joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ee0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
mov eax, 0x1014
call fcn.00407b00
push esi
mov esi, dword [esp + 0x101c]
push edi
push esi
push str.Connecting_to__s..._n
call fcn.00407f7f
add esp, 8
push esi
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x406f1b
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
push 0x2b
mov word [esp + 0x10], 2
call sub.WS2_32.dll_htons
mov word [esp + 0xe], ax
mov eax, dword [esi + 0xc]
push 0
push 1
mov ecx, dword [eax]
push 2
mov edx, dword [ecx]
mov dword [esp + 0x1c], edx
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
jne 0x406f5d
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
lea eax, [esp + 0xc]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
je 0x406f7c
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
mov ecx, dword [esp + 0x1024]
lea edx, [esp + 0x1c]
push ecx
push 0x411abc
push edx
call fcn.00407778
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
lea eax, [esp + 0x20]
push ecx
push eax
push esi
call sub.WS2_32.dll_send
test eax, eax
jne 0x406fc4
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
mov edi, dword [esp + 0x1028]
push ebx
push ebp
xor ebp, ebp
push ebp
lea ecx, [esp + 0x28]
push 0x1000
push ecx
push esi
mov dword [edi], 0
call sub.WS2_32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407066
jmp 0x406ff6
mov edi, dword [esp + 0x1030]
test ebx, ebx
je 0x407066
mov eax, dword [edi]
test eax, eax
jne 0x40700e
lea edx, [ebx + 1]
push edx
call fcn.004079b7
add esp, 4
jmp 0x40701c
lea ecx, [ebx + ebp + 1]
push ecx
push eax
call fcn.00407fc0
add esp, 8
mov ecx, ebx
mov dword [edi], eax
mov edi, eax
mov edx, ecx
lea esi, [esp + 0x24]
add edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1030]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
add ebp, ebx
push 0x1000
push edx
push eax
mov byte [ecx + ebp], 0
call sub.WS2_32.dll_recv
mov esi, dword [esp + 0x10]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x406fef
push esi
call sub.WS2_32.dll_closesocket
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x1014
ret

Function at 0x408370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x74f36133
xor ecx, ebp
loop 0x408378
pop ebp
ret
Function at 0x401040
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x53fab0
push 0x9f
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40106b
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push 2
push 0
push 7
push 0x40000000
push str.C:Program_FilesFonsdkxgl.rar
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x53fad4
push 0xa1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4010fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push 2
push 0
push 7
push 0x40000000
push str.C:Program_FilesFonsdRar.exe
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403bff
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x50b168
call fcn.004f478f
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x403c24
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x403c76
call fcn.0041419d
push eax
lea ecx, [ebp - 0x10]
call fcn.00402157
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f5b0b
push eax
call fcn.00401623
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004019a9
mov eax, esi
call fcn.004f4867
ret 8
Function at 0x4046df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041128b
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x404718
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00404321
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x404776
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x40479a
cmp dword [edi + 0x74], 0
jne 0x40479a
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0041128b
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00404737
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40bf0f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40bf56
call fcn.0041128b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40bf56
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40bf72
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040ba14
mov esi, eax
test edi, edi
je 0x40bf70
test ebx, ebx
je 0x40bf70
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x448012
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004cc5de
call fcn.00410cbc
cmp dword [eax + 0x14], 0
jne 0x44802f
mov ecx, esi
pop esi
jmp fcn.00447b17
pop esi
ret

Function at 0x44b6aa
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00449c93
call fcn.00410cbc
cmp dword [eax + 0x14], 0
jne 0x44b6c7
mov ecx, esi
pop esi
jmp fcn.0044b07d
pop esi
ret
Function at 0x45ae73
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0045ab32
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x45aebd
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00409ea0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00403507
jmp 0x45aec8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00412804
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x45aece
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.004038c9
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x45af0b
call fcn.0045ab32
mov dword [esi + 0xc], 1
jmp 0x45af10
call fcn.0045ab32
cmp dword [esi], 0
je 0x45af59
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x45af31
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00409ea0
jmp 0x45af43
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.0040231a
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00403507
jmp 0x45af7d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x45af7d
push dword [esi]
push dword [ebp + 8]
call fcn.00412804
pop esi
pop ebp
ret 0xc

