joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40213e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43814c]
jne 0x402148
repz ret
jmp fcn.00402d4d

Function at 0x40fc7f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43814c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405afb
and dword [ebp - 0x14], 0
cmp dword [0x43afe4], 0
mov dword [ebp - 0x18], eax
jne 0x40fd32
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40fdda
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40fdda
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43afe4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43afe8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43afec], eax
call edi
push eax
call esi
mov dword [0x43aff4], eax
test eax, eax
je 0x40fd32
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43aff0], eax
mov eax, dword [0x43aff0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40fd8b
cmp dword [0x43aff4], ecx
je 0x40fd8b
push eax
call esi
push dword [0x43aff4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40fd8b
test ebx, ebx
je 0x40fd8b
call edi
test eax, eax
je 0x40fd82
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40fd82
test byte [ebp - 8], 1
jne 0x40fd8b
or dword [ebp + 0x10], 0x200000
jmp 0x40fdbe
mov eax, dword [0x43afe8]
cmp eax, dword [ebp - 0x18]
je 0x40fdbe
push eax
call esi
test eax, eax
je 0x40fdbe
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40fdbe
mov eax, dword [0x43afec]
cmp eax, dword [ebp - 0x18]
je 0x40fdbe
push eax
call esi
test eax, eax
je 0x40fdbe
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43afe4]
call esi
test eax, eax
je 0x40fdda
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40fddc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040213e
leave
ret
Function at 0x4294b0
Capabilities:
Get disk information
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x43814c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x43f1fc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push edi
mov ebx, 0x1519a5
mov edi, 0x8e46a7b8
lea esp, [esp]
mov dword [0x43ee64], edi
cmp eax, 0x3dc
jne 0x4294fa
push 0
push 0
push 0
call esi
mov eax, dword [0x43f1fc]
dec ebx
jne 0x4294e0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor esi, esi
jmp 0x429510
cmp eax, 0x933
jne 0x429557
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
mov eax, dword [0x43f1fc]
cmp esi, 0x845fef
jne 0x42956e
mov eax, dword [0x439d60]
add eax, 0xa231
mov dword [0x43f1fc], eax
cmp eax, 0x141
jne 0x429589
mov dword [0x43b508], 0xec58acac
mov dword [0x43b50c], 0xffffffff
inc esi
cmp esi, 0x12d16a2
jl 0x429510
call fcn.00429020
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040213e
add esp, 0x41c
ret 0x10
Function at 0x477cf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x47000]
mov dword [edi + 0x63d00], 0xc48b0577
push edi
jmp 0x477d1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x477d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d10
mov eax, 1
add ebx, ebx
jne 0x477d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x477d44
jne 0x477d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d63
dec eax
add ebx, ebx
jne 0x477d50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x477d28
add ebx, ebx
jne 0x477d5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x477db5
xor ecx, ecx
sub eax, 3
jb 0x477d7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x477dea
sar eax, 1
mov ebp, eax
jmp 0x477d86
add ebx, ebx
jne 0x477d86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d54
inc ecx
add ebx, ebx
jne 0x477d94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d54
add ebx, ebx
jne 0x477da1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x477d96
jne 0x477db2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x477d96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x477dd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x477dc6
jmp 0x477d16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x477dd4
add edi, ecx
jmp 0x477d16
pop esi
mov edi, esi
mov ecx, 0x283d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x477df2
cmp byte [edi], 0x22
jne 0x477df2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x477df7
lea edi, [esi + 0x74000]
mov eax, dword [edi]
or eax, eax
je 0x477e6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b620]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b728]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x477e24
mov ecx, edi
jns 0x477e53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b730]
or eax, eax
je 0x477e69
mov dword [ebx], eax
add ebx, 4
jmp 0x477e41
call dword [esi + 0x7b72c]
mov ebp, dword [esi + 0x7b734]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x477ea3
sub esp, 0xffffff80
jmp 0x42c2ee
Function at 0x401714
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x40a2a0]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [esp + 0x1c], ebx
mov dword [ebp], esi
sub eax, esi
je 0x40188b
dec eax
je 0x4017fc
dec eax
je 0x40179f
dec eax
je 0x40174c
xor eax, eax
inc eax
jmp 0x4018b1
mov edi, esi
mov ecx, dword [0x40a298]
lea eax, [esp + 0x20]
push eax
push 0x10
pop edx
test edi, edi
je 0x401762
mov ecx, eax
call fcn.004018bb
test eax, eax
jne 0x4018b1
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x34]
mov ebp, ebx
sub ebp, dword [esp + 0x34]
mov edx, esi
mov al, byte [ecx + ebp]
xor al, byte [esp + edx + 0x20]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, 0x10
jb 0x401780
mov ebp, dword [esp + 0x38]
inc edi
cmp edi, 0x10
jb 0x40174e
jmp 0x4018a8
mov edi, esi
lea eax, [esp + 0x20]
push eax
push 0x10
pop edx
test edi, edi
jne 0x4017b5
mov ecx, dword [0x40a298]
jmp 0x4017bf
mov eax, edi
shl eax, 4
lea ecx, [ebx - 0x10]
add ecx, eax
call fcn.004018bb
test eax, eax
jne 0x4018b1
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x34]
mov ebp, ebx
sub ebp, dword [esp + 0x34]
mov edx, esi
mov al, byte [ecx + ebp]
xor al, byte [esp + edx + 0x20]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, 0x10
jb 0x4017dd
mov ebp, dword [esp + 0x38]
inc edi
cmp edi, 0x10
jb 0x4017a1
jmp 0x4018a8
mov edi, esi
mov eax, edi
shl eax, 4
mov dword [esp + 0x10], eax
add eax, ebx
lea edx, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.00401915
test eax, eax
jne 0x4018b1
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x10]
mov ebp, esi
mov esi, dword [0x40a298]
mov eax, edx
lea ecx, [esp + 0x20]
sub esi, edx
sub eax, ecx
mov dword [esp + 0x18], eax
test edi, edi
jne 0x401858
lea ecx, [esp + 0x20]
add ecx, ebp
lea edx, [eax + ecx]
mov al, byte [edx + esi]
xor al, byte [ecx]
mov byte [edx], al
mov edx, dword [esp + 0x34]
jmp 0x40186a
mov eax, dword [esp + 0x14]
mov cl, byte [eax + ebp - 0x10]
xor cl, byte [esp + ebp + 0x20]
lea eax, [ebx + ebp]
mov byte [eax + edx], cl
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, 0x10
jb 0x40183e
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x38]
inc edi
push 0
pop esi
cmp edi, 0x10
jb 0x4017fe
jmp 0x4018a8
mov edi, dword [esp + 0x34]
sub edi, ebx
lea edx, [edi + ebx]
mov ecx, ebx
call fcn.00401915
test eax, eax
jne 0x4018b1
inc esi
add ebx, 0x10
cmp esi, 0x10
jb 0x401891
mov dword [ebp], 0x100
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x4023da
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4023ee
sub ecx, edx
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
dec esi
jne 0x4023e5
pop esi
ret 4
Function at 0x402a0a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x33c
push ebx
push ebp
push esi
push edi
push 0x1ff
xor ebx, ebx
lea eax, [esp + 0x51]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebp
call sub.msvcrt.dll_memset
mov eax, dword [ebp]
mov dword [esp + 0x58], eax
lea esi, [ebp + 4]
lea edi, [esp + 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
lea esi, [ebp + 4]
push esi
push ecx
push 4
call fcn.00401107
mov edx, esi
call fcn.00402253
call fcn.00401238
lea ecx, [ebp + 0x14]
lea edx, [esp + 0x60]
call fcn.00402801
lea ebp, [esp + 0x60]
add ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
push 0x10
pop edi
call dword [sym.imp.msvcrt.dll_rand]
and eax, 0x800000ff
jns 0x402a94
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [esi + ebx]
xor cl, byte [esp + ebx + 0x50]
mov byte [esp + ebx + 0x1c], al
xor cl, al
mov byte [ebx + ebp], cl
inc ebx
cmp ebx, edi
jl 0x402a80
add ebp, edi
push ebp
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.00402bc3
add ebp, 0x28
mov dword [ebp - 8], 0x8863d35f
mov dword [ebp - 4], 0x364f463a
lea edx, [esp + 0x24c]
lea edi, [esp + 0x4c]
sub edi, dword [esp + 0x14]
mov ebx, ebp
mov eax, edx
push 0x10
mov dword [esp + 0x14], ebp
sub ebx, eax
pop ebp
movzx ecx, byte [edi + esi]
movzx eax, byte [esi]
xor ecx, eax
mov byte [ebx + edx], cl
inc esi
mov byte [edx], cl
inc edx
dec ebp
jne 0x402ae4
mov ebp, dword [esp + 0x10]
add ebp, 0x10
lea eax, [esp + 0x60]
mov esi, ebp
sub esi, eax
push esi
push eax
lea eax, [esp + 0x264]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [ecx + 0x68]
mov edx, 0x40a240
call fcn.00402c62
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x10]
lea edx, [esp + 0x250]
call fcn.00402cb6
push 0x10
pop ecx
mov edi, ebp
add ebp, ecx
lea eax, [esp + 0x60]
lea esi, [esp + 0x3c]
movsd dword es:[edi], dword [esi]
mov ebx, ebp
sub ebx, eax
mov al, bl
not al
movsd dword es:[edi], dword [esi]
inc al
and al, 0xf
movsd dword es:[edi], dword [esi]
movzx eax, al
cmove eax, ecx
movsd dword es:[edi], dword [esi]
movzx esi, al
push esi
push esi
push ebp
mov byte [esp + 0x1c], al
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x50]
push eax
push ecx
push dword [esp + 0x18]
add ebx, esi
call fcn.00401107
lea edx, [esp + 0x60]
mov ecx, ebx
call fcn.0040228c
call fcn.00401238
mov edi, dword [esp + 0x18]
lea eax, [ebx + 0x14]
push eax
mov dword [edi], eax
call fcn.00402e02
push dword [edi]
mov esi, eax
lea eax, [esp + 0x50]
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x33c
ret

Function at 0x402bc3
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
jmp loc.0040c190
Function at 0x402cb6
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf0000000
xor ebp, ebp
stosd dword es:[edi], eax
push 0x18
push ebp
stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x24]
push eax
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x34], 0x800c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x402d80
lea eax, [esp + 0x18]
push eax
push ebp
push ebp
push 0x1c
push 0x40a234
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x402d80
lea eax, [esp + 0x10]
push eax
push ebp
push dword [esp + 0x20]
push 0x8009
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402d80
push ebp
lea eax, [esp + 0x24]
push eax
push 5
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x402d80
push ebp
push ebx
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402d80
push ebp
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x40]
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x402d80
xor esi, esi
inc esi
jmp 0x402d82
mov esi, ebp
cmp dword [esp + 0x18], ebp
je 0x402d92
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [esp + 0x10], ebp
je 0x402da2
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [esp + 0x14], ebp
je 0x402db3
push ebp
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x402dbf
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push str.KmsRequests
xor ebx, ebx
push ebx
mov dword [ebp - 4], edx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov esi, eax
test esi, esi
je 0x402dfb
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 1
push ebx
push edi
jmp loc.0040c4b0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x64b11960
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x64b119d5
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x64b119a3
cmp eax, 2
jne 0x64b119c0
mov ecx, dword [esp + 0x14]
test esi, esi
je 0x64b119cf
test ecx, ecx
je 0x64b119ca
test cl, 1
jne 0x64b119c0
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x64b119cf
pop edi
mov eax, 0xd
pop esi
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
ret 0xc

Function at 0x64b126b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64b15a8b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 8], eax
lea eax, [esi + 0x54]
mov byte [esi + 0x4c], 0
push eax
mov dword [esi + 0x50], 0x64b16514
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x14], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
call fcn.64b13c70
mov dword [esi + 0x6c], eax
xorps xmm0, xmm0
mov dword [esi + 0x14], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
movdqu xmmword [esi + 0x18], xmm0
movq qword [esi + 0x28], xmm0
movdqu xmmword [esi + 0x30], xmm0
movq qword [esi + 0x40], xmm0
mov dword [esi + 0x48], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x287e6274
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3b8615b3
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
inc edi
sal ch, 0xf
scasb al, byte es:[edi]
mov bl, 0xc3
add ch, 0x5a
cmc
xsaveopt [ebx + 0x5ac580c3]
mov dh, 0xf8
push ebp
xor dword [edi - 0x73], ebx
xor ch, byte [ebp + 0x12aebd5c]
ljmp 0xb9ea
mov ecx, 0xb9ea7c5a
dec ebp
pop esp
test eax, 0x73d5b6ae
mov ecx, 0x468cb70a
mov bl, 0x5f
cmpsb byte [esi], byte es:[edi]
sbb dword [ebp + 0x48], ecx
push edx
dec ebp
sbb ah, 0x1f
mov bh, 0x64
mov bh, 0x64
jnp 0x414b26
dec ecx
jae 0x414a77
jb 0x414a79
mov dword [esi - 0x468c17ba], ebp
jnp 0x414b33
call 0x75bd0431
add byte [esi - 0x19], 0x3e
out 0x3e, eax
imul eax, dword [eax + 0x7dd67b7], 0x96e4b6b2
xor byte [edi - 0x4df82299], 0xb6
in al, 0x96
jo 0x414ac3
cmc
mov word [esp + eax*2], gs
pop edi
test byte [ebx - 0x5123b7b4], 0x16
jno 0x414b4d
dec eax
fsubr qword [esi - 0x468d8eea]
or esi, dword [edi + 0xdb2046c]
mov ecx, 0x46cb70b
mov dl, 0xd
mov byte [esi + 0x7634b7f0], ah
sal dh, cl
mov word [esi - reloc.winhttp.dll_WinHttpCrackUrl], gs
pop edx
in al, dx
jae 0x414aad
dec ebp
setl byte [esi]
mov bh, 0x64
xchg edi, eax
xor al, 0x48
jae 0x414a8f
jno 0x414ab9
mov word [esi - 0x4e], es
mov bh, 0x8c
inc esi
mov dl, WinHttpCloseHandle
mov word [esi - 0x4e], es
mov bh, 0x8c
inc esi
dec ebp
dec eax
jae 0x414acd
mov dl, WinHttpCloseHandle
mov word [esi + 0x4d], es
dec eax
jae 0x414ad5
mov dl, WinHttpCloseHandle
mov word [esi - 0x4e], es
mov bh, 0x8c
inc esi
mov dl, WinHttpCloseHandle
mov word [esi - 0x4e], es
mov bh, 0xf
stosb byte es:[edi], al
mov dh, 0x70
mov byte [edx + 0x5e], ah
pop ds
into
inc esi
mov ebx, 0xb22ec34c
invalid
cmpsd dword [esi], dword es:[edi]
int3