joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x415f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415f80
mov eax, 1
add ebx, ebx
jne 0x415fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415f98
jne 0x415fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415f98
xor ecx, ecx
sub eax, 3
jb 0x415fc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41603a
mov ebp, eax
add ebx, ebx
jne 0x415fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416004
inc ecx
add ebx, ebx
jne 0x415ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415fe5
jne 0x416001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415fe5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416015
jmp 0x415f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416024
add edi, ecx
jmp 0x415f86
pop esi
mov edi, esi
mov ecx, 0x22
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x416042
cmp byte [edi], 1
jne 0x416042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x416047
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x4160bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x168fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16938]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416074
mov ecx, edi
jns 0x4160a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16940]
or eax, eax
je 0x4160b9
mov dword [ebx], eax
add ebx, 4
jmp 0x416091
call dword [esi + 0x1693c]
mov ebp, dword [esi + 0x16944]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4160f3
sub esp, 0xffffff80
jmp 0x401350
Function at 0x4074e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4000]
push edi
or ebp, 0xffffffff
jmp 0x407502
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4074f8
mov eax, 1
add ebx, ebx
jne 0x40751b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407510
jne 0x40752c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407510
xor ecx, ecx
sub eax, 3
jb 0x407540
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4075b2
mov ebp, eax
add ebx, ebx
jne 0x40754b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407558
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40757c
inc ecx
add ebx, ebx
jne 0x407568
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40755d
jne 0x407579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40755d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40759c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40758d
jmp 0x4074fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40759c
add edi, ecx
jmp 0x4074fe
pop esi
mov edi, esi
mov ecx, 0x1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4075ba
cmp byte [edi], 1
jne 0x4075ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4075bf
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x40762e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x720c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x725c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4075ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7264]
or eax, eax
je 0x407628
mov dword [ebx], eax
add ebx, 4
jmp 0x407609
call dword [esi + 0x7260]
mov ebp, dword [esi + 0x7268]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407662
sub esp, 0xffffff80
jmp 0x403331
Function at 0x100194d5
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xea0
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x100194fb
mov eax, 0x80070057
jmp 0x1001970d
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x484]
xor ebx, ebx
push str.SoftwareMicrosoftOffice_i.0Registration
push 0x100
push eax
mov dword [esi], ebx
mov dword [ebp - 0xe9c], ebx
call fcn.1001a1a1
add esp, 0x10
test eax, eax
je 0x100196fd
lea eax, [ebp - 0xe9c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x484]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100196fd
push 0x40
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push dword [ebp - 0xe9c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x103
je 0x100196fd
test edi, edi
jne 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x484]
mov edi, 0x100
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe98], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0x284]
mov dword [ebp - 0xe94], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10019655
lea eax, [ebp - 0xea0]
mov dword [ebp - 0xea0], 0x802
push eax
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0xe98]
push eax
push ebx
push 0x1003b278
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0xe94], ebx
je 0x10019669
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100196ce
cmp dword [ebp - 0xe98], 1
je 0x1001967f
cmp dword [ebp - 0xe98], 2
jne 0x100196ce
cmp dword [ebp - 0xe98], 2
jne 0x100196d2
push 0x104
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100196d2
push 0xffffffffffffffff
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push 0x401
push eax
call fcn.1001a1a1
