joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015eb
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a209
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x28], 0x4000
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 2
call sub.MPR.dll_WNetOpenEnumA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401637
xor eax, eax
jmp 0x401786
mov edx, dword [ebp - 0x28]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004052d0
add esp, 0xc
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.MPR.dll_WNetEnumResourceA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401749
mov dword [ebp - 0x20], 0
jmp 0x40168c
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x14]
jae 0x401747
mov edx, dword [ebp - 0x20]
shl edx, 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx + 0xc]
and ecx, 1
cmp ecx, 1
jne 0x401710
push 8
call fcn.004052bd
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x34], 0
je 0x4016d4
mov ecx, dword [ebp - 0x34]
call fcn.00402230
mov dword [ebp - 0x38], eax
jmp 0x4016db
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
shl ecx, 5
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x14]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00402260
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004024d0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x20]
shl edx, 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx + 0xc]
and ecx, 2
cmp ecx, 2
jne 0x401742
mov edx, dword [ebp - 0x20]
shl edx, 5
mov eax, dword [ebp - 0x10]
add eax, edx
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004015eb
jmp 0x401683
jmp 0x401754
cmp dword [ebp - 0x18], 0x103
je 0x401754
jmp 0x401761
cmp dword [ebp - 0x18], 0x103
jne 0x401646
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x24]
push eax
call sub.MPR.dll_WNetCloseEnum
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401781
xor eax, eax
jmp 0x401786
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x401866
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a21c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402230
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402300
push str._tst
lea ecx, [ebp - 0x14]
call fcn.00402380
push eax
lea ecx, [ebp - 0x14]
call fcn.004022e0
push 0
push 0x40000080
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.00402480
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x40190d
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.00402480
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402490
mov al, byte [ebp - 0x1c]
jmp 0x401923
mov byte [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402490
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4019dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xf003f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push str.REG_SZ
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00402480
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00402480
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00402480
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x401a5a
mov al, 1
jmp 0x401a5c
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x401a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x10c], 0x20019
mov dword [ebp - 4], 0xfe
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00402480
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00402480
push eax
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x104]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00402260
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], 0
jne 0x401b00
mov al, 1
jmp 0x401b02
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x401b06
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0xf003f
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00402480
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp + 0x10]
call fcn.00402480
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x401b5a
mov al, 1
jmp 0x401b5c
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x404120
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40a378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
mov edi, str.Mrak1pack
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x44], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Mrak1pack
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c]
push ecx
call fcn.0040196a
mov esi, eax
add esp, 4
test esi, esi
jne 0x4041ba
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x44], 0xffffffff
test eax, eax
je 0x404257
jmp 0x40424e
push ebx
push 2
push 0
push 0xffffffffffffffe8
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0xc]
push 0
push edx
lea eax, [esp + 0x18]
push 0x18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x28]
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404214
test cl, cl
je 0x404210
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404214
add eax, 2
add esi, 2
test cl, cl
jne 0x4041ec
xor eax, eax
jmp 0x404219
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x50]
pop ebx
mov dword [esp + 0x44], 0xffffffff
jne 0x40424a
test eax, eax
je 0x404237
push eax
call fcn.004052b2
add esp, 4
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
test eax, eax
je 0x404257
push eax
call fcn.004052b2
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x407815
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d5c0
cmp edx, dword [eax]
je 0x407837
add eax, 8
inc ecx
cmp eax, 0x40d650
jl 0x407828
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d5c0]
jne 0x407965
mov eax, dword [0x40d818]
cmp eax, 1
je 0x40793f
test eax, eax
jne 0x407868
cmp dword [0x40d208], 1
je 0x40793f
cmp edx, 0xfc
je 0x407965
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40789f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405700
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004057f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4078e2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004057f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b524
push edi
call fcn.00409590
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405700
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405710
lea eax, [ebp - 0xa0]
push 0x40b504
push eax
call fcn.00405710
push dword [esi + 0x40d5c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405710
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004096d0
add esp, 0x2c
pop edi
jmp 0x407965
lea eax, [ebp + 8]
lea esi, [esi + 0x40d5c4]
push 0
push eax
push dword [esi]
call fcn.004057f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x845380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30b000]
push edi
jmp 0x84539a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8453a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x845390
mov eax, 1
add ebx, ebx
jne 0x8453b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8453c4
jne 0x8453e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8453e3
dec eax
add ebx, ebx
jne 0x8453d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8453a8
add ebx, ebx
jne 0x8453df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x845435
xor ecx, ecx
sub eax, 3
jb 0x8453fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84546a
sar eax, 1
mov ebp, eax
jmp 0x845406
add ebx, ebx
jne 0x845406
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8453d4
inc ecx
add ebx, ebx
jne 0x845414
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8453d4
add ebx, ebx
jne 0x845421
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x845416
jne 0x845432
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x845416
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x845454
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x845446
jmp 0x845396
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x845454
add edi, ecx
jmp 0x845396
pop esi
mov edi, esi
mov ecx, 0x8c40
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x845472
cmp byte [edi], 0x1a
jne 0x845472
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x845477
lea edi, [esi + 0x441000]
mov eax, dword [edi]
or eax, eax
je 0x8454ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4570a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4571e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8454a4
mov ecx, edi
jns 0x8454d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4571e8]
or eax, eax
je 0x8454e9
mov dword [ebx], eax
add ebx, 4
jmp 0x8454c1
call dword [esi + 0x4571f8]
mov ebp, dword [esi + 0x4571ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x845523
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x401000
Capabilities:
Accept command line arguments
Access peb ldr_data
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
push esi
push edi
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x401174
cmp dword [esp + 0x14], 1
jl 0x401174
xorps xmm0, xmm0
mov dword [esp + 0x38], 0x44
push str.KrkrUniversalPatch.dll
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x40], xmm0
push eax
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movaps xmmword [esp + 0x28], xmm0
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x1c]
sub ecx, 0x10
mov edi, ecx
mov ecx, dword [ecx + 0x10]
sub ecx, 0x10
mov edx, dword [ecx + 0x30]
test edx, edx
je 0x4010e4
mov eax, dword [edx]
mov esi, dword [edx + 4]
and eax, 0xffdfffdf
and esi, 0xffdfffdf
cmp eax, 0x45004b
jne 0x4010e4
cmp esi, 0x4e0052
jne 0x4010e4
mov eax, dword [edx + 8]
mov esi, dword [edx + 0xc]
and eax, 0xffdfffdf
and esi, 0xffdfffdf
cmp eax, 0x4c0045
jne 0x4010e4
cmp esi, 0x120013
jne 0x4010e4
cmp word [edx + 0x10], 0x2e
je 0x4010ea
cmp edi, ecx
jne 0x401091
xor ecx, ecx
mov ecx, dword [ecx + 0x18]
mov edx, 0x638020fb
call fcn.004015c0
push 0
lea ecx, [esp + 0x24]
mov dword [0x4145a8], eax
push ecx
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push str.recation.exe
push 0
push 0
call eax
test eax, eax
je 0x40115c
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub esp, 0xc
push eax
call fcn.00401330
add esp, 0x10
push 0
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Krkr_Universal_Patch
push str.Couldnt_Launch_Game
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4011e0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
mov eax, 0x5a4d
push edi
cmp word [esi], ax
jne 0x401240
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x401240
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
je 0x40121a
mov edx, 0x20b
cmp cx, dx
jne 0x401240
mov ecx, 0x88
jmp 0x40121f
mov ecx, 0x78
mov edx, dword [eax + 0x50]
lea edi, [eax + ecx]
mov ecx, edi
call fcn.004011a0
test eax, eax
je 0x401240
mov eax, dword [edi]
cmp dword [eax + esi + 0x1c], edx
jae 0x401240
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10013da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10013daf
pop dword [ebp - 8]
mov eax, 0xf6c49ad9
sub eax, 0xe6c35d2a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf4d7391d
sub dword [ebp - 0x18], 0xa684f3d2
mov dword [ebp - 0x14], 0x8862795e
add dword [ebp - 0x14], 0xa9d0d2e7
mov dword [ebp - 0x10], 0x55acc63a
add dword [ebp - 0x10], 0xf69f7df4
mov dword [ebp - 0xc], 0x697fbb2b
sub dword [ebp - 0xc], 0x697fbb2b
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x6e14e944
add dword [ebp - 0x18], 0x65d8012
mov dword [ebp - 0x14], 0x5d7b50e9
add dword [ebp - 0x14], 0xe3f1108c
mov dword [ebp - 0x10], 0x4f5ddbe2
add dword [ebp - 0x10], 0x1411908a
mov dword [ebp - 0xc], 0xd0455bee
sub dword [ebp - 0xc], 0xd0455bee
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x4c036834
sub eax, 0x3c00f6b4
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3eeb4
push 0
call eax
mov ecx, 0xf95004f3
add ecx, 0x6b03c26
xor edx, edx
add edx, eax
mov esi, 0x10039800
add esi, dword [ebp - 8]
mov ebx, 0x335c3aab
add ebx, 0xbcd4c0a8
xor dword [ebp - 4], 0xb5df7d12
mov edi, dword [esi]
add dword [ebp - 4], 0xd2520163
sub edi, ebx
mov dword [ebp - 4], 0x9fbedb65
mov dword [edx], edi
add dword [ebp - 4], 0x4faf1209
add edx, 4
add esi, 4
loop 0x10013ec8
add eax, 0xf737
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10021388
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100327bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100331a8], 0
jne 0x10021493
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jbe 0x1002147d
cmp dword [ebp - 0x94], 5
je 0x1002143c
cmp dword [ebp - 0x94], 6
jne 0x10021489
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021430
dec eax
je 0x10021424
dec eax
je 0x10021418
dec eax
jne 0x10021489
mov dword [0x100331a8], 0x6b
jmp 0x10021493
mov dword [0x100331a8], 0x6a
jmp 0x10021493
mov dword [0x100331a8], 0x69
jmp 0x10021493
mov dword [0x100331a8], 0x68
jmp 0x10021493
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021471
dec eax
je 0x10021465
dec eax
je 0x10021459
mov dword [0x100331a8], 0x67
jmp 0x10021493
mov dword [0x100331a8], 0x66
jmp 0x10021493
mov dword [0x100331a8], 0x65
jmp 0x10021493
mov dword [0x100331a8], 0x64
jmp 0x10021493
mov dword [0x100331a8], 1
jmp 0x10021493
mov dword [0x100331a8], 0x6c
mov ecx, dword [ebp - 4]
mov eax, dword [0x100331a8]
xor ecx, ebp
call fcn.1002336a
leave
ret

Function at 0x1002336a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100327bc]
jne 0x10023374
repz ret
jmp fcn.10023b89

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6abf3283
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x7d655054
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0xac186f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3e14dd7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x403e51
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00404b09
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00403fb1
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x403f9b
test ebx, ebx
jl 0x403f3f
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba2b5
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403f60
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x403f52
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00405921
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00405921
add esp, 8
mov ebx, 0x80070057
jmp 0x403f3f
Function at 0x417c10
Capabilities:
Get disk information

Disassembly:
sub esp, 0xbc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x4c2064
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ecx, [esp + 0x10]
mov dword [0x4c5a8c], eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xa]
mov eax, dword [esp + 0xc0]
and edx, 0xffff
and ecx, 0xffff
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 6]
and edx, 0xffff
and ecx, 0xffff
mov dword [eax + 8], edx
mov edx, dword [esp + 2]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp]
and edx, 0xffff
and ecx, 0xffff
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0xb8]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x10]
add ecx, edx
xor edx, edx
test ecx, ecx
mov ecx, dword [eax + 0x20]
setl dl
shl edx, 1
and ecx, 0xfffffffd
or edx, ecx
or edx, 1
mov dword [eax + 0x20], edx
add esp, 0xbc
ret 4