joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ab8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404d30
add esp, 0x104
pop ebx
ret

Function at 0x406c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406d21
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406d0b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406c59
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406d0b
cmp dword [ebp - 0xc], 0
jne 0x406c6e
mov eax, dword [ebp - 4]
call fcn.00403198
mov bl, 1
jmp 0x406d0b
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403420
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406c25
test eax, eax
jne 0x406d0b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406cb5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406d0b
jmp 0x406cb5
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x406cc8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x406cb2
cmp dword [ebp - 8], 7
jne 0x406cd7
cmp dword [ebp - 0xc], 0
je 0x406cd7
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004034f0
cmp dword [ebp - 8], 7
jne 0x406cfe
cmp dword [ebp - 0xc], 0
je 0x406cfe
lea eax, [ebp - 0x10]
call fcn.00403420
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d28
lea eax, [ebp - 0x10]
call fcn.00403198
ret

Function at 0x40765c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407678
shr eax, 1
xor eax, 0xedb88320
jmp 0x40767a
shr eax, 1
dec edx
jne 0x40766b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407664
pop esi
ret

Function at 0x4076a7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x4076b3
call fcn.0040765c
push 1
push 0x40b558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4076de
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4076b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x408c90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408c44
test al, al
jne 0x408cb1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408cfd
xor eax, eax
push ebp
push 0x408ced
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408cf4
lea eax, [ebp - 0xc]
call fcn.00408c80
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409004
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4090f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406ae4
mov edx, dword [ebp - 8]
mov ecx, 0x40910c
xor eax, eax
call fcn.00408ef8
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4090c1
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409024
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408ab0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404be4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040705c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408a80
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045b0
call fcn.004057e0
call fcn.00402eb4
jmp 0x409024
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4090fa
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x4091d4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40922e
inc esi
xor edi, edi
cmp edi, 1
jne 0x4091fa
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409208
cmp edi, 1
jle 0x409208
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408c90
test eax, eax
jne 0x40922e
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40922e
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40922e
inc edi
dec esi
jne 0x4091ea
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x409620
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x78]
xor eax, eax
push ebp
push 0x409710
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409728
push esi
push 0x409734
push edi
lea eax, [ebp - 8]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4096a4
mov al, 0x62
call fcn.00409238
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4096bb
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4096af
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4096bb
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409717
lea eax, [ebp - 8]
call fcn.00403198
ret

Function at 0x4097c8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
jmp 0x409871
cmp dword [esi + 0x10], 0x1000
jne 0x40985d
test byte [esi + 0x15], 1
jne 0x40985d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40981c
cmp eax, 2
je 0x40981c
cmp eax, 0x10
je 0x40981c
cmp eax, 0x20
jne 0x409831
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409831
mov bl, 1
xor ebp, ebp
jmp 0x409842
mov eax, dword [esi]
add eax, ebp
call fcn.004097c0
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409835
test bl, bl
je 0x40985d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097f4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000135d
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
push esi
mov dword [ebp - 4], esi
call edi
mov ebx, eax
mov eax, dword [0x1000fde8]
test eax, eax
jne 0x10001407
mov eax, ebx
or eax, 1
push eax
call edi
lea eax, [ebp - 4]
push eax
push str.mscoree.dll
call fcn.100025cf
mov esi, eax
test esi, esi
js 0x1000141b
push str.CorBindToCurrentRuntime
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100013d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100013c3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x100013ce
mov esi, 0x80004005
push esi
push 0x186
jmp 0x100013f6
push 0x1000fde8
push 0x1000c1fc
push 0x1000c1ec
push dword [ebp + 8]
call eax
mov esi, eax
test esi, esi
jns 0x10001402
push esi
push 0x189
push str.host.cpp
call fcn.10002499
jmp 0x10001417
mov eax, dword [0x1000fde8]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [0x1000fde8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test esi, esi
jns 0x10001424
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x100025cf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1000f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10003f80
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10002665
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x1000263c
push 1
push 0x1000c8e8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.10002584
mov edi, eax
test edi, edi
js 0x10002684
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.10002547
mov edi, eax
test edi, edi
js 0x10002684
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x10002684
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10002679
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x10002684
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ffa
leave
ret 8
Function at 0x10002d0c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
push edi
push str.kernel32.dll
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
jne 0x10002d8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10002d4a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, esi
jl 0x10002d58
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x8d
push str.xmlutil.cpp
call fcn.10002499
mov eax, dword [ebp - 0xc]
pop edi
pop esi
test eax, eax
je 0x10002d79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002d86
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
leave
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.IsWow64Process
push edi
call esi
test eax, eax
je 0x10002de2
push str.Wow64DisableWow64FsRedirection
push edi
call esi
push str.Wow64EnableWow64FsRedirection
push edi
mov ebx, eax
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [ebp - 0x10], eax
call esi
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x10002dce
cmp dword [ebp - 0x10], 0
je 0x10002dce
test eax, eax
jne 0x10002dd4
and dword [ebp - 0x10], 0
jmp 0x10002de2
lea eax, [ebp - 0x14]
push eax
call ebx
push 1
call dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x1000c22c
push 1
push 0
mov ebx, 0x1000fe00
push ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
test eax, eax
js 0x10002e8f
push 0x10
pop ecx
mov edi, 0x1000c21c
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10002e1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002e38
push 0x10
pop ecx
mov edi, 0x1000c20c
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10002e34
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10002e42
mov dword [0x1000fe1c], 1
cmp dword [ebp + 8], 0
je 0x10002e73
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1000271f
mov dword [ebp - 4], eax
test eax, eax
js 0x10002e8f
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 0
push dword [ebp - 0xc]
push eax
call dword [ecx + 0x54]
mov dword [ebp - 4], eax
test eax, eax
js 0x10002e8f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 8], 0
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10002e8f
mov ecx, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
mov dword [eax], ecx
cmp dword [ebp - 0x10], 0
pop ebx
je 0x10002d6a
push dword [ebp - 0x14]
call dword [ebp - 0x18]
test eax, eax
jne 0x10002d6a
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10003ece
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10003f09
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10003ef0
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10003f01
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10003f0b
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10003ee6
xor eax, eax
pop edi
pop esi
ret

