joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408620
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408570
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4086c3
push 0x40df10
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004063a0
push str.Could_not_open_file_mapping_object.
push 0x104
mov edx, dword [ebp + 0xc]
add edx, 0x208
push edx
call fcn.004063a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], eax
xor eax, eax
jmp 0x4087be
push 0x1e78
push 0
push 0
push 4
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x408739
push 0x40df88
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call fcn.004063a0
push str.Could_not_map_view_of_file.
push 0x104
mov ecx, dword [ebp + 0xc]
add ecx, 0x208
push ecx
call fcn.004063a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x410], eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4087be
mov dword [ebp - 4], 0xe3c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x53ec8b55
push ebp
mov ebp, esp
push ebx
add dh, bh
fmul dword [ecx + 0x458bfc45]
cld
Function at 0x4096e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004087e4
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00408816
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004087cb
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00408806
std
and dword [edx - 0x6c], 0x10468
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax

Function at 0x409bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x6cb43]
inc dword [eax]
je 0x40a999
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00408777
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x409c13
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x409c5c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x409c06
call fcn.00408806
shr byte [edi + 0x34], 0x20
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00408806
out 0x7f, al
invalid
Function at 0x401390
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push str._n_nRetreiving_Package_Info:_n
call fcn.0040202a
add esp, 4
call fcn.00402338
add eax, 0x20
push eax
call fcn.004022dc
add esp, 4
push 0
lea eax, [ebp - 8]
push eax
push 0x20a
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x4114ac]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401402
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40f270
call fcn.0040202a
add esp, 8
xor eax, eax
jmp 0x4014db
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [0x4114a8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40143f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40f2d8
call fcn.0040202a
add esp, 8
xor eax, eax
jmp 0x4014db
mov eax, dword [ebp + 8]
push eax
push str.__PackagePath:__s_n
call fcn.0040202a
add esp, 8
push 0
lea ecx, [ebp - 8]
push ecx
push 0x800
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x4114ac]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40148c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40f368
call fcn.0040202a
add esp, 8
xor eax, eax
jmp 0x4014db
push 0
lea ecx, [ebp - 8]
push ecx
push 4
lea edx, [ebp - 4]
push edx
mov eax, dword [0x4114a8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4014c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40f3d0
call fcn.0040202a
add esp, 8
xor eax, eax
jmp 0x4014db
mov ecx, dword [ebp + 0xc]
push ecx
push str.__Propertery_Assignments:__s_n
call fcn.0040202a
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401a40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x40d4c0
push 0x4027a0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [0x40fcc0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x4114a8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401af5
push 0
lea ecx, [ebp - 0x24]
push ecx
push 4
lea edx, [ebp - 0x20]
push edx
mov eax, dword [0x4114ac]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Reading_from_pipe_failed._GetLastError_____4dL_n
call fcn.0040202a
add esp, 8
mov dword [ebp - 0x2c], 3
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x2c]
jmp 0x401b53
jmp 0x401b1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Writing_to_pipe_failed._GetLastError_____4dL_n
call fcn.0040202a
add esp, 8
mov dword [ebp - 0x30], 3
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
jmp 0x401b53
mov dword [ebp - 4], 0xfffffffe
jmp 0x401b50
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40275b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40fcc0]
jne 0x402765
repz ret
jmp fcn.004067dc
Function at 0x40ad90
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407953
and dword [ebp - 4], 0
cmp dword [0x4113d4], 0
mov ebx, eax
jne 0x40ae41
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40aef2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40aef2
push eax
call fcn.004078e1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4113d4], eax
call esi
push eax
call fcn.004078e1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4113d8], eax
call esi
push eax
call fcn.004078e1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4113dc], eax
call esi
push eax
call fcn.004078e1
pop ecx
mov dword [0x4113e4], eax
test eax, eax
je 0x40ae41
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004078e1
pop ecx
mov dword [0x4113e0], eax
mov eax, dword [0x4113e0]
cmp eax, ebx
je 0x40ae99
cmp dword [0x4113e4], ebx
je 0x40ae99
push eax
call fcn.0040795c
push dword [0x4113e4]
mov esi, eax
call fcn.0040795c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ae99
test edi, edi
je 0x40ae99
call esi
test eax, eax
je 0x40ae90
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ae90
test byte [ebp - 0xc], 1
jne 0x40ae99
or dword [ebp + 0x10], 0x200000
jmp 0x40aed2
mov eax, dword [0x4113d8]
cmp eax, ebx
je 0x40aed2
push eax
call fcn.0040795c
pop ecx
test eax, eax
je 0x40aed2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40aed2
mov eax, dword [0x4113dc]
cmp eax, ebx
je 0x40aed2
push eax
call fcn.0040795c
pop ecx
test eax, eax
je 0x40aed2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4113d4]
call fcn.0040795c
pop ecx
test eax, eax
je 0x40aef2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40aef4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40923e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40924d
pop dword [ebp - 0x28]
mov eax, 0x30dd9971
add eax, 0xcf62f8dc
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe285d5bd
add dword [ebp - 0x38], 0x6bcc6f8e
mov dword [ebp - 0x34], 0x8b14ebc0
sub dword [ebp - 0x34], 0x58e19f7b
mov dword [ebp - 0x30], 0x4f78b4be
sub dword [ebp - 0x30], 0x32c7090
mov dword [ebp - 0x2c], 0x29741b1f
add dword [ebp - 0x2c], 0xd68be4e1
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x79b7fb65
sub dword [ebp - 0x38], 0x545920f
mov dword [ebp - 0x34], 0xf8c5ed32
add dword [ebp - 0x34], 0x48a67443
mov dword [ebp - 0x30], 0xcedc8c1
add dword [ebp - 0x30], 0x5681a3ab
mov dword [ebp - 0x2c], 0xd80ceb3d
sub dword [ebp - 0x2c], 0xd80ceb3d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x70f85c3c
add eax, 0x8f4843d8
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36c5a
push 0
call eax
mov ecx, 0xec9fcca4
sub ecx, 0xec9f8d10
xor edi, edi
add edi, eax
mov edx, 0x2fda770e
sub edx, 0x2f96b90e
add edx, dword [ebp - 0x28]
mov esi, 0x39591161
xor dword [ebp - 8], 0xa062a984
mov ebx, dword [edx]
sub ebx, esi
mov dword [ebp - 0x20], 0x885e7a4c
mov dword [edi], ebx
add dword [ebp - 0x20], ecx
add edi, 0xe7da57d6
add edi, 0x1825a82e
add edx, 0xbc52ab47
add edx, 0x43ad54bd
loop 0x409366
add eax, 0x14ade043
sub eax, 0x14acef20
xor ebx, ebx
add ebx, eax
add eax, 0xcbc02ce
sub eax, 0xcbc02c9
mov ecx, 0xa7da93e3
add ecx, 0x58656c1d
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x496b73
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x496ba1
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x496b8d
pop edi
pop esi
ret
Function at 0x49720e
Capabilities:
Terminate process

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [0x4893f0], 0
mov dword [esp + 0x10], eax
jne 0x4973c8
mov eax, dword [0x494e58]
inc dword [0x4893f0]
test eax, eax
je 0x497244
push eax
call fcn.00496ab2
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x4973c8
mov esi, 0x489424
mov edx, 0x494d50
mov edi, edx
mov ebx, 0xffffffff
mov ecx, ebx
sub eax, eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x4891ac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, ebx
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x48942c
mov edi, edx
mov ecx, ebx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov edi, dword [eax*4 + 0x4893a4]
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, ebx
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x497301
mov ecx, ebx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
mov ecx, ebx
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 0
je 0x497361
mov esi, 0x489430
mov ebx, 0x494d50
mov edi, ebx
mov ebp, 0xffffffff
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
add edi, ebp
push 0
push 0xc8
mov ecx, ebp
movsd dword es:[edi], dword [esi]
mov edi, ebx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x494d4f
mov edi, ebx
push ecx
push 0x400
push dword [esp + 0x20]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x494d4d], 0
push 0x494d50
mov esi, str.SHRINKER.ERR
push esi
call fcn.00496cf7
add esp, 8
push 0x10
push 0x489434
push esi
call fcn.00496abf
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4973c8
mov eax, dword [esp + 0x1c]
cmp eax, 0xd
jl 0x497398
mov eax, 0xd
mov esi, 0x489438
mov edx, 0x494d50
mov edi, edx
mov ecx, 0xffffffff
mov dword [esp + 0x1c], eax
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
push ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push edx
call fcn.00496b3b
add esp, 8
push ebx
call fcn.00496ab2
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x49781d
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x494f74]
imul eax, eax, 0x28
mov ecx, dword [eax + ecx + 0x24]
test ecx, 0x20000000
je 0x497858
test ecx, 0x40000000
je 0x497851
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x497869
mov eax, 0x10
jmp 0x497869
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x497876
add eax, 0x200
ret

Function at 0x498624
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
push edi
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x498651
cmp byte [ebp + ebx - 1], 0x5c
je 0x498654
mov esi, 0x48a4e8
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
inc ebp
movsw word es:[edi], word [esi]
jmp 0x498654
mov byte [ebx], 0
push ebx
push 0
push 0x48a4ec
push ebx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x4986a2
lea edi, [ebp + ebx]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, str.SHRINK33.LDR
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x10
and ecx, 3
push 0x48a4f0
rep movsb byte es:[edi], byte [esi]
push ebx
call fcn.00496abf
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4986a7
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.00498bd0
push esi
push edi
push 0
call fcn.004985af
add esp, 4
mov dword [0x48a4c8], eax
cmp eax, 0xffffffff
jne 0x4987db
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00498624
add esp, 8
mov esi, eax
test esi, esi
jne 0x49876d
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x49875a
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x49873c
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x49873c
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x498723
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.00498624
add esp, 8
mov esi, eax
test esi, esi
je 0x498710
test esi, esi
jne 0x49876d
push 0xc
push str.12345
call fcn.0049720e
add esp, 8
lea eax, [ebp - 0x4220]
push eax
push 0x4894bc
call fcn.0049647c
add esp, 8
test eax, eax
jne 0x498791
push 2
push 0
call fcn.0049720e
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x4894b8]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.00496b12
add esp, 0xc
push esi
call fcn.00496ab2
add esp, 4
push 0
call fcn.004985af
add esp, 4
lea ecx, [ebp - 0x11c]
mov dword [0x48a4c8], eax
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x48a4c8], 0xffffffff
jne 0x4987f0
push 0xc
push 0x48a500
jmp 0x498878
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x48a4c8]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x498871
cmp dword [ebp - 0x18], 0x31e
jne 0x498868
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x48a4c8]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x49885f
mov eax, dword [ebp - 4]
mov dword [0x48a4cc], eax
jmp 0x498880
push 0xc
push 0x48a504
jmp 0x498878
push 0xc
push 0x48a508
jmp 0x498878
push 0xc
push 0x48a50c
call fcn.0049720e
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x52b17fc6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x7e581426
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4172d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408115
mov dword [ebp - 0x14], eax
cmp dword [0x43fd08], esi
jne 0x4173cb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x417358
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4174ab
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4174ab
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4174ab
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43fd08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43fd0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43fd10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43fd18], eax
test eax, eax
je 0x4173c8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43fd14], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4173f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4173e3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417405
push 4
pop eax
jmp 0x4174ad
cmp dword [ebp - 0x14], esi
je 0x417405
push dword [0x43fd08]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4173ea
mov eax, dword [0x43fd14]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x417463
cmp dword [0x43fd18], edi
je 0x417463
push eax
call ebx
push dword [0x43fd18]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x417463
test eax, eax
je 0x417463
call ecx
test eax, eax
je 0x417458
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417458
test byte [ebp - 8], 1
jne 0x417463
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x417493
mov eax, dword [0x43fd0c]
cmp eax, edi
je 0x417490
push eax
call ebx
test eax, eax
je 0x417490
call eax
mov esi, eax
test esi, esi
je 0x417490
mov eax, dword [0x43fd10]
cmp eax, edi
je 0x417490
push eax
call ebx
test eax, eax
je 0x417490
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43fd08]
call ebx
test eax, eax
je 0x4174ab
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4174ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004070bf
mov esp, ebp
pop ebp
ret