joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60c5e0
Capabilities:
Terminate process

Disassembly:
mov eax, 8
call fcn.005dfc90
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
push ebx
xor edi, edi
call fcn.004797c0
add esp, 4
test eax, eax
jle 0x60c7ba
push edi
push ebx
call fcn.00479a10
mov esi, eax
mov dword [esp + 0x18], 0
push 0x9c
push esi
xor ebp, ebp
call fcn.0060c800
add esp, 0x10
test eax, eax
je 0x60c631
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
push 0x9d
push esi
call fcn.0060c800
add esp, 8
test eax, eax
je 0x60c646
mov ebp, dword [eax + 4]
push esi
call fcn.0060c8f0
add eax, 0xffffff6a
add esp, 4
cmp eax, 5
ja case.0x60c65d.153
jmp dword [eax*4 + 0x60c7dc]
mov ebp, dword [esp + 0x28]
test ebp, ebp
je case.0x60c65d.153
cmp dword [ebp], 0
jne case.0x60c65d.153
push esi
call fcn.0060c820
push eax
call fcn.004fa200
add esp, 8
mov dword [ebp], eax
jmp 0x60c7a4
mov ebp, dword [esp + 0x28]
test ebp, ebp
je case.0x60c65d.153
cmp dword [ebp], 0
jne case.0x60c65d.153
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.0060c900
mov esi, eax
add esp, 0xc
test esi, esi
je 0x60c7d0
push esi
call fcn.004fa200
push esi
mov dword [ebp], eax
call fcn.004f4780
add esp, 8
cmp dword [ebp], 0
jmp 0x60c7a6
cmp dword [esp + 0x2c], 0
je case.0x60c65d.153
push esi
call fcn.0060c8b0
add esp, 4
cmp eax, 0x9e
jne case.0x60c65d.153
push esi
call fcn.0060c860
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x60c7d0
test ebp, ebp
je 0x60c72a
push dword [ebp]
push dword [ebp + 8]
push ebx
call fcn.005097d0
add esp, 0xc
test eax, eax
je 0x60c7c7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x60c76b
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004a18a0
add esp, 8
test eax, eax
js 0x60c76b
push eax
push dword [esp + 0x18]
push ebx
call fcn.005096c0
push 0xec
push str.cryptopkcs12p12_kiss.c
push dword [esp + 0x28]
mov esi, eax
call fcn.004679c0
add esp, 0x18
test esi, esi
je 0x60c7c7
push ebx
push dword [esp + 0x30]
call fcn.00479850
add esp, 8
test eax, eax
je 0x60c7c7
mov ebx, dword [esp + 0x1c]
jmp case.0x60c65d.153
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.0060c840
add esp, 4
push eax
call fcn.0060c5e0
add esp, 0x14
test eax, eax
je 0x60c7d0
push ebx
inc edi
call fcn.004797c0
add esp, 4
cmp edi, eax
jl 0x60c605
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push ebx
call fcn.004a0a40
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x60cbc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x60cbed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x60cbed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1002b663
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1002b663
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1002b663
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1002b663
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1002b663
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1002b663
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1002b663
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.1002b663
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.1002b663
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.1002b663
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.1002b663
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.1002b663
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.1002b663
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1002b663
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1002b663
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.1002b663
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.1002b663
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.1002b663
push eax
lea ecx, [ebx + 0x10]
call fcn.1002b663
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc
Function at 0x10013c40
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002d483
call fcn.10017005
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013d7c
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.100194b0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.1002b663
add esp, 0x18
test eax, eax
jne 0x10013ce1
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1002b663
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013d20
cmp dword [ebp - 0x818], 0
jne 0x10013d20
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.1002b663
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009bb3
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013d7c
cmp dword [ebp - 0x818], 0
jne 0x10013d7c
test esi, esi
jns 0x10013d7c
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016faf
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1002b663
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x1002b663
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002b672
pop dword [ebp - 0xc]
mov eax, 0x9bf3c10b
sub eax, 0x8bf10a99
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x41a1f
push 0
mov eax, 0x3834a12f
sub eax, 0x2831afd3
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x7f155155
sub ecx, 0x7f1503d7
xor edi, edi
add edi, eax
mov edx, 0xc2d2620a
sub edx, 0xb2cdb60a
add edx, dword [ebp - 0xc]
mov esi, 0xbc8f880c
mov dword [ebp - 4], 0x6d60a5fb
mov ebx, dword [edx]
mov dword [ebp - 4], 0x96819dba
xor ebx, esi
mov dword [edi], ebx
add dword [ebp - 4], esi
add edi, 0x3afa070a
add edi, 0xc505f8fa
add edx, 0x5344f56e
sub edx, 0x5344f56a
loop 0x1002b6cd
add eax, 0x94bd262e
add eax, 0x6b44029d
xor ebx, ebx
add ebx, eax
add eax, 0xc66cebf3
add eax, 0x39931412
mov ecx, 0x69e48bbd
add ecx, 0xa61b7443
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x40a5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and ecx, dword [ebx - 0x247aefa3]
push edi
invalid
Function at 0x41e0e9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00416204
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41e121
xor eax, eax
jmp 0x41e14d
cmp esi, dword [ebp - 4]
je 0x41e14a
cmp dword [ebp + 0xc], 0
je 0x41e14a
push dword [edi + 0x9c]
call fcn.0041dcf7
push dword [edi + 0x9c]
mov esi, eax
call fcn.00411074
pop ecx
pop ecx
cmp esi, eax
je 0x41e11d
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x416153
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416192
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416192
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416192
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416192
cmp dword [ecx + 0x74], 0xe
jbe 0x416192
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42858d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42858d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xfae058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00fae1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xfae07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfae06a
add dl, dl
jne 0xfae089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfae0dc
xor eax, eax
add dl, dl
jne 0xfae096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfae17d
add dl, dl
jne 0xfae0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfae0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfae0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfae0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xfae0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xfae075
mov eax, 1
add dl, dl
jne 0xfae0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfae0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfae0e1
sub eax, ebx
mov ebx, 1
jne 0xfae128
mov ecx, 1
add dl, dl
jne 0xfae10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfae119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfae105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfae075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xfae13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfae14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfae136
cmp eax, 0x7d00
jae 0xfae16d
cmp eax, 0x500
jb 0xfae168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfae075
cmp eax, 0x7f
ja 0xfae170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfae075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xfae19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xfae075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x66576934
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x61b6601b
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x10413058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104131a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1041307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1041306a
add dl, dl
jne 0x10413089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104130dc
xor eax, eax
add dl, dl
jne 0x10413096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1041317d
add dl, dl
jne 0x104130a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104130b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104130bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104130c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104130d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10413075
mov eax, 1
add dl, dl
jne 0x104130ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104130f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104130e1
sub eax, ebx
mov ebx, 1
jne 0x10413128
mov ecx, 1
add dl, dl
jne 0x1041310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10413119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10413105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10413075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1041313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1041314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10413136
cmp eax, 0x7d00
jae 0x1041316d
cmp eax, 0x500
jb 0x10413168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10413075
cmp eax, 0x7f
ja 0x10413170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10413075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1041319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10413075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6ea7463
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x42e1d0
nop
mov ecx, 0xf2f4272
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219