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x1001970a
lea eax, [ebp - 0xe90]
push str._no_more_entries_
push eax
call fcn.1001a1a1
pop ecx
pop ecx
test eax, eax
je 0x1001970a
xor eax, eax
cmp ax, word [ebp - 0xe90]
je 0x1001970a
lea eax, [ebp - 0xe90]
push eax
jmp 0x10019702
push str._no_more_entries_
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c65c
leave
ret 0x10
Function at 0x1001a082
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30dc
call fcn.1002fb29
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1001a18b
test esi, esi
je 0x1001a18b
push ecx
lea eax, [ebp - 0x2094]
xor ebx, ebx
push eax
lea eax, [edi + 0x30]
push eax
push edx
lea eax, [edi + 0x20]
mov edx, edi
push eax
push ebx
call fcn.1001a1a1
test eax, eax
js 0x1001a190
push 1
push 0x824
lea eax, [ebp - 0x104c]
push eax
push esi
lea eax, [ebp - 0x2094]
push eax
call fcn.1001a1a1
test eax, eax
js 0x1001a190
lea ecx, [ebp - 0x104c]
call fcn.1001a1a1
test eax, eax
lea eax, [ebp - 0x104c]
jne 0x1001a120
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov eax, 0x80044809
jmp 0x1001a190
push 0xffffffffffffffff
push eax
mov esi, 0x824
lea eax, [ebp - 0x30dc]
push esi
push eax
call fcn.1001a1a1
add esp, 0x10
cmp eax, 0x50
jne 0x1001a144
mov eax, 0x80040161
jmp 0x1001a190
push esi
lea edx, [ebp - 0x104c]
lea ecx, [ebp - 0x30dc]
call fcn.1001a1a1
test eax, eax
js 0x1001a190
add edi, 0x1078
je 0x1001a17d
push 0xffffffffffffffff
lea eax, [ebp - 0x104c]
push eax
push esi
push edi
call fcn.1001a1a1
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
xor ecx, ecx
mov eax, 0x80040110
test ebx, ebx
cmovne eax, ecx
jmp 0x1001a190
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c65c
leave
ret 0x14

Function at 0x1001a1a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001a1b0
pop dword [ebp - 0x1c]
mov eax, 0x1001a1b0
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3e9b3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3d4a
xor edx, edx
add edx, eax
mov ebx, 0x198d254d
add ebx, 0xf6775ab3
add ebx, dword [ebp - 0x1c]
mov esi, 0x4a3b9169
sub dword [ebp - 0x18], ebx
mov edi, dword [ebx]
xor dword [ebp - 0x18], edx
sub edi, esi
mov dword [edx], edi
sub dword [ebp - 0xc], 0xe5f18273
add edx, 0xe70eacfa
add edx, 0x18f1530a
add ebx, 0x4834d73c
add ebx, 0xb7cb28c8
loop 0x1001a1fb
add eax, 0x474b8e97
sub eax, 0x474aa69c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbb47fd4d
sub ecx, 0xab47fd4d
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Delete file
Execute command
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
nop
mov eax, 0x800
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, 0
mov byte [eax], cl
mov eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp eax, ecx
jge 0x401091
jmp 0x401063
mov eax, dword [ebp - 8]
mov ecx, eax
add eax, 1
mov dword [ebp - 8], eax
jmp 0x401043
mov eax, dword [ebp - 8]
shl eax, 2
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov eax, dword [ecx]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, 0x402085
push eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
jmp 0x401056
call fcn.00401000
mov dword [ebp - 0xc], eax
mov eax, 0x800
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0
mov byte [eax], cl
mov eax, str.HOMEDRIVE
push eax
call sub.msvcrt.dll_getenv
add esp, 4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, str.HOMEPATH
push eax
call sub.msvcrt.dll_getenv
add esp, 4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, str._bat.bat
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, 0x4020a4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_fopen
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fputs
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, 0x1000
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x800
jge 0x401178
jmp 0x401167
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x401146
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add eax, ecx
mov ecx, 0
mov byte [eax], cl
jmp 0x40115a
mov eax, dword [ebp - 0x18]
mov ecx, 0
mov byte [eax], cl
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, 0x4020a6
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, dword [ebp - 0x18]
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_remove
add esp, 4
mov eax, 0
jmp 0x4011d6
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x60e939e2
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x71583c9d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x417cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x417ce2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417ce9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417cd8
mov eax, 1
add ebx, ebx
jne 0x417cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417cf0
jne 0x417d0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417cf0
xor ecx, ecx
sub eax, 3
jb 0x417d20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417d92
mov ebp, eax
add ebx, ebx
jne 0x417d2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417d38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417d5c
inc ecx
add ebx, ebx
jne 0x417d48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417d3d
jne 0x417d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417d3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417d7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417d6d
jmp 0x417cde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417d7c
add edi, ecx
jmp 0x417cde
pop esi
mov edi, esi
mov ecx, 0x455
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417d9a
cmp byte [edi], 0
jne 0x417d9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417d9f
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417e0e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b394]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b41c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417dcc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b424]
or eax, eax
je 0x417e08
mov dword [ebx], eax
add ebx, 4
jmp 0x417de9
call dword [esi + 0x1b420]
mov ebp, dword [esi + 0x1b428]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417e42
sub esp, 0xffffff80
jmp 0x409b60
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100250d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100250e3
pop dword [ebp - 8]
mov eax, 0x9e0665dc
sub eax, 0x8e0414f9
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7af7413b
sub dword [ebp - 0x18], 0x2ca4fbf0
mov dword [ebp - 0x14], 0x3fed1162
add dword [ebp - 0x14], 0xf2463ae3
mov dword [ebp - 0x10], 0x2f729587
sub dword [ebp - 0x10], 0xe3265159
mov dword [ebp - 0xc], 0x2260265c
add dword [ebp - 0xc], 0xdd9fd9a4
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x375f4cfc
sub dword [ebp - 0x18], 0xc2ece3a6
mov dword [ebp - 0x14], 0x618c3bce
add dword [ebp - 0x14], 0xdfe025a7
mov dword [ebp - 0x10], 0xcedcb70
sub dword [ebp - 0x10], 0xa97e5f04
mov dword [ebp - 0xc], 0x203ab68c
sub dword [ebp - 0xc], 0x203ab68c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9c223b04
add eax, 0x73e11660
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37dca
push 0
call eax
mov ecx, 0xccbdcb
sub ecx, 0xcc82ac
mov edx, eax
mov edi, 0x10088400
add edi, dword [ebp - 8]
mov esi, 0xb8403eb2
sub dword [ebp - 4], edx
mov ebx, dword [edi]
xor dword [ebp - 4], 0x961ebb93
sub ebx, esi
add dword [ebp - 4], 0xadfcfc21
mov dword [edx], ebx
sub dword [ebp - 4], ebx
add edx, 0x82a41d6f
add edx, 0x7d5be295
add edi, 0xa32df246
add edi, 0x5cd20dbe
loop 0x100251f4
add eax, 0xdf4f
mov ebx, eax
add eax, 0x7e2b9895
sub eax, 0x7e2b9890
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401bc8
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x40c17c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, ecx
push str.Py_Initialize
push edi
call esi
push str.PySys_SetArgv
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 0x10], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyCFunction_New
push edi
mov ebx, eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x1c], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x18], eax
call esi
xor ecx, ecx
cmp dword [ebp - 0x14], ecx
je 0x401d4b
cmp dword [ebp - 8], ecx
je 0x401d4b
cmp dword [ebp - 0x10], ecx
je 0x401d4b
cmp dword [ebp - 0xc], ecx
je 0x401d4b
cmp ebx, ecx
je 0x401d4b
cmp dword [ebp - 0x18], ecx
je 0x401d4b
cmp eax, ecx
je 0x401d4b
cmp dword [ebp - 0x1c], ecx
je 0x401d4b
mov esi, dword [ebp + 8]
cmp esi, ecx
je 0x401d44
cmp byte [esi], cl
je 0x401d44
push ecx
push esi
call dword [sym.imp.MSVCR80.dll__open]
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x401cc4
push esi
push str.Could_not_open_postinstall_script__s_n
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR80.dll_fprintf]
add esp, 0xc
push 3
pop eax
jmp 0x401d4e
push str.Running_Script...
push 0x3ec
push dword [0x40dad8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call dword [ebp - 0x14]
mov eax, edi
jmp section..htext
push 2
jmp 0x401cbe
xor eax, eax
inc eax
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004065b0
leave
ret

Function at 0x401d60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, eax
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 4], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyErr_Print
push edi
mov dword [ebp - 8], eax
call esi
mov esi, eax
xor eax, eax
cmp ebx, eax
je 0x401de7
cmp dword [ebp - 4], eax
je 0x401de7
cmp dword [ebp - 0xc], eax
je 0x401de7
cmp dword [ebp - 8], eax
je 0x401de7
cmp esi, eax
je 0x401de7
push 0x40c800
call dword [ebp - 4]
call ebx
mov eax, edi
call fcn.00401ad5
push dword [ebp + 8]
call dword [ebp - 8]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x401de0
call esi
call dword [ebp - 0xc]
mov eax, edi
jmp 0x401dea
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret