joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007fba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a6ac
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000803c
push esi
call fcn.100129d0
pop ecx
test eax, eax
jne 0x10008034
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008043
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x10008034
cmp edi, 0xb7
je 0x10008034
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10008034
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor al, al
pop edi
pop esi
ret 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x1000803e

Function at 0x1000836f
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x1001ff00]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x7b0]
push ebx
push esi
push edi
push dword [0x1001ff58]
movlpd qword [ebp - 0x80], xmm0
push eax
push ecx
call fcn.1000a1e8
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x60]
push 0x400
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
test eax, eax
je 0x1000840e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000840e
mov eax, dword [ebp + 0x7bc]
sub eax, 0
je 0x10008406
sub eax, 1
je 0x100083fe
sub eax, 1
jne 0x1000840e
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp 0x10008414
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
jmp 0x10008414
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x74]
jmp 0x10008414
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x80]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, dword [ebp + 0x7a4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10014785
add ebp, 0x7a8
leave
ret 0x10
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x100129d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100129df
pop dword [ebp - 0x20]
mov eax, 0x342b9d8c
add eax, 0xdbd58c53
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9309faaa
add dword [ebp - 0x30], 0xbb484aa1
mov dword [ebp - 0x2c], 0xfe827e1e
sub dword [ebp - 0x2c], 0xcc4f31d9
mov dword [ebp - 0x28], 0x5c186765
sub dword [ebp - 0x28], 0xfcc2337
mov dword [ebp - 0x24], 0x89406ccd
add dword [ebp - 0x24], 0x76bf9333
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x7b6cdc4
sub dword [ebp - 0x30], 0x9344646e
mov dword [ebp - 0x2c], 0x4654d0fb
sub dword [ebp - 0x2c], 0x4e86f86
mov dword [ebp - 0x28], 0x6556c317
add dword [ebp - 0x28], 0xfe18a955
mov dword [ebp - 0x24], 0x22afc4dc
add dword [ebp - 0x24], 0xdd503b24
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c3d2
push 0
call eax
mov ecx, 0x171a9e9d
sub ecx, 0x171a440b
xor ebx, ebx
add ebx, eax
mov edx, 0x706af373
add edx, 0x9f97428d
add edx, dword [ebp - 0x20]
mov edi, 0x5f5a32b9
xor dword [ebp - 0x18], 0x12827f58
mov esi, dword [edx]
xor dword [ebp - 0x14], ebx
xor esi, edi
add dword [ebp - 0x10], edi
mov dword [ebx], esi
sub dword [ebp - 0xc], 0xe128e0e5
add ebx, 0x53f62932
add ebx, 0xac09d6d2
add edx, 4
loop 0x10012af3
add eax, 0x9bca2a01
add eax, 0x6437331a
mov ebx, eax
add eax, 0x4283d349
sub eax, 0x4283d344
mov ecx, 0xb88a7ff6
sub ecx, 0xa88a7ff6
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4086d9
pop dword [ebp - 0x18]
mov eax, 0x25557d5d
add eax, 0xdaeb097c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd72e8b7f
sub dword [ebp - 0x28], 0x88dc4634
mov dword [ebp - 0x24], 0x636ed802
add dword [ebp - 0x24], 0xcec47443
mov dword [ebp - 0x20], 0x4d7b3bf6
add dword [ebp - 0x20], 0xfed10838
mov dword [ebp - 0x1c], 0x95927626
add dword [ebp - 0x1c], 0x6a6d89da
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x571092f7
sub dword [ebp - 0x28], 0xe29e29a1
mov dword [ebp - 0x24], 0xb7a9324c
sub dword [ebp - 0x24], 0x763cd0d7
mov dword [ebp - 0x20], 0x6dd975cd
sub dword [ebp - 0x20], 0xa6a0961
mov dword [ebp - 0x1c], 0x8b53b6a7
add dword [ebp - 0x1c], 0x74ac4959
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xf888bfdf
sub eax, 0xf847ef93
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c945
push 0
call eax
mov ecx, 0x543d
xor ebx, ebx
add ebx, eax
mov esi, 0x7fbd7148
sub esi, 0x7f7bc148
add esi, dword [ebp - 0x18]
mov edx, 0xd94e4d2f
xor dword [ebp - 4], eax
mov edi, dword [esi]
add dword [ebp - 0x10], 0x7fc320db
add edi, edx
xor dword [ebp - 0x14], 0xa0dda36e
mov dword [ebx], edi
xor dword [ebp - 4], 0xe6de5aff
add ebx, 0x99ce8760
sub ebx, 0x99ce875c
add esi, 0xb6f619bf
sub esi, 0xb6f619bb
loop 0x4087ec
add eax, 0xc5767257
add eax, 0x3a8ad170
xor ebx, ebx
add ebx, eax
add eax, 0x89e27532
add eax, 0x761d8ad3
mov ecx, 0x563d384e
add ecx, 0xaa02c7b2
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x28b04633
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x79041bee
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x10005480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.100048c7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000487c
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.100048b7
movsd dword es:[edi], dword [esi]
add byte [ebp + 0x71], dh
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.100048c7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x10005566
call fcn.1000487c
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.100048b7
arpl word [edx], bp
iretd
Function at 0x408f09
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408f47
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408f4e
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c748
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x40911c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4308e4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x409159
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409136
mov dword [ecx*4 + 0x4308e0], eax
inc ecx
cmp ecx, 0x100
jne 0x40912f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x40917c
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4308e0]
jmp 0x409163
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x480000
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Packed with generic packer
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
pushal
push 0x480031
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x48003a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [0x480047]
push 0
push 0
push 0
push edx
push 0
push 0
call eax
popal
jmp fcn.0040454c
Function at 0x435e21
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00435d33
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x435e52
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0x10]
call fcn.00436a27
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x24], 0
je 0x435e72
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x28], 0
je 0x435e92
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x2c], 0
je 0x435eb2
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
je 0x435ee2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.0042a3f9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x16c], 0
je 0x435f2b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x435f17
push 1
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x435f1e
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x16c], 0
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4086eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4086fa
pop dword [ebp - 0x34]
mov eax, 0xf0e94605
add eax, 0xf5740f5
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x1b59c23d
sub dword [ebp - 0x44], 0xcd077cf2
mov dword [ebp - 0x40], 0xc057abe8
sub dword [ebp - 0x40], 0x8e245fa3
mov dword [ebp - 0x3c], 0x6ee6c2c
sub dword [ebp - 0x3c], 0xbaa227fe
mov dword [ebp - 0x38], 0x564a193a
add dword [ebp - 0x38], 0xa9b5e6c6
lea eax, [ebp - 0x44]
push eax
mov eax, 0x99f70225
add eax, 0x664eae3f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x8c5d1a78
sub dword [ebp - 0x44], 0x17eab122
mov dword [ebp - 0x40], 0x656d95c
add dword [ebp - 0x40], 0x3b158819
mov dword [ebp - 0x3c], 0x3cd2916a
sub dword [ebp - 0x3c], 0xd96324fe
mov dword [ebp - 0x38], 0x686baca
add dword [ebp - 0x38], 0xf9794536
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x37010015
sub eax, 0x36bb4f95
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4b319
push 0
call eax
mov ecx, 0xf879b072
add ecx, 0x7868f26
mov edx, eax
mov esi, 0x5793ac1c
sub esi, 0x574c4c1c
add esi, dword [ebp - 0x34]
mov ebx, 0x8b008344
sub ebx, 0x58bcce4a
xor dword [ebp - 0xc], edi
mov edi, dword [esi]
sub edi, ebx
mov dword [edx], edi
add dword [ebp - 0x30], 0xa87de014
add edx, 0xaf4785ae
sub edx, 0xaf4785aa
add esi, 0x4eb818d4
sub esi, 0x4eb818d0
loop 0x40881c
add eax, 0x2cc40749
add eax, 0xd33ce9ea
xor ebx, ebx
add ebx, eax
add eax, 0x624d80ba
sub eax, 0x624d80b5
mov ecx, 0x7a08fdec
sub ecx, 0x79c8fdec
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4078ae
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add dh, ah
lodsb al, byte [esi]
add dl, bh
dec edx
bound esi, qword [esi + 0x39]
dec edx
movsd dword es:[edi], dword [esi]
invalid
inc eax
pop esi
xor dword [esi + 0xe], 0x74e5d333
sub esi, 0xfffffffc
loop 0x4078b1
mov bl, byte [edi + 0x3b3374e7]
sbb cl, byte [ebx + 0x2a242ccc]
add ebx, dword [edi + 0x29d173eb]
mov ch, 0x20
arpl word [eax - 0x50125cc6], ax
enter 0x678a, 0x5c
sub byte [edx + 0xd], bh
or ah, byte [edx + 0x71997f31]
mov dword [0x6efccba3], eax
xchg ebx, eax
mov edx, 0xc2a55ee1
wait
jnp 0x407885
sbb byte [eax - 0x48b094b5], bh
sbb dword [edx - 0x42b8fac6], ecx
invalid
Function at 0x401330
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x7f4], str.FFFTWAREFFasses
mov dword [ebp - 0x7a4], str.yysid0afaced1_e828_11d1_9187_b532f1e9575dinprocserver32
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x13
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x200
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4014b3
call entry0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x40d0c8], ecx
mov edx, dword [ebp - 0x7f4]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7f4]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7f4]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7f4]
push edx
push 0x80000002
call dword [0x40d0c8]
test eax, eax
je 0x401511
xor eax, eax
jmp 0x4017b3
mov eax, dword [ebp - 0x7a4]
mov byte [eax], 0x63
mov ecx, dword [ebp - 0x7a4]
mov byte [ecx + 1], 0x6c
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x7a4]
push eax
push 0x80000000
call dword [0x40d0c8]
test eax, eax
je 0x401545
xor eax, eax
jmp 0x4017b3
push 1
mov ecx, dword [0x40d0c4]
push ecx
jmp section..htext
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x15935a3a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x7d8366e7
nop
nop
nop
nop
nop
test eax, eax
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100204c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100204cf
pop dword [ebp - 0x30]
mov eax, 0xd6f8d86d
sub eax, 0xc6f6d39e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa811068c
add dword [ebp - 0x40], 0xa6413ebf
mov dword [ebp - 0x3c], 0xbb5db620
sub dword [ebp - 0x3c], 0x892a69db
mov dword [ebp - 0x38], 0xf17c0cee
sub dword [ebp - 0x38], 0xa52fc8c0
mov dword [ebp - 0x34], 0x628c3502
add dword [ebp - 0x34], 0x9d73cafe
lea eax, [ebp - 0x40]
push eax
mov eax, 0x2dcea9e9
sub eax, 0x1dbf78d9
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x55d1b381
sub dword [ebp - 0x40], 0xe15f4a2b
mov dword [ebp - 0x3c], 0xddf57130
add dword [ebp - 0x3c], 0x6376f045
mov dword [ebp - 0x38], 0x48084517
add dword [ebp - 0x38], 0x1b672755
mov dword [ebp - 0x34], 0xf1d0fe50
sub dword [ebp - 0x34], 0xf1d0fe50
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xc93e649c
sub eax, 0xb92f33f4
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x88ada
push 0
call eax
mov ecx, 0x539b
xor edi, edi
add edi, eax
mov edx, 0x10136a00
add edx, dword [ebp - 0x30]
mov esi, 0x79d116d3
sub esi, 0xb410196e
sub dword [ebp - 0x18], ecx
mov ebx, dword [edx]
sub dword [ebp - 0x10], 0x178375a7
xor ebx, esi
add dword [ebp - 0x24], 0xf56bfcf2
mov dword [edi], ebx
add dword [ebp - 8], 0x556a9eae
add edi, 0x9235e0cc
sub edi, 0x9235e0c8
add edx, 0x84a9ebbf
add edx, 0x7b561445
loop 0x100205e7
add eax, 0x1413f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret