joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419c9a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4282d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00412c85
and dword [ebp - 0x14], 0
cmp dword [0x42a37c], 0
mov dword [ebp - 0x18], eax
jne 0x419d4d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x419df5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x419df5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42a37c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42a380], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42a384], eax
call edi
push eax
call esi
mov dword [0x42a38c], eax
test eax, eax
je 0x419d4d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42a388], eax
mov eax, dword [0x42a388]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x419da6
cmp dword [0x42a38c], ecx
je 0x419da6
push eax
call esi
push dword [0x42a38c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x419da6
test ebx, ebx
je 0x419da6
call edi
test eax, eax
je 0x419d9d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x419d9d
test byte [ebp - 8], 1
jne 0x419da6
or dword [ebp + 0x10], 0x200000
jmp 0x419dd9
mov eax, dword [0x42a380]
cmp eax, dword [ebp - 0x18]
je 0x419dd9
push eax
call esi
test eax, eax
je 0x419dd9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x419dd9
mov eax, dword [0x42a384]
cmp eax, dword [ebp - 0x18]
je 0x419dd9
push eax
call esi
test eax, eax
je 0x419dd9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42a37c]
call esi
test eax, eax
je 0x419df5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x419df7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d58c
leave
ret
Function at 0x42582b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push 0x4092ac
push 0x4092c8
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0xb
call dword [ebp - 4]
cmp dword [ebp - 0xc], 0
je 0x42588e
push dword [ebp - 0xc]
call fcn.0042d4e5
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42588c
xor eax, eax
jmp 0x4258d2
jmp 0x425892
xor eax, eax
jmp 0x4258d2
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0xb
call dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1e]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 0x20]
push eax
push dword [ebp + 8]
call dword [0x40911c]
mov eax, dword [ebp - 8]
jmp 0x464608
leave
ret 4

Function at 0x425b84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 0x14], 1
and dword [ebp - 0x10], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x44], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 8], 0
mov dword [ebp - 0x40], 0x64616f4c
mov dword [ebp - 0x3c], 0x6f736552
mov dword [ebp - 0x38], 0x65637275
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x40]
push eax
push 0x4092f0
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 8], eax
push 0x409300
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [0x4090c8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [0x4090e8]
mov dword [ebp - 4], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call dword [0x4090fc]
cmp dword [ebp + 0x10], 0x65
jne 0x425c2a
mov dword [ebp - 0x1c], 0x843
cmp dword [ebp + 0x10], 0x66
jne 0x425c37
mov dword [ebp - 0x1c], 0x976
push dword [ebp - 4]
call fcn.0042d4e5
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x44]
push dword [ebp - 0x10]
call fcn.0042d4d3
add esp, 0xc
push 0
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.00425697
push 0
push dword [ebp + 0x14]
push 2
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [0x4090c4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x425c94
jmp 0x4643d4
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [0x4090e0]
cmp dword [ebp - 0x10], 0
je 0x425cbe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.0042d4df
pop ecx
cmp dword [ebp - 0x44], 0
je 0x425ccd
push dword [ebp - 0x44]
call dword [0x4090cc]
cmp dword [ebp - 0x18], 0xffffffff
je 0x425cdc
push dword [ebp - 0x18]
call dword [0x409110]
mov eax, dword [ebp - 0x14]
leave
ret 0x10
Function at 0x427561
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 4], 0xffffffff
cmp dword [0x40dc64], 0
jne 0x4275ee
push 0x400
call fcn.0042d4e5
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x40dc64], eax
and dword [ebp - 8], 0
jmp 0x427597
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4275ee
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 8
jmp 0x4275b6
jmp 0x464dbe
cmp dword [ebp - 0x10], 0
jle 0x4275dd
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x4275d3
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x4275db
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4275af
mov eax, dword [ebp - 8]
mov ecx, dword [0x40dc64]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edx
jmp 0x427590
and dword [ebp - 0x14], 0
jmp 0x4275fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x427637
and dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
movsx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x40dc64]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x4275f4
mov eax, dword [ebp - 4]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x428e83
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
jmp loc.0046483c
Function at 0x42b42f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409fb0
push 0x408ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x124
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x38], 0
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
and dword [ebp - 0x70], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x3c], 0
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x8c], 0
and dword [ebp - 0x6c], 0
or dword [ebp - 0x68], 0xffffffff
and dword [ebp - 0x30], 0
and dword [ebp - 0x90], 0
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
push dword [ebp + 8]
call fcn.0042b37c
cmp eax, 1
jne 0x42b4ae
jmp 0x42bab6
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [0x4090c4]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffff
jne 0x42b4d7
jmp 0x42bab6
push 0
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x68]
call fcn.0042aaa2
push 2
push 0
push 0
push dword [ebp - 0x68]
call dword [0x409128]
mov dword [ebp - 0x24], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 0x68]
call dword [0x409174]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x42b51b
jmp 0x42bab6
push 0x400
push 0
push 0
push 0xf001f
push dword [ebp - 0x30]
call dword [0x409160]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x42b548
mov eax, dword [ebp - 0x28]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x42b54d
jmp 0x42bab6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x90], ecx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
cmp dword [ebp - 0x90], eax
jae 0x42b585
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x28]
jbe 0x42b585
mov eax, dword [ebp - 0x90]
movzx eax, word [eax]
cmp eax, 0x4550
invalid
je 0x42b58a
jmp 0x42bab6
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 6]
dec eax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x90]
lea eax, [ecx + eax + 0xf8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0x22]
movzx ecx, word [0x40be6c]
cmp eax, ecx
jl 0x42b5bf
jmp 0x42bab6
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0x22]
test eax, eax
je 0x42b655
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0x22]
movzx ecx, word [0x40be6c]
cmp eax, ecx
jge 0x42b655
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 6]
dec eax
mov ecx, dword [ebp - 0x90]
mov word [ecx + 6], ax
mov eax, dword [ebp - 0x90]
cmp dword [eax + 0x1c], 0
je 0x42b620
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x20]
mov eax, dword [eax + 0x1c]
sub eax, dword [ecx + 8]
mov ecx, dword [ebp - 0x90]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 4]
mov dword [eax + 0x28], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x20]
mov eax, dword [eax + 0x50]
sub eax, dword [ecx + 8]
mov ecx, dword [ebp - 0x90]
mov dword [ecx + 0x50], eax
push 0x400
Function at 0x42c3a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0042d515
test eax, eax
je 0x42c3dd
jmp 0x42c57e
push dword [ebp - 8]
push 0x40
call dword [0x4090b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3f6
jmp 0x42c57e
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409e70
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0042d4d9
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42c555
and dword [ebp - 0x44], 0
jmp 0x42c46d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x42c553
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x42c52d
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409e78
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [0x4090c4]
invalid
invalid
Function at 0x636a11
Capabilities:
Encode data using xor

Disassembly:
jmp loc.00797600
rol al, 4
test bx, sp
push esp
jmp 0x64612b
pushfd
push dword [esp]
lodsb al, byte [esi]
cmc
xor al, 4
mov byte [esp + 4], 0xbf
stc
add al, 0x5d
jmp 0x62e569
pushal
pushal
push 0x5894b754
lea esp, [esp + 0x44]
jae 0x62f8cb
inc bl
pushal
push dword [esp + 4]
mov bl, 2
push edx
pushfd
inc ecx
mov al, bl
push 0x33684636
mov al, 0x10
lea esp, [esp + 0x30]
call fcn.0062e4b7
push 0x30a9814b
call fcn.00784189
test eax, 0x503e6b68
xor al, ch
call 0xbba26a12
iretd
mov byte [esp], 0x1c
lea esp, [esp + 0xc]
jo 0x7640e1
pushal
lea esp, [esp + 0x20]
call fcn.00636ec8
jmp 0x6369b8
stc
not al
pushfd
pushal
sub al, 0x2c
pushfd
push ebp
shr eax, 1
jmp 0x62c454
xchg byte [eax + 0x3eb6aba8], al
std
pop edi
and al, 0xb
dec ecx
push esi
mov al, 0xf4
invalid
pushfd
call fcn.00646087
push ebp
push ebx
out dx, al
call dword [ebp + 0x53]
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add ah, ch
mov cl, 0xae
mov dh, 0xaa
je 0x7640e1
ja 0x7640a3
xor byte [ebp + 0x35], ch
cdq
jb 0x764154
jg 0x7640e5
cmp byte [edx + 0x75e03cf0], ah
mov eax, dword [0x95eab698]
movsd dword es:[edi], dword [esi]
leave
sub byte [0x58042a9c], dl
adc eax, 0x58042a9c
push 0x14
wait
mov eax, 0xdd8ad52c
rcr dword [ebp - 0x682fce51], 0xa4
aas
mov al, byte [0x63ce51ff]
sbb al, byte [ecx + 0x3a24dcc0]
mov ebp, 0x1ad0f068
pop edx
div ah
sub byte [ebx + 0x62944628], ch
push eax
frstor dword [edx + 0x48983dd7]
inc esi
int3
push esi
jl 0x764111
xchg esi, eax
mov dh, ch
lodsb al, byte [esi]
das
stc
and dword [edx - 0x951449e], edi
shr dword [eax - 0x15], 1
mov eax, dword [0x5a3e830]
add al, byte [eax]
bound ebp, qword [edx - 0x4d1235bb]
test al, 0xb7
jmp 0x2ea829f1
Function at 0x429400
Capabilities:
Get disk information
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x43814c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x43f1fc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push edi
mov ebx, 0x1519a5
mov edi, 0x8e46a7b8
lea esp, [esp]
mov dword [0x43ee64], edi
cmp eax, 0x3dc
jne 0x42944a
push 0
push 0
push 0
call esi
mov eax, dword [0x43f1fc]
dec ebx
jne 0x429430
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor esi, esi
jmp 0x429460
cmp eax, 0x933
jne 0x4294a7
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
mov eax, dword [0x43f1fc]
cmp esi, 0x845fef
jne 0x4294be
mov eax, dword [0x439d60]
add eax, 0xa231
mov dword [0x43f1fc], eax
cmp eax, 0x141
jne 0x4294d9
mov dword [0x43b508], 0xec58acac
mov dword [0x43b50c], 0xffffffff
inc esi
cmp esi, 0x12d16a2
jl 0x429460
call fcn.00428f70
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040213e
add esp, 0x41c
ret 0x10
Function at 0x10179851
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101794ce
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, ecx
cmp eax, 0x22
cmp eax, 0x54
cmp eax, 0x55
cmp eax, 0x403c8ab2
nop
mov eax, 0xf19de1ad
cmp eax, 0xf
cmp eax, 0xffffffeb
cmp eax, 0xe20a575a
mov eax, ecx
cmp eax, 0x8427a4ca
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, 0x96f52c00
mov eax, 0xa10e5e7e
mov eax, 0x129b83e3
mov eax, ecx
mov eax, ecx
mov eax, ebx
cmp eax, 0x64
mov eax, ebx
mov eax, 0x97642f7c
inc eax
inc eax
mov eax, ecx
mov eax, ecx
cmp eax, 0xffffffbf
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
nop
cmp eax, 0x9e326f6c
cmp eax, 0x767cdb76
cmp eax, 0x535823a4
cmp eax, 0xffffffc1
mov eax, 0x5e4ac718
nop
nop
nop
mov eax, ecx
cmp eax, 0x7b
mov eax, 0x9cfd53b3
mov eax, ecx
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, ebx
cmp eax, 0xffffffad
mov eax, ecx
nop
mov eax, ebx
nop
mov eax, 0xa60b77c5
mov eax, ecx
inc eax
nop
nop
cmp eax, 0x32c75814
mov eax, 0xf4f537e3
mov eax, ebx
inc eax
nop
mov eax, ecx
cmp eax, 0x70
inc eax
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, ebx
nop
mov eax, 0xc70a3684
mov eax, ebx
mov eax, ebx
nop
mov eax, ebx
cmp eax, 0xa2855eb
cmp eax, 0xa024c4aa
mov eax, ecx
inc eax
cmp eax, 0x3a
mov eax, 0xf7fbcfb
nop
mov eax, ecx
mov eax, ecx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ebx
cmp eax, 0x6b
mov eax, ecx
mov eax, 0xfd0ab2f6
nop
nop
inc eax
inc eax
mov eax, ebx
nop
mov eax, ecx
mov eax, ebx
mov eax, ebx
cmp eax, 0xffffffa5
mov eax, ebx
mov eax, ebx
inc eax
mov eax, 0x8b2fd9b
cmp eax, 0xffffff8d
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e770
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5e6

Function at 0x401ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.00401be9
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4034ed
push eax
sub edi, fcn.00402c97
push edi
push fcn.00402c97
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401d1c
mov eax, fcn.00402c97
mov ebx, esi
mov edx, edi
call fcn.00401be9
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call section.AUTO
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.0040189e
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00402c97
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x414de9
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], ecx
add edx, 4
or ebx, esi
cmp edx, edi
jne fcn.00414de9
mov eax, 0x35520344
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5e072b9f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x43992e06
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x405950
Capabilities:
Check os version
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x425fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xec
lea ecx, [esp]
call fcn.0040e550
mov eax, str.control_mmsys.cpl
mov dword [esp + 0xf4], 0
test eax, eax
je 0x405993
push str.control_mmsys.cpl
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.control_mmsys.cpl
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::AssignCopy
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x5c]
cmp eax, 4
jne 0x4059cc
cmp dword [esp + 0x60], 0x5a
jne 0x4059f0
push 0x43128c
jmp 0x4059e7
jbe 0x4059f0
cmp eax, 5
jne 0x4059e2
mov eax, dword [esp + 0x60]
test eax, eax
jne 0x4059e2
push 0x43128c
jmp 0x4059e7
push 0x431288
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_1
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0x44
mov word [esp + 0x6c], 5
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 4]
mov dword [esp + 0xf8], 0xffffffff
call fcn.00424f94
mov ecx, dword [esp + 0xf0]
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x40b020
Capabilities:
Check os version

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0xa8]
push str.Unknown
mov ecx, ebp
mov dword [esi + 8], edi
call fcn.00425078
lea ebx, [esi + 0xc]
mov dword [esi + 4], edi
mov ecx, 0x27
xor eax, eax
mov edi, ebx
push ebx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebx], 0x9c
call edi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40b06f
push ebx
mov dword [ebx], 0x94
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
sub ecx, 0
mov dword [esi + 4], eax
je 0x40b1f7
dec ecx
je 0x40b176
dec ecx
je 0x40b0a1
push str.Undetermined
mov ecx, ebp
call fcn.00425078
jmp 0x40b20a
mov eax, dword [esi + 0x10]
sub eax, 3
je 0x40b15e
dec eax
je 0x40b146
dec eax
je 0x40b0c8
push str.Undetermined
mov ecx, ebp
call fcn.00425078
jmp 0x40b20a
mov eax, dword [esi + 0x14]
sub eax, 0
je 0x40b12e
dec eax
je 0x40b0e4
push str.Undetermined
mov ecx, ebp
call fcn.00425078
jmp 0x40b20a
push str.WinXP
mov ecx, ebp
call fcn.00425078
mov eax, dword [esp + 0x10]
mov dword [esi + 8], 4
test eax, eax
je 0x40b20a
test byte [esi + 0xa5], 2
je 0x40b11d
push str._Home_Edition
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
jmp 0x40b20a
push str._Professional
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
jmp 0x40b20a
push str.Win2000
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 3
jmp 0x40b20a
push str.WinNT4
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 2
jmp 0x40b20a
push str.WinNT_3.51
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 1
jmp 0x40b20a
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x40b1e2
cmp ecx, 0xa
je 0x40b1aa
cmp ecx, 0x5a
je 0x40b195
push str.Undetermined
mov ecx, ebp
call fcn.00425078
jmp 0x40b20a
push str.WinME
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 8
jmp 0x40b20a
cmp eax, 0x7ce
jne 0x40b1c6
push str.Win98
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 6
jmp 0x40b20a
cmp eax, 0x8ae
jb 0x40b20a
push str.Win98SE
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 7
jmp 0x40b20a
push str.Win95
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 5
jmp 0x40b20a
push str.Win31
mov ecx, ebp
call fcn.00425078
mov dword [esi + 8], 9
mov al, byte [esi + 0x20]
add esi, 0x20
test al, al
je 0x40b228
push 0x4312d0
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
push esi
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret