov eax, 0x79d2eefd
sub eax, 0x7992c64c
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x2f09437d
sub dword [ebp - 0x44], 0xe0b6fe32
mov dword [ebp - 0x40], 0xc2b064cb
add dword [ebp - 0x40], 0x6f82e77a
mov dword [ebp - 0x3c], 0xef0b7be0
add dword [ebp - 0x3c], 0x5d40c84e
mov dword [ebp - 0x38], 0x77b68f9c
add dword [ebp - 0x38], 0x88497064
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x8b3d8e97
sub dword [ebp - 0x44], 0x16cb2541
mov dword [ebp - 0x40], 0x6828d201
sub dword [ebp - 0x40], 0x26bc708c
mov dword [ebp - 0x3c], 0x5fafe28e
add dword [ebp - 0x3c], 0x3bf89de
mov dword [ebp - 0x38], 0x5376b73a
sub dword [ebp - 0x38], 0x5376b73a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xfadc4494
add eax, 0x5642b8c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35e10
push 0
call eax
mov ecx, 0x40a7
xor edi, edi
add edi, eax
mov esi, 0xa83bb414
sub esi, 0xa7faec14
add esi, dword [ebp - 0x34]
mov ebx, 0xb145071
sub ebx, 0x96eb708d
sub dword [ebp - 0x1c], 0xab29292a
mov edx, dword [esi]
xor dword [ebp - 0x18], edi
sub edx, ebx
add dword [ebp - 0x28], 0x7dbe6754
mov dword [edi], edx
sub dword [ebp - 8], eax
add edi, 0x94733026
add edi, 0x6b8ccfde
add esi, 0x48d41374
sub esi, 0x48d41370
loop 0x4029ca
add eax, 0xd3c0d12
add eax, 0xf2c4e85d
mov ebx, eax
add eax, 0xc1fd60ad
add eax, 0x3e029f58
mov ecx, 0x36508af1
sub ecx, 0x36108af1
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004028a2
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004028a2
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40345b
pop dword [ebp - 0x1c]
mov eax, 0x410e7114
sub eax, 0x40ce3cb9
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x9eb41e12
sub dword [ebp - 0x2c], 0x5061d8c7
mov dword [ebp - 0x28], 0x98d76e58
add dword [ebp - 0x28], 0x995bdded
mov dword [ebp - 0x24], 0xe6776c7a
add dword [ebp - 0x24], 0x65d4d7b4
mov dword [ebp - 0x20], 0xd6aad25e
sub dword [ebp - 0x20], 0xd6aad25e
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xd3f6b66a
add eax, 0x2c4989ea
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x8a3c02cd
sub dword [ebp - 0x2c], 0x15c99977
mov dword [ebp - 0x28], 0x94dc9628
add dword [ebp - 0x28], 0xac8fcb4d
mov dword [ebp - 0x24], 0xc6c0318
sub dword [ebp - 0x24], 0xa8fc96ac
mov dword [ebp - 0x20], 0xb84fd3ff
sub dword [ebp - 0x20], 0xb84fd3ff
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x244388ba
add eax, 0xdbfcb796
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36b67
push 0
call eax
mov ecx, 0x160228a0
sub ecx, 0x1601e13c
mov edi, eax
mov edx, 0x408400
add edx, dword [ebp - 0x1c]
mov esi, 0x8ec2246e
add esi, 0xf110ccad
xor dword [ebp - 8], esi
mov ebx, dword [edx]
add dword [ebp - 0x14], esi
sub ebx, esi
sub dword [ebp - 0x10], 0x8445fe20
mov dword [edi], ebx
add dword [ebp - 0xc], edx
add edi, 0xbd965c78
add edi, 0x4269a38c
add edx, 4
loop 0x403577
add eax, 0x11063
mov ebx, eax
add eax, 0x8c0003ef
add eax, 0x73fffc16
mov ecx, 0xa5a70182
add ecx, 0x5a98fe7e
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00405630
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00405630
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00405630
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00405630
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00405630
mov dword [0x41203c], eax
call fcn.00405630
test eax, eax
jge 0x402550
push 8
call fcn.00405630
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00405630
pop ecx
push 1
call fcn.00405630
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00405630
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00405630
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00405630
jmp 0x402495

Function at 0x405630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40563f
pop dword [ebp - 0x2c]
mov eax, 0xa5c45a85
sub eax, 0xa5840446
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3b542
push 0
mov eax, 0x769a05d5
sub eax, 0x765924fd
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x29cf704e
add ecx, 0xd630e02f
mov edx, eax
mov edi, 0xcb35fee5
sub edi, 0xcaf4c321
add edi, dword [ebp - 0x2c]
mov esi, 0x1e5def19
sub esi, 0xe8fe92af
add dword [ebp - 4], 0x3c8a2837
mov ebx, dword [edi]
xor dword [ebp - 8], 0x4ae79634
add ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x20], 0xea931a17
add edx, 4
add edi, 0x48cd5bf3
add edi, 0xb732a411
loop 0x40569e
add eax, 0xe063a9c3
add eax, 0x1f9d8b04
xor ebx, ebx
add ebx, eax
add eax, 0x3f7344ac
sub eax, 0x3f7344a7
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401bd7
pop dword [ebp - 0x4c]
mov eax, 0xcfc0901e
add eax, 0x307f8bb9
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x3499458b
sub dword [ebp - 0x5c], 0xe6470040
mov dword [ebp - 0x58], 0x3fb46f7b
sub dword [ebp - 0x58], 0xd812336
mov dword [ebp - 0x54], 0xadc4d58c
add dword [ebp - 0x54], 0x9e876ea2
mov dword [ebp - 0x50], 0xcb250e71
add dword [ebp - 0x50], 0x34daf18f
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xd21d9fbf
add dword [ebp - 0x5c], 0xa254c997
mov dword [ebp - 0x58], 0x4db757d1
sub dword [ebp - 0x58], 0xc4af65c
mov dword [ebp - 0x54], 0x6ee6e2f7
add dword [ebp - 0x54], 0xf4888975
mov dword [ebp - 0x50], 0xbc5d9bec
sub dword [ebp - 0x50], 0xbc5d9bec
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x11f1392d
add eax, 0xee4f37d3
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a797
push 0
call eax
mov ecx, 0xf0b4a06d
sub ecx, 0xf0b448d4
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x4c]
mov edx, 0xdf76d7d
sub dword [ebp - 0x44], 0x6eadeea8
mov esi, dword [ebx]
sub dword [ebp - 8], 0xec4c6a
xor esi, edx
add dword [ebp - 0x34], eax
mov dword [edi], esi
add edi, 4
add ebx, 0x6a5fef4
sub ebx, 0x6a5fef0
loop 0x401ce8
add eax, 0xa4606da2
add eax, 0x5ba0e395
mov ebx, eax
add eax, 0x7483393d
add eax, 0x8b7cc6c8
mov ecx, 0xe376c5b
sub ecx, 0xdf76c5b
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.00401bc8
jmp 0x406676

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret