joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a522
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003a58f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003a583
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x147b
push 0x473b
push 0x2ed6
push 0x516d
push 0x6a4d
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x4ba2
push 1
push 0
call fcn.10035228
add esp, 0x24
jmp 0x1003a58d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1003a5a3
push 0x775d
push 0x6077
push 1
call fcn.100257c3
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1003b765
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003b7fe
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003b7e0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003b7c1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1003b7de
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10009b6a
mov dword [eax], 0xcbbbc25
jmp 0x1003b7b6
jmp 0x1003b7f9
push 0x10ae
push 0x23bf
push 0
push 0x1d4b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1003b897
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1003b84c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1003b84a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x1003b897
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003b87a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1003b897
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10009b6a
mov dword [eax], 0xb108f825
jmp 0x1003b86f
mov esp, ebp
pop ebp
ret
Function at 0x1006a9a7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10078750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005e4d8
mov dword [ebp - 0x14], eax
cmp dword [0x10664cd4], esi
jne 0x1006aa9a
push 0x800
push esi
push 0x100068fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006aa27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006ab7a
push esi
push esi
push 0x100068fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006ab7a
push 0x10006914
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006ab7a
push eax
call ebx
push 0x10006920
push edi
mov dword [0x10664cd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006930
push edi
mov dword [0x10664cd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006944
push edi
mov dword [0x10664cdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10664ce4], eax
test eax, eax
je 0x1006aa97
push 0x10006960
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10664ce0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006aabf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006aab2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006aad4
push 4
pop eax
jmp 0x1006ab7c
cmp dword [ebp - 0x14], esi
je 0x1006aad4
push dword [0x10664cd4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006aab9
mov eax, dword [0x10664ce0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006ab32
cmp dword [0x10664ce4], edi
je 0x1006ab32
push eax
call ebx
push dword [0x10664ce4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006ab32
test eax, eax
je 0x1006ab32
call ecx
test eax, eax
je 0x1006ab27
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006ab27
test byte [ebp - 8], 1
jne 0x1006ab32
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006ab62
mov eax, dword [0x10664cd8]
cmp eax, edi
je 0x1006ab5f
push eax
call ebx
test eax, eax
je 0x1006ab5f
call eax
mov esi, eax
test esi, esi
je 0x1006ab5f
mov eax, dword [0x10664cdc]
cmp eax, edi
je 0x1006ab5f
push eax
call ebx
test eax, eax
je 0x1006ab5f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10664cd4]
call ebx
test eax, eax
je 0x1006ab7a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006ab7c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005bcbe
mov esp, ebp
pop ebp
ret
Function at 0x408d51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408d8f
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408d96
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43a424], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x408fa1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f7e
mov dword [ecx*4 + 0x43a420], eax
inc ecx
cmp ecx, 0x100
jne 0x408f77
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fc4
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a420]
jmp 0x408fab
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1aea449f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x760b4333
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401443
pop dword [ebp - 0x30]
mov eax, 0x401443
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x638a3c41
add dword [ebp - 0x40], 0xeac8090a
mov dword [ebp - 0x3c], 0x6a4c0981
sub dword [ebp - 0x3c], 0x3818bd3c
mov dword [ebp - 0x38], 0x28dbc7dd
add dword [ebp - 0x38], 0x23707c51
mov dword [ebp - 0x34], 0x75941897
add dword [ebp - 0x34], 0x8a6be769
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb8ea12ca
add dword [ebp - 0x40], 0xbb88568c
mov dword [ebp - 0x3c], 0xf6064cd8
add dword [ebp - 0x3c], 0x4b66149d
mov dword [ebp - 0x38], 0x33049532
sub dword [ebp - 0x38], 0xcf9528c6
mov dword [ebp - 0x34], 0xd1214423
add dword [ebp - 0x34], 0x2edebbdd
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38096
push 0
call eax
mov ecx, 0x5d818f74
sub ecx, 0x5d814878
mov esi, eax
mov edi, 0x419dda11
sub edi, 0x4156f611
add edi, dword [ebp - 0x30]
mov edx, 0x323cef62
sub edx, 0x71bac1f2
add dword [ebp - 0x10], edx
mov ebx, dword [edi]
mov dword [ebp - 0x14], 0xcce2bb4
add ebx, edx
xor dword [ebp - 0x1c], 0x4d108497
mov dword [esi], ebx
mov dword [ebp - 4], 0x5445c04a
add esi, 0x6f5fc665
sub esi, 0x6f5fc661
add edi, 4
loop 0x401556
add eax, 0xf27d3ac2
add eax, 0xd83d401
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47e030]
jne 0x401116
repz ret
jmp fcn.00401b21

Function at 0x40a4bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405c15
and dword [ebp - 4], 0
cmp dword [0x480894], 0
mov ebx, eax
jne 0x40a56d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a61e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a61e
push eax
call fcn.00405ba3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x480894], eax
call esi
push eax
call fcn.00405ba3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x480898], eax
call esi
push eax
call fcn.00405ba3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48089c], eax
call esi
push eax
call fcn.00405ba3
pop ecx
mov dword [0x4808a4], eax
test eax, eax
je 0x40a56d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405ba3
pop ecx
mov dword [0x4808a0], eax
mov eax, dword [0x4808a0]
cmp eax, ebx
je 0x40a5c5
cmp dword [0x4808a4], ebx
je 0x40a5c5
push eax
call fcn.00405c1e
push dword [0x4808a4]
mov esi, eax
call fcn.00405c1e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a5c5
test edi, edi
je 0x40a5c5
call esi
test eax, eax
je 0x40a5bc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a5bc
test byte [ebp - 0xc], 1
jne 0x40a5c5
or dword [ebp + 0x10], 0x200000
jmp 0x40a5fe
mov eax, dword [0x480898]
cmp eax, ebx
je 0x40a5fe
push eax
call fcn.00405c1e
pop ecx
test eax, eax
je 0x40a5fe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a5fe
mov eax, dword [0x48089c]
cmp eax, ebx
je 0x40a5fe
push eax
call fcn.00405c1e
pop ecx
test eax, eax
je 0x40a5fe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x480894]
call fcn.00405c1e
pop ecx
test eax, eax
je 0x40a61e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a620
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cea0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x47e030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2b392d4]
push ebx
mov ebx, dword [0x2b38ff4]
push esi
mov esi, dword [0x47f060]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cee1
push str.duxafodaz
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2b392d4]
mov dword [0x2b38ff0], esi
cmp eax, 0x114e
jne 0x40cf06
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2b392d4]
cmp eax, 0x2f
jne 0x40cf34
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push edi
push ebx
call fcn.0040cd50
mov ecx, dword [esp + 0x438]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x43b63d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
add eax, 0x4db18ce5
or ecx, ecx
call fcn.0043b68f
add ecx, 1
sub ecx, eax
mov ecx, 0xc654156e
xor dword [esi], ebx
and ecx, ecx
mov ecx, 0x66a55cb4
sub esp, 4
mov dword [esp], 0x861a7dd7
pop eax
inc esi
add ecx, ecx
add ecx, 0x3489953f
or ecx, ecx
cmp esi, edx
jne fcn.0043b63d
or ecx, ecx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x747534fe
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x73b37b0e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0x401c66
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2c314466
sub dword [ebp - 0x58], 0xdddeff1b
mov dword [ebp - 0x54], 0xb61b5459
sub dword [ebp - 0x54], 0x83e80814
mov dword [ebp - 0x50], 0xbda02ac7
add dword [ebp - 0x50], 0x8eac1967
mov dword [ebp - 0x4c], 0x8e7ba36
sub dword [ebp - 0x4c], 0x8e7ba36
lea eax, [ebp - 0x58]
push eax
mov eax, 0xaa880af1
add eax, 0x55b82563
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x66aff5f
add dword [ebp - 0x58], 0x6e0769f7
mov dword [ebp - 0x54], 0x97c0b8f8
sub dword [ebp - 0x54], 0x56545783
mov dword [ebp - 0x50], 0x2a60e781
add dword [ebp - 0x50], 0x390e84eb
mov dword [ebp - 0x4c], 0xa4347b2c
add dword [ebp - 0x4c], 0x5bcb84d4
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3450a
push 0
call eax
mov ecx, 0x3edca107
add ecx, 0xc1239e4f
xor esi, esi
add esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x48]
mov ebx, 0xfdf1a825
add ebx, 0xaaa628b
mov dword [ebp - 0x20], 0x6bd87bb8
mov edi, dword [edx]
mov dword [ebp - 0x34], 0x8ed1a199
xor edi, ebx
mov dword [esi], edi
sub dword [ebp - 0x40], 0x6b35c78c
add esi, 0x3ac94f4e
add esi, 0xc536b0b6
add edx, 0x640b9992
sub edx, 0x640b998e
loop 0x401d7a
add eax, 0x2a6a87a9
add eax, 0xd5966882
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4189ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00408ee5
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x418a01
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00418a20
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x433bce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test esi, esi
jne 0x433be6
call fcn.00408ee5
mov esi, dword [eax + 0xc]
push 0x546d70
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x433c3c
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x433c3b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x433c1c
xor esi, esi
jmp 0x433c32
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.00433c42
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4dd64f
Capabilities:
Enumerate pe sections

Disassembly:
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4dd684
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4dd66b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4dd67c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4dd686
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4dd661
xor eax, eax
pop edi
pop esi
ret
Function at 0x4dd99f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004dd619
push eax
push esi
push dword [ebp + 8]
call fcn.004dd5ce
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004dd619
push eax
push esi
push dword [ebp + 8]
call fcn.004dd5ce
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004dd619
push eax
push esi
push dword [ebp + 8]
call fcn.004dd5ce
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004dd609
mov edi, 0x88e042f5
popfd
jl 0x4dda8e
invalid
invalid

Function at 0x4dde1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
and byte [ebp - 0x354], 0
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004dd619
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004dd5ce
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
inc dword [eax]