joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c3fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.1002c5c2
mov bl, al
mov al, dl
call fcn.1002c5c2
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.1002c5c2
mov bl, al
mov al, byte [esi - 4]
call fcn.1002c5c2
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.1002c5c2
mov bl, al
mov al, byte [esi]
call fcn.1002c5c2
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.1002c5c2
mov bl, al
mov al, byte [esi - 0xc]
call fcn.1002c5c2
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1002c424
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031cf1
leave
ret 4

Function at 0x1002c4b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.1002c63e
push ebx
mov dl, al
call fcn.1002c617
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1002c5d2
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1002c5f0
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1002c5d2
push ebx
mov byte [ebp - 0x15], al
call fcn.1002c5f0
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1002c617
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.1002c63e
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1002c617
mov bl, al
mov al, byte [edi + 4]
call fcn.1002c63e
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1002c5f0
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002c5d2
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1002c5f0
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1002c5d2
xor bl, al
mov al, dl
call fcn.1002c63e
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002c617
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x1002c4dd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031cf1
leave
ret 4
Function at 0x1002ccff
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x100499fb
call fcn.1003327a
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002cd1e
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10003138
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x1002ce23
jmp 0x1002cd4f
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x10055dc8]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x1002cd63
cmp al, 0xff
je 0x1002cd4f
cmp al, 0xff
je 0x1002ce23
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x10055dc8]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x1002cd83
cmp cl, 0xff
je 0x1002cd6b
cmp cl, 0xff
je 0x1002ce23
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1001bcc9
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002ce23
movsx eax, al
mov al, byte [eax + 0x10055dc8]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x1002cdc3
cmp al, 0xff
je 0x1002cda3
cmp al, 0xff
je 0x1002ce23
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1001bcc9
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002ce23
movsx eax, al
mov cl, byte [eax + 0x10055dc8]
cmp esi, dword [ebp - 0x30]
jae 0x1002ce01
cmp cl, 0xff
je 0x1002cde3
cmp cl, 0xff
je 0x1002ce23
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.1001bcc9
cmp esi, dword [ebp - 0x30]
jb 0x1002cd4c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.100028d0
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10002d1a
mov eax, dword [ebp - 0x38]
call fcn.100332fd
ret

Function at 0x1002d556
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x10031cf1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007d060]
jne 0x10031cfb
repz ret
jmp fcn.1003331b
Function at 0x10039464
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1003360c
and dword [ebp - 4], 0
cmp dword [0x1008488c], 0
mov ebx, eax
jne 0x10039515
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100395c6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100395c6
push eax
call fcn.1003359a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1008488c], eax
call esi
push eax
call fcn.1003359a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10084890], eax
call esi
push eax
call fcn.1003359a
mov dword [esp], 0x1004fe48
push edi
mov dword [0x10084894], eax
call esi
push eax
call fcn.1003359a
pop ecx
mov dword [0x1008489c], eax
test eax, eax
je 0x10039515
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1003359a
pop ecx
mov dword [0x10084898], eax
mov eax, dword [0x10084898]
cmp eax, ebx
je 0x1003956d
cmp dword [0x1008489c], ebx
je 0x1003956d
push eax
call fcn.10033615
push dword [0x1008489c]
mov esi, eax
call fcn.10033615
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003956d
test edi, edi
je 0x1003956d
call esi
test eax, eax
je 0x10039564
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10039564
test byte [ebp - 0xc], 1
jne 0x1003956d
or dword [ebp + 0x10], 0x200000
jmp 0x100395a6
mov eax, dword [0x10084890]
cmp eax, ebx
je 0x100395a6
push eax
call fcn.10033615
pop ecx
test eax, eax
je 0x100395a6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100395a6
mov eax, dword [0x10084894]
cmp eax, ebx
je 0x100395a6
push eax
call fcn.10033615
pop ecx
test eax, eax
je 0x100395a6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1008488c]
call fcn.10033615
pop ecx
test eax, eax
je 0x100395c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100395c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x405a12
pop dword [ebp - 0x14]
mov eax, 0x9c156a2
sub eax, 0x980fc90
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x4f1b7de4
sub dword [ebp - 0x24], 0xc93899
mov dword [ebp - 0x20], 0x943f84eb
sub dword [ebp - 0x20], 0x620c38a6
mov dword [ebp - 0x1c], 0xae77d1fa
add dword [ebp - 0x1c], 0x9dd47234
mov dword [ebp - 0x18], 0xd288ee1b
add dword [ebp - 0x18], 0x2d7711e5
lea eax, [ebp - 0x24]
push eax
mov eax, 0xdac75641
sub eax, 0xda86d53d
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x674060d
add dword [ebp - 0x24], 0x6dfe6349
mov dword [ebp - 0x20], 0xe407d6c5
add dword [ebp - 0x20], 0x5d648ab0
mov dword [ebp - 0x1c], 0xbd49a7cc
sub dword [ebp - 0x1c], 0x59da3b60
mov dword [ebp - 0x18], 0x6dd10f06
sub dword [ebp - 0x18], 0x6dd10f06
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x97d17c66
add eax, 0x686f049a
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x350e4
push 0
call eax
mov ecx, 0x34ac69b3
sub ecx, 0x34ac2966
xor ebx, ebx
add ebx, eax
mov esi, 0x35fbf2d7
add esi, 0xca4af129
add esi, dword [ebp - 0x14]
mov edx, 0x6d80e489
add edx, 0xb965bc5c
xor dword [ebp - 4], ebx
mov edi, dword [esi]
add dword [ebp - 4], 0x8500ccb1
add edi, edx
mov dword [ebp - 8], 0x73f8eea5
mov dword [ebx], edi
mov dword [ebp - 4], 0x5a9d3574
add ebx, 0x676e780c
sub ebx, 0x676e7808
add esi, 0xe1b7062e
sub esi, 0xe1b7062a
loop 0x405b36
add eax, 0x3e5b3546
sub eax, 0x3e5a413f
xor ebx, ebx
add ebx, eax
add eax, 0x5698d7a2
sub eax, 0x5698d79d
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x402a91
Capabilities:
Hide graphical window
Persist via run registry key
Read .ini file
Set registry value
Terminate process

Disassembly:
push 0x402860
push dword fs:[0]
mov dword fs:[0], esp
push 0x4027fe
call dword [sym.imp.comctl32.dll_InitCommonControlsEx]
push 0
push 0x402ade
push 0
push 0x12d
push 0
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov esp, dword fs:[0]
pop dword fs:[0]
add esp, 4
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x51dea0
Capabilities:
Terminate process

Disassembly:
test byte [0x5cc2e8], 0x20
jne 0x51debe
vmovq xmm0, xmm0
vcvttpd2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
mov ecx, esp
add esp, 0xfffffff8
and esp, 0xfffffff8
movsd qword [esp], xmm0
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov esp, ecx
btr edx, 0x1f
sbb ecx, ecx
cmp edx, 0x41e00000
jae 0x51df1e
cvttsd2si eax, xmm0
cdq
ret
mov ecx, edx
bts edx, 0x14
shr ecx, 0x14
and edx, 0x1fffff
sub ecx, 0x433
jge 0x51df18
neg ecx
push ebx
xor ebx, ebx
shrd ebx, eax, cl
je 0x51df11
cvttss2si ebx, dword [0x532bec]
pop ebx
shrd eax, edx, cl
shr edx, cl
ret
shld edx, eax, cl
shl eax, cl
ret
cmp edx, 0x43e00000
jae 0x51df37
test ecx, ecx
je 0x51dee8
call 0x51dee8
neg eax
adc edx, 0
neg edx
ret
jecxz 0x51df3f
ja 0x51df3f
test eax, eax
je 0x51df47
cvttss2si ecx, dword [0x532be8]
mov edx, SysReAllocStringLen
xor eax, eax
ret

Function at 0x51e623
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51e662
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51e662
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51e662
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51e662
cmp dword [ecx + 0x74], 0xe
jbe 0x51e662
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x52adc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52aded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52aded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3ed32ba6
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x52a46655
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3e7a501a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5130330c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x79f67add
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0xd535d33
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4019fa
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be795
jg 0x401a20
inc edi
cmp edi, 0x323bbf1
jl 0x401a06
cmp dword [0x20d2264], 0x400
jne 0x401a61
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
call fcn.00401f7f
push esi
call fcn.00402174
push esi
call fcn.00402183
add esp, 0xc
xor edi, edi
cmp edi, 0xd036
jge 0x401a72
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x401a98
inc edi
cmp edi, 0x263ff
jl 0x401a63
mov eax, dword [0x4855e4]
mov dword [0x20d2264], eax
call fcn.00401776
mov edi, 0x3078f
cmp dword [0x20d2264], 0x51f
jne 0x401ac4
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401aac
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10
Function at 0x40441c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46b328]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040346a
and dword [ebp - 0x14], 0
cmp dword [0x4900d0], 0
mov dword [ebp - 0x18], eax
jne 0x4044cf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404577
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404577
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4900d0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4900d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4900d8], eax
call edi
push eax
call esi
mov dword [0x4900e0], eax
test eax, eax
je 0x4044cf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4900dc], eax
mov eax, dword [0x4900dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404528
cmp dword [0x4900e0], ecx
je 0x404528
push eax
call esi
push dword [0x4900e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404528
test ebx, ebx
je 0x404528
call edi
test eax, eax
je 0x40451f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40451f
test byte [ebp - 8], 1
jne 0x404528
or dword [ebp + 0x10], 0x200000
jmp 0x40455b
mov eax, dword [0x4900d4]
cmp eax, dword [ebp - 0x18]
je 0x40455b
push eax
call esi
test eax, eax
je 0x40455b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40455b
mov eax, dword [0x4900d8]
cmp eax, dword [ebp - 0x18]
je 0x40455b
push eax
call esi
test eax, eax
je 0x40455b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4900d0]
call esi
test eax, eax
je 0x404577
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404579
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404787
leave
ret

Function at 0x404787
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46b328]
jne 0x404791
repz ret
jmp fcn.004055f9
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402ee4
pop dword [ebp - 0x44]
mov eax, 0x402ee4
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x26cf933a
add dword [ebp - 0x54], 0x2782b211
mov dword [ebp - 0x50], 0xf8ee04d1
sub dword [ebp - 0x50], 0xc6bab88c
mov dword [ebp - 0x4c], 0x47312050
add dword [ebp - 0x4c], 0x51b23de
mov dword [ebp - 0x48], 0x600cbdf7
sub dword [ebp - 0x48], 0x600cbdf7
lea eax, [ebp - 0x54]
push eax
mov eax, 0x7f8cb2df
add eax, 0x80b3ce25
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x4888f3f5
add dword [ebp - 0x54], 0x2be97561
mov dword [ebp - 0x50], 0x608247d1
sub dword [ebp - 0x50], 0x1f15e65c
mov dword [ebp - 0x4c], 0xb4d6a44
add dword [ebp - 0x4c], 0x58220228
mov dword [ebp - 0x48], 0xb53edc27
add dword [ebp - 0x48], 0x4ac123d9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xcbc1ff4f
add eax, 0x347e81b1
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36877
push 0
call eax
mov ecx, 0x942670ef
add ecx, 0x6bd9d50a
xor esi, esi
add esi, eax
mov edi, 0xce28f7ea
add edi, 0x321dec16
add edi, dword [ebp - 0x44]
mov edx, 0xa21b2a1c
add edx, 0xc0522352
sub dword [ebp - 4], 0xe527041a
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0x4d331924
xor ebx, edx
sub dword [ebp - 0x3c], eax
mov dword [esi], ebx
xor dword [ebp - 0x30], eax
add esi, 4
add edi, 0xa4a66e99
sub edi, 0xa4a66e95
loop 0x403003
add eax, 0x10ab7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10