joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40645d
pop dword [ebp - 8]
mov eax, 0x9bd832d7
add eax, 0x64683186
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8868754d
sub dword [ebp - 0x18], 0x3a163002
mov dword [ebp - 0x14], 0x6c0c17a3
sub dword [ebp - 0x14], 0x39d8cb5e
mov dword [ebp - 0x10], 0x9e9e0b86
add dword [ebp - 0x10], 0xadae38a8
mov dword [ebp - 0xc], 0xed6e5553
sub dword [ebp - 0xc], 0xed6e5553
lea eax, [ebp - 0x18]
push eax
mov eax, 0xcd5cd99f
sub eax, 0xcd1c5927
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xcd7d1786
sub dword [ebp - 0x18], 0x590aae30
mov dword [ebp - 0x14], 0xc0e003d4
sub dword [ebp - 0x14], 0x7f73a25f
mov dword [ebp - 0x10], 0x3d5ef963
sub dword [ebp - 0x10], 0xd9ef8cf7
mov dword [ebp - 0xc], 0xcdbbca21
sub dword [ebp - 0xc], 0xcdbbca21
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x3bd2ab07
add eax, 0xc46dd575
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36563
push 0
call eax
mov ecx, 0x4523
xor edx, edx
add edx, eax
mov edi, 0x451400
add edi, dword [ebp - 8]
mov esi, 0xbfe19e7d
sub dword [ebp - 4], edx
mov ebx, dword [edi]
add dword [ebp - 4], 0xbed7f4e6
xor ebx, esi
add dword [ebp - 4], eax
mov dword [edx], ebx
sub dword [ebp - 4], edi
add edx, 0x2ea9611c
sub edx, 0x2ea96118
add edi, 0xd98e0db9
add edi, 0x2671f24b
loop 0x40656f
add eax, 0x8d964f55
add eax, 0x726ab80a
xor ebx, ebx
add ebx, eax
add eax, 0xfab0b537
add eax, 0x54f4ace
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x447509
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043c5eb
xor ebx, ebx
cmp dword [0x46f71c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4475df
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4476bf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4476bf
push eax
call fcn.0043c57d
mov dword [esp], 0x4569e8
push edi
mov dword [0x46f71c], eax
call esi
push eax
call fcn.0043c57d
mov dword [esp], 0x4569d4
push edi
mov dword [0x46f720], eax
call esi
push eax
call fcn.0043c57d
mov dword [0x46f724], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00436c4e
test eax, eax
pop ecx
pop ecx
je 0x4475ad
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043ccbd
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4475df
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043c57d
cmp eax, ebx
pop ecx
mov dword [0x46f72c], eax
je 0x4475df
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043c57d
pop ecx
mov dword [0x46f728], eax
mov eax, dword [0x46f728]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x447664
cmp dword [0x46f72c], ecx
je 0x447664
push eax
call fcn.0043c5f4
push dword [0x46f72c]
mov esi, eax
call fcn.0043c5f4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x447664
cmp edi, ebx
je 0x447664
call esi
cmp eax, ebx
je 0x447631
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447631
test byte [ebp - 0x18], 1
jne 0x447664
lea eax, [ebp - 0x10]
push eax
call fcn.00436c85
test eax, eax
pop ecx
je 0x44764c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043ccbd
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44765b
or dword [ebp + 0x10], 0x200000
jmp 0x44769f
or dword [ebp + 0x10], 0x40000
jmp 0x44769f
mov eax, dword [0x46f720]
cmp eax, dword [ebp - 8]
je 0x44769f
push eax
call fcn.0043c5f4
cmp eax, ebx
pop ecx
je 0x44769f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44769f
mov eax, dword [0x46f724]
cmp eax, dword [ebp - 8]
je 0x44769f
push eax
call fcn.0043c5f4
cmp eax, ebx
pop ecx
je 0x44769f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f71c]
call fcn.0043c5f4
cmp eax, ebx
pop ecx
je 0x4476bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4476c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x7ad854
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ad85e
pushal
call 0x7ad864
pop ebp
sub ebp, 0x10
sub ebp, 0x3ad854
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7ad888
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7ad891
mov eax, 0x3ad854
add eax, ebp
add eax, 0x63
mov ecx, 0x610
mov edx, 0x9ad0ef44
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ad8a8
jmp 0x7ad8bb
iretd
Function at 0x403cc5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4163c0]
jne 0x403ccf
repz ret
jmp fcn.00405c45

Function at 0x40438d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030f4
and dword [ebp - 4], 0
cmp dword [0x4172c4], 0
mov ebx, eax
jne 0x40443e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4044ef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4044ef
push eax
call fcn.00403082
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4172c4], eax
call esi
push eax
