joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007a88b
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push 0x30
mov eax, 0x1009816e
call fcn.1008f84a
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea eax, [ebp - 0x18]
push eax
push 0x100b66cc
push 1
push esi
push 0x100b66dc
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x1007a8d2
mov ecx, dword [ebp + 8]
push esi
call dword [0x100b6094]
jmp 0x1007a9b5
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x100b66bc
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x18]
cmp eax, esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push eax
jge 0x1007a8f6
call dword [ecx + 8]
jmp 0x1007a8c3
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x14]
cmp word [ebp - 0x10], si
je 0x1007a9a8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [ecx + 0x24]
fldz
mov dword [ebp - 0x24], esi
fstp qword [ebp - 0x2c]
lea ebx, [ebp - 0x2c]
lea esi, [ebp - 0x3c]
call fcn.10009d26
neg eax
sbb eax, eax
inc eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x3c], bx
je 0x1007a9a8
cmp word [ebp - 0x36], bx
je 0x1007a9a8
cmp word [ebp - 0x3a], bx
je 0x1007a9a8
push str._b__d___Y__H:_M:_S
lea edi, [ebp - 0x20]
lea ecx, [ebp - 0x2c]
call fcn.10009e5d
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov ecx, edi
mov byte [ebp - 4], bl
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0x100b80dc
lea eax, [ebp + 0xc]
push str.IDS_HOURS
push eax
call sym.ASOHelper.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_STLoadStringFromMainINI_wchar_t_const___wchar_t_const__
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Append]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call dword [0x100b6030]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [ebp + 8]
call fcn.1008f922
ret 8
Function at 0x1007c72e
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10112038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
add edi, 4
mov eax, dword [edi]
xor esi, esi
mov dword [ebp - 0x14], edi
cmp eax, esi
je 0x1007c75a
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [edi], esi
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], esi
mov dword [ebp - 8], esi
mov ebx, SysReAllocStringLen
cmp dword [ebp + 8], esi
je 0x1007c7ab
push dword [ebp + 8]
call edi
push esi
inc eax
cdq
push 2
push edx
push eax
call fcn.1008f810
mov ecx, eax
add eax, ebx
adc edx, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
jne 0x1007c7ab
cmp eax, 0xffffffff
jbe 0x1007c7b0
mov dword [ebp - 0xc], esi
jmp 0x1007c7ee
cmp ecx, 0x400
jg 0x1007c7cf
push ecx
call fcn.1008a9b8
pop ecx
test al, al
je 0x1007c7cf
mov eax, dword [ebp - 0x10]
call fcn.1008edf0
mov eax, esp
jmp 0x1007c7da
push dword [ebp - 0x10]
lea esi, [ebp - 8]
call fcn.1008a97f
push 3
push dword [ebp - 0x10]
mov esi, eax
push dword [ebp + 8]
call fcn.1008aa2e
mov dword [ebp - 0xc], eax
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x1007c814
push dword [ebp + 0xc]
call edi
push esi
inc eax
cdq
push 2
push edx
push eax
call fcn.1008f810
mov edi, eax
add eax, ebx
adc edx, esi
mov dword [ebp - 0x1c], edx
jne 0x1007c814
cmp eax, 0xffffffff
jbe 0x1007c818
xor eax, eax
jmp 0x1007c84e
cmp edi, 0x400
jg 0x1007c836
push edi
call fcn.1008a9b8
pop ecx
test al, al
je 0x1007c836
mov eax, edi
call fcn.1008edf0
mov eax, esp
jmp 0x1007c83f
push edi
lea esi, [ebp - 8]
call fcn.1008a97f
push 3
push edi
push dword [ebp + 0xc]
mov esi, eax
call fcn.1008aa2e
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x1007c887
cmp eax, esi
je 0x1007c887
push dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
push ecx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
cmp dword [ebp - 8], esi
je 0x1007c883
mov eax, dword [ebp - 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
cmp edi, esi
jne 0x1007c86f
mov eax, ebx
jmp 0x1007c8ab
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [ebp - 8], esi
je 0x1007c8a8
mov eax, dword [ebp - 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
cmp edi, esi
jne 0x1007c894
or eax, 0xffffffff
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008e7ae
leave
ret 8
Function at 0x1007d988
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push edi
push 6
lea edx, [esi + 0x10]
pop ecx
xor eax, eax
mov edi, edx
push edx
rep stosd dword es:[edi], eax
call fcn.1008a7f4
xor ebx, ebx
cmp eax, ebx
jge 0x1007d9a8
push eax
call fcn.1000a081
push 6
lea edx, [esi + 0x28]
pop ecx
xor eax, eax
mov edi, edx
push edx
rep stosd dword es:[edi], eax
call fcn.1008a7f4
cmp eax, ebx
jl 0x1007d9a2
or dword [esi + 0x40], 0xffffffff
mov dword [esi], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x2710
cmp dword [0x10116c10], ebx
je 0x1007d9f8
push 0x10116a80
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x10116c10], eax
pop edi
mov eax, esi
pop ebx
ret

Function at 0x1007dafd
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x1007db0f
mov al, 1
jmp 0x1007db81
mov eax, dword [esi + 0x40]
mov byte [ebp - 1], 1
cmp eax, 0xffffffff
jne 0x1007db1f
xor al, al
jmp 0x1007db81
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x1007db7b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1007db75
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1007db78
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x1007db7b
mov dword [esi + 0x48], eax
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
mov byte [esi + 0x44], al
pop ebx
leave
ret 8
Function at 0x1007db86
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1007dbad
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x1007dc54
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x1007dbcb
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x1007dc53
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x1007dc13
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1007dc45
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x1007dc48
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x1007dc3f
mov bl, 1
jmp 0x1007dc48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 0xc
Function at 0x1007dc59
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
mov ebx, eax
call edi
test eax, eax
je 0x1007dc83
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x1007dd3b
push 0
push dword [esi + 4]
call edi
cmp eax, 0x80
jne 0x1007dc9a
mov dword [esi + 0x48], 0x2734
jmp 0x1007dc7c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebx]
and dword [ebx], 0
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1007dcf8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1007dd2d
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1007dd30
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x1007dd27
mov bl, 1
jmp 0x1007dd32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop edi
pop ebx
leave
ret 4

Function at 0x10082316
Capabilities:
Read data from internet
Receive data

Disassembly:
push dword [esp + 0x10]
mov eax, dword [esp + 8]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [eax + 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
ret 0x10
Function at 0x10082381
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
push edi
mov edi, eax
xor ebp, ebp
cmp dword [edi + 0x34fc], ebp
je 0x10082396
xor eax, eax
jmp 0x10082433
mov edx, dword [edi + 0x2480]
mov eax, dword [edx - 0xc]
mov ecx, eax
neg ecx
sbb ecx, ecx
push ebp
and ecx, edx
neg eax
push ebp
sbb eax, eax
push ecx
and eax, 3
push eax
push str.VCSoapClient
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 0x34f8], eax
cmp eax, ebp
je 0x10082429
push ebx
lea ebx, [edi + 0x2484]
cmp dword [ebx], ebp
je 0x100823fc
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
push ebx
push 2
push eax
call esi
push 4
push ebx
push 6
push dword [edi + 0x34f8]
call esi
push 4
push ebx
push 5
push dword [edi + 0x34f8]
call esi
pop esi
movzx eax, word [edi + 0x2450]
push ebp
push ebp
push 3
push ebp
push ebp
push eax
lea eax, [edi + 0x46]
push eax
push dword [edi + 0x34f8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi + 0x34fc], eax
pop ebx
cmp eax, ebp
jne 0x1008238f
call fcn.10082340
mov eax, 0x80004005
pop edi
pop ebp
ret
Function at 0x1008262e
Capabilities:
Send data
Send http request

Disassembly:
push 0xc
mov eax, 0x1009b2d5
call fcn.1008f87d
mov esi, ecx
mov eax, esi
call fcn.10082381
test eax, eax
je 0x1008265b
mov dword [esi + 0x34f4], 4
mov eax, 0x80004005
jmp 0x100827bb
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
xor edi, edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Append_1]
push str.Content_Type:_text_xml__charsetutf_8_r_n
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Append_1]
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x2454]
mov ecx, dword [esi + 0x2494]
sub eax, 3
neg eax
sbb eax, eax
push edi
and eax, 0xff800000
add eax, 0x800000
or eax, 0x400200
push eax
push 0x1011678c
push edi
push str.HTTP_1.0
push ecx
push str.POST
push dword [esi + 0x34fc]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x3500], eax
cmp eax, edi
je 0x1008278f
mov ecx, dword [esi + 0x2474]
mov edx, dword [ecx - 0xc]
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi - 0xc]
push edx
push ecx
push ebx
push edi
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x10082799
mov eax, dword [esi + 0x3500]
push esi
mov dword [esi + 0x247c], eax
call fcn.100828a1
cmp eax, 0x1f4
je 0x10082724
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
jmp 0x100827bb
and dword [ebp + 8], 0
mov dword [esi + 0x34f4], 7
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax]
test eax, eax
jl 0x1008277c
mov byte [ebp - 4], 4
mov edx, dword [ebp + 8]
lea edi, [esi + 0x2478]
push edi
lea ecx, [esi + 0x3504]
mov dword [ebp - 0x18], edi
call fcn.1007f50d
test eax, eax
jge 0x1008276e
mov dword [esi + 0x34f4], 8
mov byte [ebp - 4], 3
test edi, edi
je 0x1008277c
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x10082799
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10082799
mov dword [esi + 0x34f4], 5
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
jmp 0x10082651
call fcn.1008f922
ret 4
Function at 0x1008a5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0
push str.ProxyServer
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008a626
cmp dword [ebp + 8], 1
je 0x1008a5fe
cmp dword [ebp + 8], 2
je 0x1008a5fe
push 0xd
pop eax
jmp 0x1008a626
mov eax, dword [ebp - 4]
test edi, edi
je 0x1008a620
test eax, eax
je 0x1008a61b
test al, 1
jne 0x1008a5f9
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1008a620
jmp 0x1008a5f9
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 4

Function at 0x1008e7ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10112038]
jne 0x1008e7b8
repz ret
jmp fcn.1008ee1c
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x69c908e3
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x57fb6277
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x617b2e47
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x32a62dd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x80a2f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x234000]
push edi
or ebp, 0xffffffff
jmp 0x80a312
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80a319
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80a308
mov eax, 1
add ebx, ebx
jne 0x80a32b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80a33c
jne 0x80a35b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80a35b
dec eax
add ebx, ebx
jne 0x80a348
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x80a320
add ebx, ebx
jne 0x80a357
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x80a3ad
xor ecx, ecx
sub eax, 3
jb 0x80a373
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80a3e2
sar eax, 1
mov ebp, eax
jmp 0x80a37e
add ebx, ebx
jne 0x80a37e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80a34c
inc ecx
add ebx, ebx
jne 0x80a38c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80a34c
add ebx, ebx
jne 0x80a399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80a38e
jne 0x80a3aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80a38e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80a3cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80a3be
jmp 0x80a30e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80a3cc
add edi, ecx
jmp 0x80a30e
pop esi
mov edi, esi
mov ecx, 0x7a82
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80a3ea
cmp byte [edi], 0x1f
jne 0x80a3ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x80a3ef
lea edi, [esi + 0x3fd000]
mov eax, dword [edi]
or eax, eax
je 0x80a45e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x413aac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x413b88]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80a41c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x413b8c]
or eax, eax
je 0x80a458
mov dword [ebx], eax
add ebx, 4
jmp 0x80a439
call dword [esi + 0x413b94]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x80a48f
cmp al, 0xef
ja 0x80a482
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x80a464
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x80a471
mov ebp, dword [esi + 0x413b90]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x80a4c3
sub esp, 0xffffff80
jmp 0x51a374