joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a014
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041c57b
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41a04d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00419c60
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x41cdc8
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x462aaf
call fcn.0044d170
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41cded
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41ce33
lea ecx, [ebp - 0x10]
call fcn.00402f60
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425277
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402fb0
mov eax, esi
call fcn.0044d248
ret 8

Function at 0x4233f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42343f
call fcn.0041c57b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42343f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42345b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00422f70
mov esi, eax
test edi, edi
je 0x423459
test ebx, ebx
je 0x423459
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42b0ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42b147
call fcn.0041c57b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42b147
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42b18a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x42b173
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42b173
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42b187
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42f35a
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x42f385
call fcn.0041c57b
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x42f3a8
push eax
push dword [esi + 4]
call fcn.0042f2ba
push esi
push eax
mov ecx, 0x4860f8
call fcn.0042ef27
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x42fc3e
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x463757
call fcn.0044d170
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.0042fbfe
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00402f60
push dword [esi + 8]
mov edi, dword [edi + 8]
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x42fca5
push eax
push dword [esi + 8]
call fcn.0042f2ba
push dword [esi + 0xc]
mov ecx, 0x4860f8
push eax
call fcn.0042ef27
mov eax, esi
call fcn.0044d248
ret 0x1c
Function at 0x4370aa
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x463fbc
call fcn.0044d170
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00409150
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x43710c
call fcn.0041be2c
cmp eax, 1
jne 0x43710c
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x46c4b8
push eax
call fcn.0043459c
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00408e30
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402fb0
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402fb0
mov eax, esi
call fcn.0044d248
ret 0x10

Function at 0x437135
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x463fbc
call fcn.0044d170
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00409150
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x437197
call fcn.0041be2c
cmp eax, 1
jne 0x437197
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x46c4b8
push eax
call fcn.0043459c
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00408e30
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402fb0
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402fb0
mov eax, esi
call fcn.0044d248
ret 0x14
Function at 0x44a4f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x482ad0]
jne 0x44a4fa
repz ret
jmp fcn.00451f63

Function at 0x45d111
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004518c6
and dword [ebp - 4], 0
cmp dword [0x486fec], 0
mov ebx, eax
jne 0x45d1c2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45d273
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45d273
push eax
call fcn.00451854
mov dword [esp], 0x46f800
push edi
mov dword [0x486fec], eax
call esi
push eax
call fcn.00451854
mov dword [esp], 0x46f7ec
push edi
mov dword [0x486ff0], eax
call esi
push eax
call fcn.00451854
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x486ff4], eax
call esi
push eax
call fcn.00451854
pop ecx
mov dword [0x486ffc], eax
test eax, eax
je 0x45d1c2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00451854
pop ecx
mov dword [0x486ff8], eax
mov eax, dword [0x486ff8]
cmp eax, ebx
je 0x45d21a
cmp dword [0x486ffc], ebx
je 0x45d21a
push eax
call fcn.004518cf
push dword [0x486ffc]
mov esi, eax
call fcn.004518cf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45d21a
test edi, edi
je 0x45d21a
call esi
test eax, eax
je 0x45d211
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45d211
test byte [ebp - 0xc], 1
jne 0x45d21a
or dword [ebp + 0x10], 0x200000
jmp 0x45d253
mov eax, dword [0x486ff0]
cmp eax, ebx
je 0x45d253
push eax
call fcn.004518cf
pop ecx
test eax, eax
je 0x45d253
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45d253
mov eax, dword [0x486ff4]
cmp eax, ebx
je 0x45d253
push eax
call fcn.004518cf
pop ecx
test eax, eax
je 0x45d253
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x486fec]
call fcn.004518cf
pop ecx
test eax, eax
je 0x45d273
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45d275
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xbc1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xbc11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbc107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc106a
add dl, dl
jne 0xbc1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc10dc
xor eax, eax
add dl, dl
jne 0xbc1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbc117d
add dl, dl
jne 0xbc10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbc10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbc1075
mov eax, 1
add dl, dl
jne 0xbc10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbc10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc10e1
sub eax, ebx
mov ebx, 1
jne 0xbc1128
mov ecx, 1
add dl, dl
jne 0xbc110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbc1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbc113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbc114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbc1136
cmp eax, 0x7d00
jae 0xbc116d
cmp eax, 0x500
jb 0xbc1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc1075
cmp eax, 0x7f
ja 0xbc1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbc1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbc119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbc1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402204
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 0xa
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_FindResourceA
sub esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402247
mov dword [0x407020], 0
mov dword [0x40701c], 0
jmp 0x40229b
mov eax, dword [ebp - 4]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_SizeofResource
sub esp, 8
mov dword [0x407020], eax
mov eax, dword [ebp - 4]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
mov dword [0x40701c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.12345678901234567890123456789012
call sub.msvcrt.dll_strcpy
leave
ret