call fcn.00403082
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4172c8], eax
call esi
push eax
call fcn.00403082
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4172cc], eax
call esi
push eax
call fcn.00403082
pop ecx
mov dword [0x4172d4], eax
test eax, eax
je 0x40443e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403082
pop ecx
mov dword [0x4172d0], eax
mov eax, dword [0x4172d0]
cmp eax, ebx
je 0x404496
cmp dword [0x4172d4], ebx
je 0x404496
push eax
call fcn.004030fd
push dword [0x4172d4]
mov esi, eax
call fcn.004030fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404496
test edi, edi
je 0x404496
call esi
test eax, eax
je 0x40448d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40448d
test byte [ebp - 0xc], 1
jne 0x404496
or dword [ebp + 0x10], 0x200000
jmp 0x4044cf
mov eax, dword [0x4172c8]
cmp eax, ebx
je 0x4044cf
push eax
call fcn.004030fd
pop ecx
test eax, eax
je 0x4044cf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4044cf
mov eax, dword [0x4172cc]
cmp eax, ebx
je 0x4044cf
push eax
call fcn.004030fd
pop ecx
test eax, eax
je 0x4044cf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4172c4]
call fcn.004030fd
pop ecx
test eax, eax
je 0x4044ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4044f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4072f0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x407352
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40731f
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x407357
test ecx, ecx
je 0x407350
test esi, esi
ja 0x407310
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x40f898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40f8a7
pop dword [ebp - 0x14]
mov eax, 0x16a7c144
add eax, 0xe9993763
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x41084
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xfd2452ab
sub ecx, 0xfd23fde4
mov edi, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x14]
mov edx, 0xeb960f19
sub edx, 0x1a52b10d
sub dword [ebp - 0xc], 0x9a23cdae
mov esi, dword [ebx]
add dword [ebp - 0xc], edx
add esi, edx
xor dword [ebp - 0xc], esi
mov dword [edi], esi
add dword [ebp - 0x10], eax
add edi, 0xacc2de12
add edi, 0x533d21f2
add ebx, 0x9cfa1785
add ebx, 0x6305e87f
loop 0x40f8fb
add eax, 0x3e4b303c
sub eax, 0x3e49ea4d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x473b6abd
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2e183e8f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40e010
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x204
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
lea eax, [esp + 0x10]
push 0x42cdf0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x10]
push ecx
call ebx
mov edx, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
lea eax, [esp + eax + 0x10]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea edx, [esp + 0x10]
push 0x42cde8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push eax
call ebx
mov edx, dword [0x432d70]
lea ecx, [esp + 0x10]
push eax
push ecx
shl edx, 4
push edx
push 0
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x432d70]
mov ecx, eax
inc eax
cmp ecx, 0x32
mov dword [0x432d70], eax
jle 0x40e0a7
mov dword [0x432d70], 0
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push str.WHSETUP.LOG
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov esi, eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push edx
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
call ebx
lea edx, [esp + 0xc]
push 0
push edx
push 2
push 0x42cdd4
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
add esp, 0x204
ret
Function at 0x41c9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0041c6a3
ja 0x41c9f2
test al, 0x65
lea eax, [ebp - 0x40]
push eax
call fcn.0041c6b3
push eax
push esi
push dword [ebp + 8]
call fcn.0041c668
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0041c6a3
fldenv [edx + 0x20]
xchg byte [ebp + 0x5d88e845], cl
call 0xe99f5264
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0041c6b3
push eax
push esi
push dword [ebp + 8]
call fcn.0041c668
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041c6b3
push eax
push esi
push dword [ebp + 8]
call fcn.0041c668
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
or al, ch
jo 0x41c9f2
invalid

Function at 0x41e420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0041c614
add esp, 0xc
jmp 0x41e61b
Function at 0x42c360
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fae4
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x49a690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea ecx, [edi + 0x14]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.0042be90
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
jne 0x42c431
push str.boost::thread_resource_error
push 0xb
lea ecx, [ebp - 0x3c]
call fcn.0041bf40
mov dword [ebp - 0x3c], vtable.boost::thread_resource_error.0
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 4
call fcn.0041bed0
mov dword [edi + 0x34], eax
mov byte [edi + 0x38], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4305b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480500
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x49a690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
push 0
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x43060c
mov ecx, edi
call fcn.0042cb90
call fcn.0045db30
mov dword [ebx + 4], eax
mov dword [ebx], 0
xor eax, eax
jmp 0x430694
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push dword [0x504d4c]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x504d4c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
xor esi, esi
call fcn.00430330
test eax, eax
je 0x430673
lea esp, [esp]
cmp esi, 0xffffffff
je 0x430666
inc esi
push ebx
push ecx
mov ecx, edi
call fcn.00430330
test eax, eax
jne 0x430660
push dword [ebp - 0x18]
push dword [0x504d4c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x430692
push ecx
call fcn.0045dbf3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045db95
mov esp, ebp
pop ebp
ret 4
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3b5f4d4d
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xbb0db7
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x85d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x85d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85d06a
add dl, dl
jne 0x85d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85d0dc
xor eax, eax
add dl, dl
jne 0x85d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85d17d
add dl, dl
jne 0x85d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x85d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x85d075
mov eax, 1
add dl, dl
jne 0x85d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85d0e1
sub eax, ebx
mov ebx, 1
jne 0x85d128
mov ecx, 1
add dl, dl
jne 0x85d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85d136
cmp eax, 0x7d00
jae 0x85d16d
cmp eax, 0x500
jb 0x85d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85d075
cmp eax, 0x7f
ja 0x85d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x85d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2b636c90
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x82257f1
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401043
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop esi
inc eax
ret 8
Function at 0x40185c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
push 4
pop eax
mov esi, str.mfc42.dll
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x158]
xor edi, edi
push 0x104
push eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], str.msvcrt.dll
mov dword [ebp - 0x3c], 0x14
mov dword [ebp - 0x38], str.msvcrt40.dll
mov dword [ebp - 0x30], 0xa
mov dword [ebp - 0x2c], str.olepro32.dll
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], str.wininet.dll
mov dword [ebp - 0x18], 0x46
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x158]
push 0x40c41c
push eax
call fcn.004028b0
mov eax, esi
pop ecx
xor ebx, ebx
pop ecx
test eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
je 0x40195b
lea edi, [ebp - 0x4c]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004028a0
lea eax, [ebp - 0x270]
push esi
push eax
call fcn.004028b0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004017e0
add esp, 0x1c
test eax, eax
je 0x401959
mov eax, dword [edi]
cmp dword [ebp - 4], eax
jl 0x401959
jne 0x40194e
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 4]
jl 0x401959
mov esi, dword [edi + 8]
add edi, 0xc
inc ebx
test esi, esi
jne 0x401902
xor edi, edi
mov esi, str.p_CFloor
push esi
push dword [ebp + 8]
call fcn.004028b0
push esi
push dword [ebp + 0xc]
call fcn.004028b0
mov esi, dword [ebp + 8]
push 0x40c43c
push esi
call fcn.004028b0
lea eax, [ebx + ebx*2]
add esp, 0x18
cmp dword [ebp + eax*4 - 0x50], edi
mov edi, str._reg_
je 0x401996
mov edi, str._sys_
push edi
push esi
call fcn.004028b0
push edi
push dword [ebp + 0xc]
call fcn.004028b0
add esp, 0x10
push dword [0x40c230]
push esi
call fcn.004028b0
push 0x40c428
push esi
call fcn.004028b0
push dword [0x40c230]
push esi
call fcn.004028b0
push dword [0x40c230]
push dword [ebp + 0xc]
call fcn.004028b0
push str..exe
push dword [ebp + 0xc]
call fcn.004028b0
add esp, 0x28
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret