joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11b12210
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x11b50c50]
sub esp, 0x114
test eax, eax
jne 0x11b1235d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x11b50ae8
mov dword [0x11b50c50], 1
mov dword [0x11b50ae8], 0x94
call esi
mov edx, dword [0x11b50af8]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x11b49990], eax
je 0x11b12338
push ebx
push 0x11b50b80
mov dword [0x11b50b80], 0x9c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x11b50c44], eax
call edi
mov dword [0x11b50c48], eax
mov eax, dword [0x11b50c44]
test eax, eax
push 0x11b50c20
je 0x11b122b4
call eax
jmp 0x11b122ba
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x11b50b84]
cmp eax, 6
jae 0x11b122d2
cmp eax, 5
jne 0x11b122e6
cmp dword [0x11b50b88], 2
jb 0x11b122e6
cmp word [0x11b50c20], 9
jne 0x11b122e6
mov dword [0x11b50adc], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x11b12304
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x11b50c4c], edx
jmp 0x11b1230a
mov edx, dword [0x11b50c4c]
test edx, edx
je 0x11b12338
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x11b12338
mov ecx, dword [esp + 0x14]
mov dword [0x11b50af4], ecx
push 0x11b50af0
push 0x11b50aec
call fcn.11b12700
add esp, 8
call fcn.11b12370
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x11b13590
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11b30948
push 0x11b094a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x11b50c54]
xor ebx, ebx
cmp eax, ebx
jne 0x11b136f0
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x11b136eb
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x11b30754
lea ecx, [ebp - 0x11c]
push ecx
push str._s_s
lea edx, [ebp - 0x224]
push edx
call fcn.11b03192
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
push eax
call fcn.11b01c91
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x11b136eb
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x11b136e2
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x11b136e2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x11b50c54], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x11b136e2
push esi
call fcn.11b01c86
add esp, 4
mov eax, dword [0x11b50c54]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x11b1e3d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
test ebx, ebx
jne 0x11b1e3ec
xor eax, eax
pop ebx
add esp, 0x104
ret
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.11b025e0
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.11b024b0
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x11b1e470
cmp byte [esp + 0x10], 0x5c
jne 0x11b1e470
cmp byte [esp + 0x11], 0x5c
jne 0x11b1e470
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.11b024b0
add esp, 8
test eax, eax
je 0x11b1e4ee
inc eax
push 0x5c
push eax
call fcn.11b024b0
add esp, 8
mov esi, eax
test esi, esi
je 0x11b1e4ee
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x11b1e4b2
test bl, 1
je 0x11b1e4a1
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x11b1e524
cmp ebx, 0xffffffff
je 0x11b1e4bb
test edi, edi
jne 0x11b1e4ca
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x11b1e524
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.11b024b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x11b1e474
test ebp, ebp
je 0x11b1e524
mov ebx, dword [esp + 0x118]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x11b1e519
test al, 0x10
jne 0x11b1e524
test al, 1
je 0x11b1e50c
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x11b1e524
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x11b1e540
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x11b1e55c
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.11b01fd5
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.11b02447
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.11b0211b
add esp, 0x18
cmp eax, 2
jbe 0x11b1e5e1
cmp word [esp + 0x10], di
jne 0x11b1e5e1
cmp word [esp + 0x12], di
jne 0x11b1e5e1
lea eax, [esp + 0x14]
push edi
push eax
call fcn.11b02447
add esp, 8
test eax, eax
je 0x11b1e669
add eax, 2
push edi
push eax
call fcn.11b02447
add esp, 8
mov esi, eax
test esi, esi
je 0x11b1e669
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x11b1e629
test bl, 1
je 0x11b1e618
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x11b1e69f
cmp ebx, 0xffffffff
je 0x11b1e632
test edi, edi
jne 0x11b1e641
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x11b1e69f
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.11b02447
mov esi, eax
add esp, 8
test esi, esi
jne 0x11b1e5e9
test ebp, ebp
je 0x11b1e69f
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x11b1e694
test al, 0x10
jne 0x11b1e69f
test al, 1
je 0x11b1e687
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x11b1e69f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x40c4b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x409015
lea edi, [esi - 0x8015]
push edi
jmp 0x40c4ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c4d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c4c0
mov eax, 1
add ebx, ebx
jne 0x40c4e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4d8
jne 0x40c4f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4d8
xor ecx, ecx
sub eax, 3
jb 0x40c508
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c57a
mov ebp, eax
add ebx, ebx
jne 0x40c513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c544
inc ecx
add ebx, ebx
jne 0x40c530
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c525
jne 0x40c541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c525
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c555
jmp 0x40c4c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c564
add edi, ecx
jmp 0x40c4c6
pop esi
mov edi, esi
mov ecx, 0x1c2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c582
cmp byte [edi], 2
jne 0x40c582
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40c587
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5f6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c5b4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc058]
or eax, eax
je 0x40c5f0
mov dword [ebx], eax
add ebx, 4
jmp 0x40c5d1
call dword [esi + 0xc054]
mov ebp, dword [esi + 0xc05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c62a
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x100018b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1000a838]
sub esp, 0x114
push esi
mov esi, dword [esp + 0x11c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000191e
mov ecx, esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
shr ecx, 0x10
jne 0x100018f1
push esi
lea edx, [esp + 0xc]
push 0x10009a58
push edx
call edi
add esp, 0xc
lea esi, [esp + 8]
push esi
lea eax, [esp + 0x1c]
push 0x10009a30
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x10
push 0x10009a28
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
add esp, 0x114
ret 4

Function at 0x10001930
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x30c
cmp eax, 1
jne 0x100019de
mov eax, dword [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea ecx, [esp]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp]
push 0x10009a7c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x1000a838], eax
jne 0x100019c0
lea ecx, [esp]
lea edx, [esp + 0x104]
push ecx
push 0x10009a5c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x104]
push 0x10
push 0x10009a28
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x1000a838]
test eax, eax
je 0x100019d3
call fcn.10001630
mov eax, 1
add esp, 0x30c
ret 0xc
xor eax, eax
add esp, 0x30c
ret 0xc
test eax, eax
jne 0x100019f2
mov eax, dword [0x1000a838]
test eax, eax
je 0x100019f2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add esp, 0x30c
ret 0xc

Function at 0x10002a80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100040d8
push 0x10003dc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x10002b1b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x10002b1b
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
mov esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x10002b1b
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x10002b1b
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100040e8
push 0x10003dc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100035fa
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x100035f3
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ecx], 0x4550
jne 0x100035f3
cmp word [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
je 0x100035fa
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4286e8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x42870c
xor eax, eax
jmp 0x428862
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x42872a
xor eax, eax
jmp 0x428862
push 0x3d05
push 1
push dword [ebp - 8]
push 0x4648
push 0x5de6
lea eax, [ebp - 0xc]
push eax
push 0x62bf
push 0xf3d
call fcn.004281f5
add esp, 0x20
cmp dword [ebp - 0xc], 0
jne 0x428761
xor eax, eax
jmp 0x428862
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push 0x7720
push 0x792b
push 0x2118
call fcn.00428397
add esp, 0x24
push dword [ebp - 8]
push 0x4be4
push 0
push dword [ebp + 8]
push 0x56ef
push dword [ebp - 4]
call fcn.004273c6
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x4287d6
push 0x6a2b
push dword [ebp - 0x14]
push 1
push 0x2dca
push dword [ebp - 4]
push 0x32b8
call fcn.004273c6
add esp, 0x18
push dword [ebp - 4]
call fcn.004280da
pop ecx
test eax, eax
jne 0x4287e7
xor eax, eax
jmp 0x428862
push 0x9b3
push 0x24fe
push dword [ebp - 4]
push 0x2f79
push 0x5b91
push 1
call fcn.00426bb1
add esp, 0x18
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x42884a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x428827
xor eax, eax
jmp 0x428862
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x428840
xor eax, eax
jmp 0x428862
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x42885b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x42885f
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7c826e7c
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1bc0074e
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401021
push eax
push dword [esp + 8]
call fcn.00401919
pop ecx
xor eax, eax
pop ecx
inc eax
ret

Function at 0x401022
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret

Function at 0x4010dd
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x54
push edi
mov edi, dword [esp + 0x60]
cmp byte [edi], 0
je 0x401214
push ebx
mov bl, byte [esp + 0x60]
cmp bl, 0x44
je 0x401106
cmp bl, 0x54
je 0x401106
cmp bl, 0x45
jne 0x401213
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, 0x400
push ebp
push 0x40
call esi
push ebp
push 0x40
mov dword [esp + 0x74], eax
call esi
mov ebp, eax
cmp bl, 0x45
jne 0x40113a
push edi
push str.__s___regserver
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40119f
cmp dword [esp + 0x70], 0
push 0x400
jne 0x401174
mov esi, dword [esp + 0x70]
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401205
push edi
movsx eax, bl
mov ebx, esi
push eax
push ebx
push str.__s____c_s
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x40119c
mov ebx, dword [esp + 0x70]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x401219
push edi
push ebx
push str.__s_regsvr32.exe___s___s_
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
call fcn.00401aec
add esp, 0x14
push 0x44
pop esi
push esi
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00401bb2
add esp, 0xc
mov dword [esp + 0x20], esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4011f2
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
cmp dword [esp + 0x70], 0
je 0x401201
push 1
call fcn.00401aec
pop ecx
mov esi, dword [esp + 0x6c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push ebp
call esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x54
ret
mov esi, ebx
jmp 0x401205
Function at 0x40121d
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x54
xor eax, eax
push ebx
mov ebx, dword [esp + 0x60]
cmp word [ebx], ax
je 0x401356
push edi
mov di, word [esp + 0x60]
push 0x45
pop ecx
push 0x44
pop eax
cmp di, ax
je 0x401250
cmp di, 0x54
je 0x401250
cmp di, cx
jne 0x401355
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x800
push 0x40
call esi
push 0x800
push 0x40
mov ebp, eax
call esi
mov esi, eax
push 0x45
pop eax
mov dword [esp + 0x6c], esi
cmp di, ax
jne 0x40128c
push ebx
push 0x402174
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4012e2
cmp dword [esp + 0x70], 0
push 0x400
push ebp
jne 0x4012c0
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401344
push ebx
movzx eax, di
push eax
push ebp
push 0x4021a4
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x4012df
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x401344
push ebx
push ebp
push 0x4021c8
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
call fcn.00401aec
add esp, 0x14
push 0x44
pop edi
push edi
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00401bb2
add esp, 0xc
mov dword [esp + 0x20], edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401335
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
cmp dword [esp + 0x70], 0
je 0x401344
push 1
call fcn.00401aec
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call esi
push dword [esp + 0x6c]
call esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x54
ret