Function at 0x1000457b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10004565
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10004583
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x9b004581
js 0x100045a7
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100045e1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100045c8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100045d1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100045db
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100045bd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10004547
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x1000a573
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000f010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000405f
and dword [ebp - 0x14], 0
cmp dword [0x10010afc], 0
mov dword [ebp - 0x18], eax
jne 0x1000a626
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000a6ce
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000a6ce
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10010afc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10010b00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10010b04], eax
call edi
push eax
call esi
mov dword [0x10010b0c], eax
test eax, eax
je 0x1000a626
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10010b08], eax
mov eax, dword [0x10010b08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000a67f
cmp dword [0x10010b0c], ecx
je 0x1000a67f
push eax
call esi
push dword [0x10010b0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000a67f
test ebx, ebx
je 0x1000a67f
call edi
test eax, eax
je 0x1000a676
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000a676
test byte [ebp - 8], 1
jne 0x1000a67f
or dword [ebp + 0x10], 0x200000
jmp 0x1000a6b2
mov eax, dword [0x10010b00]
cmp eax, dword [ebp - 0x18]
je 0x1000a6b2
push eax
call esi
test eax, eax
je 0x1000a6b2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000a6b2
mov eax, dword [0x10010b04]
cmp eax, dword [ebp - 0x18]
je 0x1000a6b2
push eax
call esi
test eax, eax
je 0x1000a6b2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10010afc]
call esi
test eax, eax
je 0x1000a6ce
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000a6d0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003ffa
leave
ret
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x40147e
Capabilities:
Encode data using xor

Disassembly:
xor dx, dx
mov esi, edi
lodsb al, byte [esi]
xchg cl, dl
ror al, cl
xor al, cl
xchg cl, dl
xor al, ah
stosb byte es:[edi], al
inc dx
loop 0x401483
ret

Function at 0x401494
Capabilities:
Encode data using xor

Disassembly:
xor dx, dx
mov esi, edi
lodsb al, byte [esi]
xor al, ah
xchg cl, dl
xor al, cl
rol al, cl
xchg cl, dl
stosb byte es:[edi], al
inc dx
loop 0x401499
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3d9a4edc
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x7a306dbd
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x41342a
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4276d4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x401e38
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x413516
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x41350a
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x4134b9
xor edi, edi
jmp 0x413501
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x4134b5
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x4134e1
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x38]
push ecx
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4134b5
push dword [ebp - 0x38]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00416507
leave
ret 8