Function at 0x48493d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x484957
call fcn.0041128b
mov esi, dword [eax + 0xc]
push dword [0x5615b4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x484975
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x48496d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4849a2
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x48496f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0048486b
mov esi, eax
jmp 0x484994
Function at 0x4d56c2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4d56da
mov edi, dword [esi + 0xc]
jmp 0x4d571a
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4d56f3
call fcn.0041164a
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4d5708
call fcn.0041164a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4d571a
call fcn.0041164a
call fcn.0041128b
cmp dword [eax + 0x3c], 0
je 0x4d572f
push edi
mov ecx, ebx
call fcn.004d4580
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004d55dc
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4d574d
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d5759
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4f4780
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x55c420]
jne 0x4f478a
repz ret
jmp fcn.004fc78c
Function at 0x506678
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55c420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004fb44e
and dword [ebp - 0x14], 0
cmp dword [0x563af8], 0
mov dword [ebp - 0x18], eax
jne 0x50672b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5067d3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5067d3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x53eb24
push ebx
mov dword [0x563af8], eax
call edi
push eax
call esi
push 0x53eb10
push ebx
mov dword [0x563afc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x563b00], eax
call edi
push eax
call esi
mov dword [0x563b08], eax
test eax, eax
je 0x50672b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x563b04], eax
mov eax, dword [0x563b04]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x506784
cmp dword [0x563b08], ecx
je 0x506784
push eax
call esi
push dword [0x563b08]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x506784
test ebx, ebx
je 0x506784
call edi
test eax, eax
je 0x50677b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x50677b
test byte [ebp - 8], 1
jne 0x506784
or dword [ebp + 0x10], 0x200000
jmp 0x5067b7
mov eax, dword [0x563afc]
cmp eax, dword [ebp - 0x18]
je 0x5067b7
push eax
call esi
test eax, eax
je 0x5067b7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5067b7
mov eax, dword [0x563b00]
cmp eax, dword [ebp - 0x18]
je 0x5067b7
push eax
call esi
test eax, eax
je 0x5067b7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x563af8]
call esi
test eax, eax
je 0x5067d3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5067d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4780
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4036c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [0x4061e8]
mov ecx, edx
mov eax, dword [edx]
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx]
mov ecx, eax
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
mov edx, edi
dec edx
sub ecx, eax
dec ecx
dec ecx
dec ecx
dec ecx
lea eax, [0x4061e8]
mov dword [eax], ecx
inc eax
inc eax
inc eax
inc eax
mov dword [eax], edi
push ecx
mov ch, byte [edi]
mov al, byte [0x406139]
add al, byte [esi]
xor al, ch
mov byte [edi], al
mov eax, edx
cmp esi, eax
je 0x403712
inc esi
pop ecx
inc edi
dec ecx
jne 0x4036f6
jmp 0x403716
mov esi, ebx
jmp 0x40370b
mov edi, esi
push 0x39
push 0x4061e8
push 0x111
push dword [0x4061c4]
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x4061e8]
mov edi, dword [0x4061ec]
mov esi, dword [0x4061dc]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x403742
mov esi, dword [0x406134]
mov ecx, dword [0x406130]
push ecx
add ecx, esi
mov dword [0x4061a8], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x4061dc]
mov ebx, esi
add ebx, eax
mov dword [0x4061a4], ebx
mov edx, esi
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x4037e9
cmp eax, ecx
jae 0x40378e
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x40379f
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x403796
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x4037b2
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x4037ab
pop ecx
inc edx
movzx eax, byte [edx]
inc cl
cmp cl, 0
jne 0x4037d3
inc al
cmp al, 0
jne 0x4037cb
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x4037cf
mov al, 0
dec al
dec cl
jmp 0x4037e5
dec cl
inc al
cmp al, 0
jne 0x4037e3
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x4037e5
dec al
jmp 0x403785
mov ecx, dword [0x4061a8]
sub ecx, esi
test ecx, ecx
je 0x4037fe
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x4037f5
mov edi, dword [0x4061dc]
mov dword [0x4061dc], edi
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40371c
Capabilities:
Encode data using xor

Disassembly:
push 0x40392c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0x2d99b62c
xor byte [ebp + 0x4f], ah
popfd
jae 0x403726
jb 0x403744
call [edx + 0x50]
pop edx
push eax
jge 0x403749
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [0x30303043], ch
sub eax, 0x53747543
jns 0x4037d1
add byte [eax], dh
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add eax, 0x40d3f000
add byte [eax], al
add byte [eax], al
add bh, bh
aaa
inc eax
add byte [ecx], al
add byte [edx], al
add al, dh
rol dword [eax], cl
add byte [eax], al
add byte [eax], al
Function at 0x4026a0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026ae
call dword [0x46401c]
or eax, eax
je 0x4026af
ret
mov al, 1
jmp fcn.0040272c

Function at 0x4026b8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026c6
call dword [0x464020]
or eax, eax
jne 0x4026c7
ret
mov al, 2
jmp fcn.0040272c

Function at 0x4026d0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402708
test edx, edx
je 0x4026f2
push eax
mov eax, ecx
call dword [0x464024]
pop ecx
or eax, eax
je 0x402701
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040272c
mov dword [eax], edx
mov eax, ecx
call dword [0x464020]
or eax, eax
jne 0x4026eb
ret
mov al, 1
jmp fcn.0040272c
test edx, edx
je 0x40271c
push eax
mov eax, edx
call dword [0x46401c]
pop ecx
or eax, eax
je 0x402701
mov dword [ecx], eax
ret

Function at 0x40272c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x466004]
test ecx, ecx
je 0x40273c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402755]
jns 0x402750
call fcn.00405e0c
mov eax, dword [eax + 4]
jmp fcn.00403938

Function at 0x4027a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4027dd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4027fd
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.00403b70
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x4028e8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402917
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a28
jmp 0x402935
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402870
mov edi, eax
test ebx, ebx
je 0x402935
cmp dword [esi], 0
je 0x402935
dec ebx
jmp 0x40291e
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x402c08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ca0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c80
xor eax, eax
push ebp
push 0x402c79
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cbc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c80
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f20
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402f3a
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402f3a
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402f26
mov al, 0xa
jmp fcn.0040272c
ret

Function at 0x402f6c
Capabilities:
Terminate process

Disassembly:
cmp dword [0x46601c], 0
je 0x402977
call dword [0x46601c]
mov eax, 0xd2
jmp fcn.00403938
push eax
push ecx
mov eax, dword [eax]
call fcn.00402f3c
pop ecx
pop eax
je 0x402f7b
jmp ebx
pop ecx
jmp 0x402968

Function at 0x402f84
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402f3c
mov eax, ebx
pop ebx
jne 0x402f99
pop ecx
jmp 0x402968
ret

Function at 0x403814
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4664a4
mov esi, 0x466038
mov edi, 0x46603c
cmp byte [ebx + 0x24], 0
jne 0x403843
cmp dword [edi], 0
je 0x403843
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403832
cmp dword [0x466040], 0
je 0x40388a
call fcn.00403790
cmp byte [0x466048], 0
je 0x403870
mov edx, 0x46402c
mov eax, 0x46621c
call fcn.004056a8
call fcn.0040562b
jmp 0x403883
push 0
push 0x46404c
push 0x46402c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x466040], eax
cmp byte [ebx + 0x24], 2
jne 0x40389a
cmp dword [esi], 0
jne 0x40389a
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403664
cmp byte [ebx + 0x24], 1
jbe 0x4038aa
cmp dword [esi], 0
je 0x4038c7
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4038c7
call fcn.004050ac
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4038c7
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.0040363c
cmp byte [ebx + 0x24], 1
jne 0x4038d5
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4038e0
call fcn.004037e0
cmp dword [ebx], 0
jne 0x4038ed
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x40388a