joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411250
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x41140b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x4113de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048dc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00407268
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x411424
call fcn.004046c8
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x4113d4
mov eax, dword [ebp - 0x10]
call fcn.0040487c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4113d4
push 0x411430
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
call fcn.004045a4
push dword [ebp - 0x1c]
push 0x411440
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040473c
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.0040487c
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x42adc4]
mov edx, 0x41144c
call fcn.00404a98
mov edx, dword [ebp - 0x10]
call fcn.00404a98
mov dl, 0x20
call fcn.00403064
call fcn.00405220
call fcn.00403164
cmp ebx, 0xffffffff
jne 0x411379
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x42adc4]
mov edx, 0x411460
call fcn.00404a98
mov edx, dword [ebp - 0x10]
call fcn.00404a98
mov dl, 0x20
call fcn.00403064
call fcn.00405220
call fcn.00403164
cmp ebx, 0xffffffff
je 0x4113d4
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0x2d4808
push ebx
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4113e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411412
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004043fc
lea eax, [ebp - 4]
call fcn.004043d8
ret
Function at 0x4122a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x412346
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
call fcn.0040ded8
test al, al
je 0x4122e7
mov cl, byte [ebp - 5]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00411af0
mov esi, eax
jmp 0x4122f6
mov cl, byte [ebp - 5]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00411804
mov esi, eax
test esi, esi
je 0x412330
mov dl, 1
mov eax, dword [0x412098]
call fcn.00403878
mov ebx, eax
mov eax, ebx
call fcn.004120f0
mov dword [ebx + 0x2ef0], esi
push ebx
push 0x412268
call sub.user32.dll_EnumWindows
mov eax, ebx
call fcn.0041222c
mov edi, eax
mov eax, ebx
call fcn.004038a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41234d
lea eax, [ebp - 4]
call fcn.004043d8
ret

Function at 0x412484
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x412561
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.0040ded8
test al, al
je 0x4124c3
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00411af0
mov ebx, eax
jmp 0x4124d1
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00411804
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x42adc4]
mov edx, 0x412578
call fcn.00404a98
call fcn.00405220
mov edx, 0x412588
call fcn.00404a98
push eax
mov eax, dword [ebp - 4]
call fcn.00407624
mov edx, eax
pop eax
call fcn.004030b4
mov edx, 0x41259c
call fcn.00404a98
mov edx, dword [ebp - 4]
call fcn.00404a98
mov dl, 0x3c
call fcn.00403064
call fcn.00403164
test ebx, ebx
je 0x41254b
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412568
lea eax, [ebp - 4]
call fcn.004043d8
ret
Function at 0x414954
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee4
mov ebp, ecx
mov edi, edx
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
push eax
push 0
mov esi, dword [ebx + 4]
mov eax, esi
call fcn.00405460
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.004148f8
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp qword [esp]
wait
push edi
push 1
mov esi, dword [ebx + 8]
mov eax, esi
call fcn.00405460
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.004148f8
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
wait
mov eax, dword [ebx + 4]
cmp dword [eax], 0
je 0x414a1e
fld qword [esp]
fcomp dword [0x414a34]
fnstsw ax
sahf
je 0x414a1e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x14]
cmp eax, 0x1f4
jbe 0x414a1e
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x14], eax
fld qword [esp]
fdiv dword [0x414a38]
fdivr qword [esp + 8]
fdiv dword [0x414a3c]
fstp qword [esp + 0x10]
wait
fld qword [esp + 0x10]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea ecx, [esp + 0x28]
mov edx, 2
xor eax, eax
call fcn.00403274
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x10]
call fcn.00404620
mov eax, ebp
mov edx, dword [ebx + 0x10]
call fcn.0040442c
add esp, 0x11c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x419c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x419e23
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004028e4
mov eax, 0x1869f
call fcn.00402e00
mov edx, dword [ebp - 8]
call fcn.00407340
mov eax, dword [ebp - 4]
call fcn.0040467c
mov ebx, eax
test ebx, ebx
jle 0x419cfb
mov esi, 1
lea eax, [ebp - 4]
call fcn.004048d4
sub byte [eax + esi - 1], 0x32
inc esi
dec ebx
jne 0x419cea
lea eax, [ebp - 0x10]
call fcn.004043d8
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048dc
mov eax, dword [ebp - 0x18]
call fcn.0040eb40
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004045a4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404684
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.0040491c
cmp dword [ebp - 4], 0
jne 0x419d03
mov eax, dword [ebp - 0x10]
call fcn.0040467c
mov edi, eax
cmp edi, 4
jle 0x419e00
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
xor eax, eax
mov ebx, edi
test ebx, ebx
jle 0x419d8a
mov esi, 1
mov edx, edi
dec edx
cmp esi, edx
je 0x419d86
mov edx, dword [ebp - 0x10]
add al, byte [edx + esi - 1]
inc esi
dec ebx
jne 0x419d78
cmp al, byte [ebp - 0xa]
jne 0x419e00
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + edi - 1]
xor al, dl
mov byte [ebp - 9], al
mov ebx, edi
dec ebx
sub ebx, 2
jl 0x419dc8
inc ebx
mov esi, 2
lea eax, [ebp - 0x10]
call fcn.004048d4
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 9]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x419dae
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov esi, eax
and esi, 0xff
add esi, 3
inc esi
and eax, 0xff
sub edi, eax
xor eax, eax
mov al, dl
sub edi, eax
sub edi, 4
mov eax, dword [ebp - 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.004048dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419e2a
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004043fc
lea eax, [ebp - 4]
call fcn.004043d8
ret
Function at 0x419e34
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x419f01
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x419e6b
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004074e0
mov esi, eax
push 0
push 0
xor edx, edx
mov eax, esi
call fcn.0040fe04
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.0040755c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.0040755c
cmp byte [ebp - 5], 0x4d
jne 0x419ede
cmp byte [ebp - 6], 0x5a
jne 0x419ede
push 0
push pe_nt_image_headers32
xor edx, edx
mov eax, esi
call fcn.0040fe04
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.0040755c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.0040755c
cmp byte [ebp - 5], 0x50
jne 0x419ede
cmp byte [ebp - 6], 0x45
jne 0x419ede
mov bl, 1
cmp dword [ebp - 4], 0
je 0x419eeb
mov eax, esi
call fcn.004075b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419f08
lea eax, [ebp - 4]
call fcn.004043d8
ret

Function at 0x41a0b4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x41a138
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048dc
mov eax, dword [ebp - 0x18]
call fcn.0040487c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x41a11a
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a13f
lea eax, [ebp - 0x18]
call fcn.004043d8
lea eax, [ebp - 4]
call fcn.004043d8
ret

Function at 0x41ef90
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x41f01b
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0040c2e4
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.004048d4
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x41efe8
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0040cda4
cmp ebp, 0xffffffff
je 0x41f007
mov eax, dword [edi]
call fcn.0040467c
cmp ebx, eax
jle 0x41efa9
mov eax, dword [edi]
call fcn.0040467c
cmp ebx, eax
jle 0x41f01b
mov eax, dword [edi]
call fcn.0040467c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41fe5c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x42003f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x42acec], 0
jne 0x42000d
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402de0
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004045a4
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x420058
call fcn.004046c8
mov eax, dword [ebp - 0x18]
call fcn.0040487c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x41ff76
lea eax, [ebp - 0x10]
mov ecx, 0x420064
mov edx, dword [ebp - 0x18]
call fcn.004046c8
mov eax, dword [ebp - 0x10]
call fcn.00407634
test al, al
je 0x41ff28
push dword [ebp - 0x10]
push 0x420074
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.0040c680
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040473c
mov eax, dword [ebp - 0x10]
call fcn.00407658
lea eax, [ebp - 0x14]
mov ecx, 0x420084
mov edx, dword [ebp - 0x10]
call fcn.004046c8
push 0
push 0
xor ecx, ecx
mov edx, 0x420098
mov eax, dword [ebp - 0x14]
call fcn.00410108
mov eax, dword [ebp - 0x14]
call fcn.00407624
test al, al
je 0x41ff6a
mov eax, dword [ebp - 0x10]
call fcn.00410484
fstp qword [esi]
wait
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00410d84
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x41fead
lea edx, [ebp - 0x60]
mov al, 1
call fcn.0040e1c8
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00407268
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x41ffc5
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x41ffad
cmp dl, byte [ebp - 9]
je 0x42000d
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.004045a4
mov edx, dword [ebp - 0x64]
mov eax, 0x42acec
mov ecx, 0x4200a4
call fcn.004046c8
mov eax, dword [0x42acec]
call fcn.00407634
test al, al
je 0x42000d
mov eax, 0x42acec
mov edx, 0x420074
call fcn.00404684
cmp dword [0x42acec], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420046
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004043fc
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004043fc
ret
Function at 0x422988
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x422a15
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402de0
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040487c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4229ff
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422a1c
lea eax, [ebp - 4]
call fcn.004043d8
ret
Function at 0x4264ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4265e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4265fc
call fcn.00416488
mov eax, dword [0x42ae5c]
cmp dword [eax], 0
jg 0x4265c3
lea eax, [ebp - 0xc]
call fcn.00421018
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x426628
call fcn.004046c8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402840
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004079ac
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x42ae00]
mov eax, dword [eax]
call fcn.0041a770
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040473c
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x426650
call fcn.004046c8
mov eax, dword [ebp - 0x1c]
call fcn.00416488
push 0
mov eax, dword [ebp - 8]
call fcn.0040487c
push eax
call sub.kernel32.dll_WinExec
push 0
push 0x3e8
xor eax, eax
call fcn.0040ce2c
mov eax, 0x426668
call fcn.00416488
push 0
push 0
push 2
mov eax, dword [0x42ad94]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x42668c
call fcn.00416488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4265ef
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004043fc
ret
Function at 0x4275a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42773f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040dff0
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x419bd0]
call fcn.0041a3b4
call fcn.0041ab70
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x4275f9
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x42b660]
push eax
push 0
mov edx, 0x427750
mov eax, 0x427754
mov ecx, 0x50000000
call fcn.0040646c
mov edx, dword [0x42aed8]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x42b660]
push eax
push 0
mov edx, 0x42775c
xor ecx, ecx
xor eax, eax
call fcn.00406414
mov edx, dword [0x42ae18]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x427698
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x42b660]
push eax
push 0
mov edx, 0x42775c
xor ecx, ecx
xor eax, eax
call fcn.00406414
mov edx, dword [0x42adb4]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x42ade8]
mov dword [edx], eax
push 0x427770
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x42aed8]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427746
lea eax, [ebp - 0x10]
call fcn.004043d8
ret
Function at 0x427a2c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x427c15
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x427c2c
call fcn.0040e860
test eax, eax
jl 0x427a6a
neg eax
mov edx, dword [0x42ae78]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402de0
mov dword [ebp - 0x50], 0x4278b0
mov eax, dword [0x42b660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x42ad30]
call fcn.0040487c
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x427c38
mov eax, dword [0x42b660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, edi
mov eax, esi
call fcn.0040f8d4
mov dword [ebp - 0xc], 0x2c80000
lea edx, [ebp - 0x58]
xor eax, eax
call fcn.0040dff0
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x419bd0]
call fcn.0041a3b4
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x427c4c
mov edx, 0x427c70
mov eax, ebx
call fcn.0041aa64
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x42b660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040487c
push eax
mov eax, dword [0x42ad30]
call fcn.0040487c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00406414
mov edx, dword [0x42ad94]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.0041ac68
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.0041ab70
push eax
mov eax, ebx
call fcn.0041abe8
mov edx, eax
pop ecx
pop eax
call fcn.00412608
mov eax, dword [0x42ad94]
cmp dword [eax], 0
je 0x427bcb
push 0
mov eax, dword [0x42ad94]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x427bb8
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp byte [0x42ad38], 0
jne 0x427bcb
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x427b9d
push 1
mov eax, dword [0x42ad94]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.00415830
call fcn.004156f4
xor edx, edx
mov eax, 0x2b
call fcn.00416568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c1c
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004043fc
lea eax, [ebp - 0x10]
call fcn.004043d8
ret
Function at 0x427ea8
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x427eb0
xor eax, eax
push ebp
push 0x427fbc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402840
lea eax, [ebp - 0x10]
call fcn.0041fcd0
push dword [ebp - 0x10]
push 0x427fd0
push 0x427fdc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00407a34
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040473c
push 0
mov eax, dword [ebp - 8]
call fcn.0040487c
push eax
mov eax, dword [ebp - 4]
call fcn.0040487c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.0040e494
push dword [ebp - 0x18]
push 0x427fe8
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402840
push dword [ebp - 0x1c]
push 0x428010
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040473c
push dword [ebp - 0xc]
push 0x428020
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402840
push dword [ebp - 0x20]
push 0x428038
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040473c
push 0
push dword [ebp - 8]
push 0x428044
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.004072a4
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040473c
mov eax, dword [ebp - 0x24]
call fcn.0040487c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427fc3
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004043fc
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x731d460a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..pdata_1
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x4bd033ed
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219