joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4193ef
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041932e
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41943e
cmp dword [ebp - 0x1c], 5
jb 0x419456
jmp 0x419452
cmp dword [ebp - 0x10], 1
jne 0x419456
cmp dword [ebp - 0x1c], 4
ja 0x419452
jne 0x419456
cmp dword [ebp - 0x18], 0
jbe 0x419456
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x41c718
call fcn.00419208
test eax, eax
jge 0x419477
mov byte [0x4286e0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00419580
add ebp, 0x78
leave
ret

Function at 0x419580
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428024]
jne 0x41958a
repz ret
jmp fcn.00419a5c
Function at 0x4027fc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40282b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004039e0
jmp 0x402849
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402784
mov edi, eax
test ebx, ebx
je 0x402849
cmp dword [esi], 0
je 0x402849
dec ebx
jmp 0x402832
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402948
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x42403c], 0x8088405
inc edx
mov dword [0x42403c], edx
mul edx
mov eax, edx
ret

Function at 0x402a7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b14
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402af4
xor eax, eax
push ebp
push 0x402aed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402af4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4038ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402604
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x424041], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403874
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404cfc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404eb8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404d5d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404ed4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404dcf
xor eax, eax
push ebp
push 0x404dc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00404b54
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404db1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404ef4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404dcf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404eb0
cmp byte [ebp - 0xd], 0
jne 0x404e11
cmp byte [ebp - 0x12], 0
je 0x404eb0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404e2a
dec ebx
cmp byte [ebx], 0x2e
je 0x404e39
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404e29
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404eb0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404e66
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404eb0
cmp byte [ebp - 0xd], 0
je 0x404eb0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404eb0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408098
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4080d1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039e0
jmp 0x4080da
mov eax, ebx
mov edx, esi
call fcn.0040394c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4080e4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408105
mov al, byte [esp]
jmp 0x408107
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x410f7c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x410f91
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4123a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
mov dword [eax + 0x1054], edx
lea edx, [eax + 0x1050]
mov dword [eax + 0x1058], edx
mov dl, byte [ebx + 0x1047]
sub dl, 1
jb 0x412418
je 0x4123e4
dec dl
je 0x412421
dec dl
je 0x4124a8
jmp 0x412506
xor eax, eax
mov edx, dword [ebx + 0x24]
mov cl, byte [ebx + eax + 0x2a]
xor byte [edx + eax + 0x104c], cl
inc eax
cmp eax, 8
jne 0x4123e6
mov eax, ebx
call fcn.00412750
lea edx, [ebx + 0x2a]
mov eax, dword [ebx + 0x24]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
pop ebx
ret
mov eax, ebx
call fcn.00412750
pop ebx
ret
lea edx, [ebx + 0x32]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
lea eax, [ebx + 0x2a]
mov ecx, 8
call fcn.00402744
mov eax, ebx
call fcn.00412750
lea edx, [ebx + 0x2a]
mov eax, dword [ebx + 0x24]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
lea eax, [ebx + 0x32]
mov ecx, 8
call fcn.00402744
xor eax, eax
mov edx, dword [ebx + 0x24]
mov cl, byte [ebx + eax + 0x2a]
xor byte [edx + eax + 0x104c], cl
inc eax
cmp eax, 8
jne 0x41247d
lea edx, [ebx + 0x2a]
mov eax, dword [ebx + 0x24]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
pop ebx
ret
lea edx, [ebx + 0x32]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
lea eax, [ebx + 0x2a]
mov ecx, 8
call fcn.00402744
mov eax, ebx
call fcn.00412750
lea edx, [ebx + 0x2a]
mov eax, dword [ebx + 0x24]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
xor eax, eax
mov dl, byte [ebx + eax + 0x32]
xor dl, byte [ebx + eax + 0x2a]
mov ecx, dword [ebx + 0x24]
mov byte [ecx + eax + 0x104c], dl
inc eax
cmp eax, 8
jne 0x4124ee
pop ebx
ret
Function at 0x412508
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
mov dword [eax + 0x1054], edx
lea edx, [eax + 0x1050]
mov dword [eax + 0x1058], edx
mov dl, byte [ebx + 0x1047]
sub dl, 1
jb 0x412585
je 0x412544
dec dl
je 0x41258e
dec dl
je 0x412610
jmp 0x41266e
lea edx, [ebx + 0x32]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, ebx
call fcn.004127f4
xor eax, eax
mov edx, dword [ebx + 0x24]
mov cl, byte [ebx + eax + 0x2a]
xor byte [edx + eax + 0x104c], cl
inc eax
cmp eax, 8
jne 0x41255f
lea edx, [ebx + 0x2a]
lea eax, [ebx + 0x32]
mov ecx, 8
call fcn.00402744
pop ebx
ret
mov eax, ebx
call fcn.004127f4
pop ebx
ret
lea edx, [ebx + 0x32]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
lea eax, [ebx + 0x2a]
mov ecx, 8
call fcn.00402744
mov eax, ebx
call fcn.00412750
lea edx, [ebx + 0x2a]
mov eax, dword [ebx + 0x24]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
lea eax, [ebx + 0x32]
mov ecx, 8
call fcn.00402744
xor eax, eax
mov edx, dword [ebx + 0x24]
mov cl, byte [ebx + eax + 0x2a]
xor byte [edx + eax + 0x104c], cl
inc eax
cmp eax, 8
jne 0x4125ea
lea edx, [ebx + 0x2a]
lea eax, [ebx + 0x32]
mov ecx, 8
call fcn.00402744
pop ebx
ret
lea edx, [ebx + 0x32]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
mov eax, dword [ebx + 0x24]
lea edx, [eax + 0x104c]
lea eax, [ebx + 0x2a]
mov ecx, 8
call fcn.00402744
mov eax, ebx
call fcn.00412750
lea edx, [ebx + 0x2a]
mov eax, dword [ebx + 0x24]
add eax, 0x104c
mov ecx, 8
call fcn.00402744
xor eax, eax
mov dl, byte [ebx + eax + 0x32]
xor dl, byte [ebx + eax + 0x2a]
mov ecx, dword [ebx + 0x24]
mov byte [ecx + eax + 0x104c], dl
inc eax
cmp eax, 8
jne 0x412656
pop ebx
ret

Function at 0x4126f4
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov edx, dword [eax + 0x24]
lea edi, [edx + 4]
mov esi, 0x421374
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0x4c]
mov esi, 0x4213bc
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0x44c]
mov esi, 0x4217bc
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0x84c]
mov esi, 0x421bbc
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0xc4c]
mov esi, 0x421fbc
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
Function at 0x412f10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x412f29
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x412f22
mov edx, esp
mov dword [ebp - 4], edx
mov esi, eax
mov eax, esi
call fcn.004126f4
xor ebx, ebx
xor edi, edi
lea eax, [ebx + 3]
cdq
idiv dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
mov dword [ebp - 8], eax
lea eax, [ebx + 2]
cdq
idiv dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add dword [ebp - 8], eax
lea eax, [ebx + 1]
cdq
idiv dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 0x10
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
shl eax, 0x18
add dword [ebp - 8], eax
mov eax, dword [esi + 0x24]
mov edx, dword [ebp - 8]
xor dword [eax + edi*4 + 4], edx
lea eax, [ebx + 4]
cdq
idiv dword [ebp + 8]
mov ebx, edx
inc edi
cmp edi, 0x12
jne 0x412f3b
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x24]
mov dword [edx + 0x1054], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov edx, dword [esi + 0x24]
mov dword [edx + 0x1058], eax
xor edi, edi
mov eax, dword [esi + 0x24]
call fcn.00412898
mov eax, dword [esi + 0x24]
mov edx, dword [ebp - 0xc]
mov dword [eax + edi*4 + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + edi*4 + 8], edx
add edi, 2
cmp edi, 0x12
jl 0x412fbe
xor ebx, ebx
mov eax, dword [esi + 0x24]
call fcn.00412898
mov eax, dword [esi + 0x24]
mov edx, dword [ebp - 0xc]
mov dword [eax + ebx*4 + 0x4c], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + ebx*4 + 0x50], edx
add ebx, 2
cmp ebx, 0x100
jl 0x412fe1
xor ebx, ebx
mov eax, dword [esi + 0x24]
call fcn.00412898
mov eax, dword [esi + 0x24]
mov edx, dword [ebp - 0xc]
mov dword [eax + ebx*4 + 0x44c], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + ebx*4 + 0x450], edx
add ebx, 2
cmp ebx, 0x100
jl 0x413007
xor ebx, ebx
mov eax, dword [esi + 0x24]
call fcn.00412898
mov eax, dword [esi + 0x24]
mov edx, dword [ebp - 0xc]
mov dword [eax + ebx*4 + 0x84c], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + ebx*4 + 0x850], edx
add ebx, 2
cmp ebx, 0x100
jl 0x413033
xor ebx, ebx
mov eax, dword [esi + 0x24]
call fcn.00412898
mov eax, dword [esi + 0x24]
mov edx, dword [ebp - 0xc]
mov dword [eax + ebx*4 + 0xc4c], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + ebx*4 + 0xc50], edx
add ebx, 2
cmp ebx, 0x100
jl 0x41305f
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4

Function at 0x413144
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, edx
dec eax
test ax, ax
jb 0x41317b
inc eax
xor edx, edx
movzx esi, dx
movzx esi, byte [ebx + esi]
mov edi, dword [ecx]
and edi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x4223fc]
mov edi, dword [ecx]
shr edi, 8
xor esi, edi
mov dword [ecx], esi
inc edx
dec ax
jne 0x413154
pop edi
pop esi
pop ebx
ret
Function at 0x41f930
Capabilities:
Create process on windows
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov ebx, eax
mov esi, 0x426024
mov edi, 0x425ff8
mov ebp, 0x42602c
mov eax, ebx
call fcn.0041e4a8
test al, al
jne 0x41f989
push 0x24
push 0x41fb18
push 0x41fb34
mov eax, dword [esi]
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x41f989
push 5
push 0x41fcb0
push 0x41fcb0
push 0x41fcb4
push 0x41fccc
push 0
call sub.shell32.dll_ShellExecuteA
call sub.user32.dll_CreatePopupMenu
mov dword [0x426074], eax
mov dword [esp], 0x30
mov dword [esp + 4], 0x13
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x1000
mov dword [esp + 0x10], 1
mov eax, 0x41fcd4
mov dword [esp + 0x24], eax
push esp
push 0
push 1
mov eax, dword [0x426074]
push eax
call sub.user32.dll_InsertMenuItemA
mov dword [0x426048], ebx
mov eax, dword [0x4244d4]
mov dword [0x426020], eax
mov dword [edi], 0x60
mov eax, 0x41f798
mov dword [edi + 4], eax
mov eax, dword [0x426020]
mov dword [edi + 0x10], eax
mov dword [edi + 0x1c], 0x10
mov eax, 0x41fcdc
mov dword [edi + 0x24], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [edi + 0x18], eax
push 0x41fce8
mov eax, dword [edi + 0x10]
push eax
call sub.user32.dll_LoadIconA
mov dword [edi + 0x14], eax
push edi
call sub.user32.dll_RegisterClassA
mov eax, ebx
call fcn.0041fd1c
push 0
mov eax, dword [0x426020]
push eax
push 0
push 0
mov eax, dword [ebx + 0x74]
push eax
mov eax, dword [ebx + 0x70]
push eax
mov eax, dword [ebx + 0x6c]
push eax
mov eax, dword [ebx + 0x68]
push eax
mov eax, dword [0x42606c]
or eax, 0x2000000
push eax
mov eax, dword [ebx + 0x80]
call fcn.00403d3c
push eax
push 0x41fcdc
mov eax, dword [0x426070]
push eax
call sub.user32.dll_CreateWindowExA
mov dword [esi], eax
mov eax, dword [esi]
push eax
call sub.user32.dll_UpdateWindow
mov eax, ebx
call fcn.0041f134
push 0
mov eax, dword [esi]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [0x426028], eax
push 0xffffffffffffffff
mov eax, dword [0x426028]
push eax
mov eax, dword [0x426084]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, ebx
call fcn.0041ee4c
mov eax, dword [ebx + 0x60]
call fcn.0041d70c
test al, al
jne 0x41fad0
push 0xffffffffffffffff
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [esi]
push eax
call sub.user32.dll_SetWindowRgn
push 5
mov eax, dword [esi]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x426048]
call fcn.0041f3dc
push 0
push 0
mov eax, dword [esi]
push eax
push ebp
call sub.user32.dll_GetMessageA
mov ebx, eax
test ebx, ebx
jle 0x41fb03
push ebp
call sub.user32.dll_TranslateMessage
push ebp
call sub.user32.dll_DispatchMessageA
test ebx, ebx
jg 0x41fae4
mov eax, dword [esi]
push eax
call sub.user32.dll_DestroyWindow
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x420290
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x20], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4203b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.00402604
mov ebx, eax
push ebx
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 4]
push eax
mov eax, 0x5f5e0ff
call fcn.00402948
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x5f5e0ff
call fcn.00402948
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, 0x5f5e0ff
call fcn.00402948
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x4203cc
call fcn.00407ab0
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403ab0
mov edx, dword [ebp - 0x20]
mov eax, esi
pop ecx
call fcn.00403bc4
push 0
mov eax, dword [esi]
call fcn.00403d3c
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [esi]
call fcn.00403d3c
call fcn.00402710
call fcn.004026d4
push 0x104
push ebx
mov eax, dword [esi]
call fcn.00403d3c
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x124]
mov edx, ebx
call fcn.00402a2c
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.00403b1c
mov edx, dword [ebp - 0x24]
mov eax, esi
mov ecx, 0x4203e4
call fcn.00403bc4
mov eax, ebx
call fcn.0040261c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4203bd
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040391c
lea eax, [ebp - 4]
call fcn.004038f8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1031c
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
xor ebx, ebx
push 0x102dc
push eax
mov dword [ebp - 4], ebx
mov dword [esi + 0x38], 0x1041e
mov dword [esi + 0x40], 0x1041e
mov dword [esi + 0x70], 0x10438
mov dword [esi + 0x34], 0x103f0
call edi
lea eax, [ebp - 4]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push 0x22
push eax
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, ebx
jl 0x103c4
mov eax, dword [ebp - 4]
push 0x102f8
or dword [eax + 0x1c], 4
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
cmp edi, ebx
jge 0x103a1
push dword [esi + 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
call fcn.0001059c
push 0xff
push ebx
call fcn.00010574
push 1
push 0xc
call fcn.00010574
push ebx
push 0xd
call fcn.00010574
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x41904c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov ecx, 0x414c38
call fcn.004039c0
pop ecx
mov dword [ebp - 0x420], eax
test eax, eax
jne 0x40111b
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.004080b0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.004080b0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x41ae70
mov ebx, edi
cmp word [ebx], 0
je 0x4010b1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.00404595
add esp, 0xc
push ebx
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.00404604
add esp, 0xc
add ebx, 0x118
cmp ebx, 0x41b3e8
jl 0x401083
cmp word [edi], 0
je 0x4010d6
push dword [ebp + 8]
push 0x414c38
push edi
call fcn.00404220
add esp, 0xc
add edi, 0x118
cmp edi, 0x41b3e8
jl 0x4010bf
push 0x41bc40
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00404604
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401115
mov dword [ebp - 0x420], 2
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404586
leave
ret
Function at 0x401383
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x41904c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x41ada0
push 0x67
push esi
call edi
push 0x64
mov ebx, 0x41acd8
push ebx
push 0x6d
push esi
call edi
mov eax, esi
call fcn.0040151d
xor edi, edi
push edi
push esi
push edi
push edi
push edi
mov eax, closesocket
push eax
push edi
push eax
push 0xcf0000
push 0x41ada0
push ebx
push edi
mov dword [0x41ae68], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x40140d
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00404586
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
call fcn.00402660
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401d48
test eax, eax
je 0x40143b
call fcn.00402f10
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004018ca
test eax, eax
je 0x4013f4
test byte [0x41b3ec], 7
je 0x401452
call fcn.0040112a
mov eax, dword [0x41b6c8]
cmp eax, edi
jbe 0x40147c
cmp word [0x41b6cc], di
jbe 0x40147c
push eax
mov esi, 0x41a07c
call fcn.00403760
mov ax, word [0x41b6cc]
pop ecx
mov word [0x41a08c], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
xor edx, edx
mov esi, ecx
div esi
xor edx, edx
mov ebx, 0x41bc40
div ecx
push edx
push 0x414ce4
push ebx
call fcn.00401a53
add esp, 0xc
call fcn.004037e0
xor eax, eax
push 0x206
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push edi
push eax
call fcn.004080b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00404604
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401434
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
push 0x414ce0
lea eax, [esp + 0x1c]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401434