Function at 0x402550
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [0x407030], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x4025a5
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x4025cc
call sub.msvcrt.dll__beginthread
jmp 0x4025c7
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00402718
mov dword [ebp - 4], 1
jmp 0x4025c7
mov eax, dword [ebp - 4]
leave
ret
Function at 0x403e84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_FindResourceA
sub esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
shr eax, 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], str._d._d._d._d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp + 8]
leave
ret

Function at 0x403f1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x403f5b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
shr eax, 4
and eax, 1
test al, al
je 0x403f5b
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret
Function at 0x401e50
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4026f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [esp + 0x48]
mov dword [esp + 0x14], ecx
mov esi, 0x40497c
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401ea2
test cl, cl
je 0x401e9e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401ea2
add eax, 2
add esi, 2
test cl, cl
jne 0x401e7a
xor eax, eax
jmp 0x401ea7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402006
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x48]
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_CString::CString_1
push edi
lea eax, [esp + 0x10]
push str._s.
push eax
mov byte [esp + 0x4c], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0xc]
push 0
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 2
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x401fc9
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x20]
mov ebp, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x401fc0
mov edx, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [edx + 0x40]
test eax, eax
je 0x401f82
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
call sub.MFC42.DLL_CFileFind::GetFileName
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push ecx
push edi
push str._s_s
push edx
mov byte [esp + 0x54], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x18]
push eax
call fcn.00401e50
jmp 0x401fc0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::GetFileName
mov edx, dword [eax]
lea eax, [esp + 0x4c]
push edx
push edi
push str._s_s
push eax
mov byte [esp + 0x54], 4
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x4c]
push ecx
call esi
test ebp, ebp
jne 0x401f0e
pop ebp
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::Close
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 1
call fcn.00402342
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x38]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4

Function at 0x402060
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x402076
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
neg eax
sbb eax, eax
neg eax
ret 4
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x4c4a3703
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x5f8228a2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x845b95
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
jmp 0x845bdb
pushal
pop word [esp + 0x11]
mov dword [esp + 0x20], esi
push ecx
call fcn.00845be5
push ebx
fisttp word [edi + 0x2a]
fldenv [edx]
mov ebx, 0x30c1a630
xchg byte [ebp + 0x242c89bc], ch
mov dword [esp + 0x20], esi
push ecx
jmp 0x845baa
js 0x845b9f
pushal
pop word [esp + 0x11]
jmp 0x845bc5

Function at 0x845be5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0832b68
jmp 0x845c32
mov dword [esp], ebp
jmp 0x845c6e
push dword [esp + 7]
jl 0x845c24
jge 0x845c0e
mov dh, 0x38
scasb al, byte es:[edi]
leave
cmp byte [eax + ebx*4 + 0x1fec8515], cl
lodsb al, byte [esi]
or al, byte [esi + 0x388e7314]
mov bh, 0x8d
and al, 2
mov dword [esp + 8], ebx
mov dword [esp + 4], esp
jmp 0x845bbd
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x845c2c
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
pushfd
jmp 0x8451a0
jmp 0x845c9f
setge bh
add ebx, 0x3a74b486
jmp 0x845c73
bswap ebx
jmp 0x845c7d
call fcn.00845b95
jge 0x845c43
bswap ebx
jmp 0x845c7d
sub esp, 0xc0
mov edi, esp
xchg cx, bx
not ax
jmp 0x845cc7
mov ebp, dword [esp + 0x2c]
mov ch, byte [esp]
mov al, cl
mov cx, word [esp]
lea esi, [esp]
jmp 0x845c34
jmp 0x845d61
mov dh, byte [esp]
mov ch, byte [esp]
mov ecx, ebp
mov al, 0xe2
bts eax, edx
jns 0x845cb1
xchg dx, ax
xchg edx, ebx
stc
jmp 0x845cf7
sub esp, 4
push word [esp + 3]
jmp 0x845d15
sub esp, 4
push word [esp + 3]
bswap eax
xchg dx, ax
lea ebx, [eax + ebx]
jmp 0x845d38
bts edx, edx
lea eax, [ebp*4]
xchg al, bh
mov edx, dword [esp]
mov ax, cx
jmp 0x845da2
mov word [esp], bp
lea esp, [esp + 2]
lea esp, [esp + 4]
add ebp, 0x76e441f5
neg edx
jmp 0x845d7e
xchg dx, ax
xchg edx, ebx
stc
jmp 0x845d0d
xchg al, bh
mov edx, dword [esp]
mov ax, cx
jmp 0x845da2
jg 0x845d1e
bts edx, edx
lea eax, [ebp*4]
jmp 0x845d68
btr bx, di
js 0x845df6
rdtsc
jmp 0x845df8
setns bl
not ebp
xchg dl, al
mov dl, byte [esp]
bswap edx
jmp 0x845d8c
rdtsc
sub ebp, 0x19676f6a
call 0x845dc7
lea ecx, reloc.KERNEL32.dll_IsBadCodePtr
call ebx
ret

Function at 0x867701
Capabilities:
Encrypt data using aes

Disassembly:
mov esi, ecx
push edx
jmp 0x867735
shl edx, 8
mov bh, 0x7c
jmp 0x867774
mov edx, eax
add edx, 6
movzx esi, byte [edx]
pop edx
jmp 0x86771f
xor edx, esi
or edi, eax
neg esi
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x86775e
Function at 0x86794b
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [esp]
mov ebx, edx
lea ebp, [ecx + edi]
jmp 0x86799f
clc
lea esp, [esp + 4]
popal
jmp 0x867935
not bh
xor bp, 0x9fc2
mov edi, dword [edi*4 + reloc.KERNEL32.dll_IsBadCodePtr]
mov bl, byte [esp]
add ebp, edi
jmp 0x8679ad
shr edi, 8
mov ebx, dword [esp]
mov bx, 0xb2ea
and edi, esi
jmp 0x867978
mov ebp, 0xb92caed9
and edi, 0xff0000
mov ebp, dword [esp]
mov ebx, dword [ecx + 4]
jmp 0x867a59
push ecx
jmp 0x867a25
xor eax, edi
xchg edi, ebp
mov bp, cx
mov edi, edx
lea ebp, [esi*4]
jmp 0x8679e7
movzx edi, byte [edi*4 + 0x83eb70]
mov bp, 0x6da8
lea ebp, [esp + esi]
jmp 0x867a35
shr edi, 0x18
sub esp, 8
lea ebp, [esi + esi]
mov ebp, 0xf7b03d5e
jmp 0x867a0f
mov ebp, 0x230315e7
adc bp, dx
xor eax, edi
pushal
pop di
jmp 0x867aa3
not bp
and eax, 0xff000000
bswap ebp
pushal
jmp 0x8679fd
xor eax, edi
jmp 0x867a8c
mov edi, dword [edi*4 + reloc.KERNEL32.dll_IsBadCodePtr]
mov ebp, 0xff00
and edi, ebp
jmp 0x867a66
lea esp, [esp + 0x48]
xor eax, dword [ecx]
mov edi, edx
jmp 0x867ad0
lea esp, [esp + 2]
mov edi, edx
and edi, esi
jmp 0x867a7c
mov dword [edi], eax
mov ax, 0x2f55
push ecx
pop eax
jmp 0x867ade
mov dword [ecx + 0x14], ebx
adc ebx, edx
rol bh, 7
jmp 0x867ae8
lea edi, [ecx + 0x10]
sub esp, 0xa
lea esp, [esp + 2]
xor ebx, eax
jmp 0x867aad
mov eax, dword [ecx + 8]
clc
push ebx
xor eax, ebx
clc
jmp 0x867ab7
mov dword [ecx + 0x18], eax
xor edx, eax
mov ax, di
bsr bx, sp
jmp 0x867b9f
lea esp, [esp + 0xc]
jmp 0x833928
mov dword [ecx + 0x1c], edx
mov cl, al
cmp cx, ax
mov ebx, 0x840374
jmp 0x867b2e