joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x70
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push esi
push 0x10003b80
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push 0x10003b80
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10001250
lea esi, [esp + 8]
call fcn.10001310
lea ebx, [esp + 0x60]
call fcn.10001000
mov ecx, dword [esp + 0x74]
pop esi
pop ebx
xor ecx, esp
call fcn.10001c48
add esp, 0x70
ret

Function at 0x10001130
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x47c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x478], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
xor eax, eax
mov ecx, 0x100
lea edi, [esp + 0x98]
push 0x10003b80
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001231
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x8c]
push ecx
push edi
call esi
test eax, eax
je 0x10001203
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x10001203
lea edx, [esp + 0x80]
push edx
lea ecx, [esp + 0x14]
call fcn.10001250
push ebx
lea eax, [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x8c]
push ecx
push edi
call esi
test eax, eax
jne 0x100011d0
lea esi, [esp + 0x10]
call fcn.10001310
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [esp + 0x68]
call fcn.10001000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x478]
xor ecx, esp
call fcn.10001c48
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x484]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10001c48
mov esp, ebp
pop ebp
ret

Function at 0x10001c48
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001c52
repz ret
jmp fcn.10001c57

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x34fb1bac
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x63af23ac
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x78797109
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3d4c1d5c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xbb13f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x63a000]
push edi
or ebp, 0xffffffff
jmp 0xbb1412
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbb1419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb1408
mov eax, 1
add ebx, ebx
jne 0xbb142b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbb143c
jne 0xbb145b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb145b
dec eax
add ebx, ebx
jne 0xbb1448
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbb1420
add ebx, ebx
jne 0xbb1457
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbb14ad
xor ecx, ecx
sub eax, 3
jb 0xbb1473
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbb14e2
sar eax, 1
mov ebp, eax
jmp 0xbb147e
add ebx, ebx
jne 0xbb147e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb144c
inc ecx
add ebx, ebx
jne 0xbb148c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb144c
add ebx, ebx
jne 0xbb1499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbb148e
jne 0xbb14aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbb148e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbb14cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbb14be
jmp 0xbb140e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbb14cc
add edi, ecx
jmp 0xbb140e
pop esi
mov edi, esi
mov ecx, 0x20a70
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbb14ea
cmp byte [edi], 0xaf
jne 0xbb14ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbb14ef
lea edi, [esi + 0x7ad000]
mov eax, dword [edi]
or eax, eax
je 0xbb155e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b3e7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b3fec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbb151c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b3ff4]
or eax, eax
je 0xbb1558
mov dword [ebx], eax
add ebx, 4
jmp 0xbb1539
call dword [esi + 0x7b3ff0]
mov ebp, dword [esi + 0x7b3ff8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbb1592
sub esp, 0xffffff80
jmp 0x865e68
Function at 0x405e40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x405f8a
test edx, edx
jle 0x405f8a
push edx
xorps xmm0, xmm0
mov byte [ebp - 0x2c], 0
push ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x94], 0x67452301
mov dword [ebp - 0x90], 0xefcdab89
mov dword [ebp - 0x8c], 0x98badcfe
mov dword [ebp - 0x88], 0x10325476
mov byte [ebp - 0x28], 0
movdqu xmmword [ebp - 0x27], xmm0
movdqu xmmword [ebp - 0x17], xmm0
call fcn.00404cb0
lea ecx, [ebp - 0x94]
call fcn.00404d80
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x94]
call fcn.00404e50
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x405ee8
mov eax, dword [esi]
jmp 0x405eea
mov eax, esi
lea edx, [ebp - 0x28]
cmp edx, eax
jb 0x405f37
cmp ecx, 0x10
jb 0x405efa
mov edx, dword [esi]
jmp 0x405efc
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
lea edx, [ebp - 0x28]
cmp eax, edx
jbe 0x405f37
cmp ecx, 0x10
jb 0x405f11
mov ecx, dword [esi]
jmp 0x405f13
mov ecx, esi
push 0x20
lea eax, [ebp - 0x28]
sub eax, ecx
mov ecx, esi
push eax
push esi
call fcn.00404a70
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret
cmp ecx, 0x20
jae 0x405f48
push dword [esi + 0x10]
mov ecx, esi
push 0x20
call fcn.004048c0
cmp dword [esi + 0x14], 0x10
jb 0x405f52
mov eax, dword [esi]
jmp 0x405f54
mov eax, esi
push 0x20
lea ecx, [ebp - 0x28]
push ecx
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov dword [esi + 0x10], 0x20
cmp dword [esi + 0x14], 0x10
jb 0x405f72
mov esi, dword [esi]
mov byte [esi + 0x20], 0
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00436c68
mov esp, ebp
pop ebp
ret
Function at 0x407f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437f88
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x408107
cmp byte [edi + 0x45], 0
je 0x408107
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x407fe0
xor al, al
jmp 0x408109
sub esp, 8
lea ecx, [esp + 0x20]
call fcn.00407e40
mov dword [esp + 0x40], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x40803f
dec eax
je 0x408043
sub eax, 2
je 0x4080ed
xor bl, bl
jmp 0x4080ef
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x40807b
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x408038
cmp byte [edi + 0x45], 0
je 0x4080ed
test esi, esi
jne 0x407ff4
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x4080e2
lea esi, [ecx + 8]
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00404a10
test al, al
je 0x407ff4
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x28]
xorps xmm0, xmm0
cmovae ecx, dword [esp + 0x18]
movq qword [ecx + eax], xmm0
lea eax, [esp + 0x18]
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], esi
cmovae eax, dword [esp + 0x18]
mov byte [eax + esi], 0
jmp 0x407ff4
push str.string_too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x408103
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x408109
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00436c68
mov esp, ebp
pop ebp
ret
Function at 0x408970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x408ae8
test eax, eax
je 0x408ae8
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x20], 0x39363231
push ecx
push 0x80
push eax
mov dword [ebp - 0x1c], 0x35313735
mov dword [ebp - 0x18], 0x32333936
mov dword [ebp - 0x14], 0x31323031
call dword [sym.imp.LIBEAY32.dll_Ordinal_3024]
add esp, 0xc
test eax, eax
js 0x408ae8
lea esi, [edi + 0xf]
and esi, 0xfffffff0
cmp esi, edi
jne 0x408a03
add esi, 0x10
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
mov dword [ebp - 4], 0
test esi, esi
jne 0x408a2a
mov dword [ebp - 0x28], esi
mov byte [ebp + esi - 0x38], 0
jmp 0x408a35
push 0
push esi
lea ecx, [ebp - 0x38]
call fcn.00407f10
mov ecx, dword [ebx + 0x10]
cmp esi, ecx
ja 0x408a55
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], esi
jb 0x408a4d
mov eax, dword [ebx]
mov byte [eax + esi], 0
jmp 0x408a63
mov eax, ebx
mov byte [eax + esi], 0
jmp 0x408a63
mov eax, esi
sub eax, ecx
mov ecx, ebx
push 0
push eax
call fcn.00407f10
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
push edi
cmovae eax, dword [ebp - 0x38]
push dword [ebp - 0x134]
push eax
call sub.MSVCR120.dll_memcpy
mov ecx, esi
add esp, 0xc
sub ecx, edi
cmp edi, esi
jge 0x408aa3
jmp 0x408a90
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
mov byte [eax + edi], cl
inc edi
cmp edi, esi
jl 0x408a90
cmp dword [ebx + 0x14], 0x10
jb 0x408aab
mov ebx, dword [ebx]
cmp dword [ebp - 0x24], 0x10
lea ecx, [ebp - 0x20]
push 1
push ecx
lea ecx, [ebp - 0x130]
push ecx
push esi
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push ebx
push eax
call dword [sym.imp.LIBEAY32.dll_Ordinal_3171]
add esp, 0x18
cmp dword [ebp - 0x24], 0x10
jb 0x408ae1
push dword [ebp - 0x38]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 1
jmp 0x408aea
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret
Function at 0x408b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x408c51
test eax, eax
je 0x408c51
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x14], 0x39363231
push ecx
push 0x80
push eax
mov dword [ebp - 0x10], 0x35313735
mov dword [ebp - 0xc], 0x32333936
mov dword [ebp - 8], 0x31323031
call dword [sym.imp.LIBEAY32.dll_Ordinal_3106]
add esp, 0xc
test eax, eax
jns 0x408b9e
push 0x43db28
push 0x35
push str.AESUtils::aes_decrypt
call fcn.00427290
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x10]
cmp edi, ecx
ja 0x408bbe
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], edi
jb 0x408bb6
mov eax, dword [esi]
mov byte [eax + edi], 0
jmp 0x408bcc
mov eax, esi
mov byte [eax + edi], 0
jmp 0x408bcc
mov eax, edi
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00407f10
cmp dword [esi + 0x14], 0x10
jb 0x408bd6
mov eax, dword [esi]
jmp 0x408bd8
mov eax, esi
push 0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x108]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.LIBEAY32.dll_Ordinal_3171]
mov ebx, dword [esi + 0x14]
add esp, 0x18
cmp ebx, 0x10
jb 0x408bfd
mov eax, dword [esi]
jmp 0x408bff
mov eax, esi
movsx ecx, byte [eax + edi - 1]
mov dword [ebp - 0x10c], ecx
lea eax, [ecx - 1]
cmp eax, 0xf
ja 0x408c8f
mov edx, edi
sub edx, ecx
mov ecx, edx
cmp edx, edi
jge 0x408c3c
lea esp, [esp]
cmp ebx, 0x10
jb 0x408c29
mov eax, dword [esi]
jmp 0x408c2b
mov eax, esi
movsx eax, byte [eax + ecx]
cmp eax, dword [ebp - 0x10c]
jne 0x408c64
inc ecx
cmp ecx, edi
jl 0x408c20
mov eax, dword [esi + 0x10]
cmp edx, eax
ja 0x408c70
mov dword [esi + 0x10], edx
cmp ebx, 0x10
jb 0x408c4d
mov esi, dword [esi]
mov byte [esi + edx], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret
push str.bad_padding
push 0x46
jmp 0x408b7d
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.00407f10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00436c68
mov esp, ebp
pop ebp
ret
push str.bad_padding_byte
push 0x3f
jmp 0x408b7d
Function at 0x41b6c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x439ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
xorps xmm0, xmm0
push eax
movq qword [esp + 0x14], xmm0
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrCreate_void__]
push 0x45397c
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0
push esi
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrCopyException_void___void_const___void_const__]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrCopy_void___void_const__]
lea eax, [esp + 0x28]
mov dword [esp + 0x40], 0xffffffff
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl___ExceptionPtrDestroy_void__]
add esp, 0x1c
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00436c68
mov esp, ebp
pop ebp
ret

Function at 0x41eee0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439da3
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.004211f0
mov dword [edi], eax
push 0
mov dword [ebp - 4], 0
push 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0040ce60
mov dword [edi + 8], eax
push 0
mov byte [ebp - 4], 1
push 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0040ce60
mov dword [edi + 0x10], eax
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x5c], 7
xor eax, eax
mov dword [edi + 0x58], 0
mov word [edi + 0x48], ax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], 7
mov word [edi + 0x60], ax
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [edi + 0xa0], eax
mov dword [edi + 0xa4], 7
mov word [edi + 0x90], ax
mov dword [edi + 0xbc], eax
mov dword [edi + 0xc0], 7
mov word [edi + 0xac], ax
mov dword [edi + 0xc4], eax
mov dword [edi + 0xc8], 0xffffffff
mov dword [edi + 0xcc], eax
mov eax, edi
mov dword [edi + 0xd0], 2
mov dword [edi + 0xd4], 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x425820
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b006
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x238], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call fcn.004119d0
push str.leidian9_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
mov ecx, 0x45b1bc
call fcn.00422680
add esp, 4
cmp dword [ebp - 0x220], 8
jb 0x4258f1
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x45b1bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret 4

Function at 0x4259c0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b06b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x45b1d8
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x45b1ec], 7
mov dword [0x45b1e8], 0
mov word [0x45b1d8], ax
mov dword [ebp - 4], eax
mov ecx, 0x45b1d8
lea eax, [ebp - 0x21c]
push eax
call fcn.004119d0
mov eax, 0x45b1d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436c68
mov esp, ebp
pop ebp
ret 4

Function at 0x42f1a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x42f1b4
xor al, al
jmp 0x42f1f9
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x42f2c0
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4