joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4818c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c8c0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x4ab4ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xe
xor eax, eax
mov edi, 7
xor ebx, ebx
push str.Common_AppData
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], ax
call fcn.00405130
mov dword [ebp - 4], ebx
xor ecx, ecx
push 0x40
mov word [ebp - 0x30], cx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
call fcn.00405130
mov byte [ebp - 4], 1
push ebx
push esi
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x34]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00480be0
add esp, 0x14
mov byte [ebp - 0xd], al
mov byte [ebp - 4], bl
mov edi, 8
cmp dword [ebp - 0x1c], edi
jb 0x481961
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00456b63
add esp, 4
xor edx, edx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x38], edi
jb 0x481989
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00456b63
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], cx
cmp byte [ebp - 0xd], bl
je 0x481a9a
cmp dword [esi + 0x14], ebx
je 0x4819bf
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
call fcn.0047fc80
mov ecx, eax
call fcn.0047fcc0
cmp word [eax], 0x5c
je 0x4819ca
push 0x5c
push 1
mov ecx, esi
call fcn.00404e80
call fcn.00481730
test al, al
lea eax, [ebp - 0x34]
je 0x481a07
push 1
push eax
call fcn.004815f0
add esp, 8
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.0047ec50
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00403d40
mov byte [ebp - 4], 2
jmp 0x481a35
push ebx
push eax
call fcn.004815f0
add esp, 8
mov dword [ebp - 4], 4
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.0047ec50
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00403d40
mov byte [ebp - 4], 4
cmp dword [ebp - 0x38], edi
jb 0x481a46
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00456b63
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], edi
jb 0x481a6e
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00456b63
add esp, 4
mov eax, dword [ebp + 8]
xor edx, edx
mov word [ebp - 0x30], dx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 7
call fcn.00480350
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xab1190
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0xab11d0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xab11c7
push 0
lea edx, [ebp - 4]
push edx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xab1220
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xac0008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
push 0
push esi
call fcn.00ab76b0
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00ab76b0
add esp, 0x18
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xac2c8c], eax
test eax, eax
je 0xab1294
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0xac2c8c]
cmp byte [ebp - 0x214], 0
push edi
push 0x105
je 0xab12b7
lea edx, [ebp - 0x210]
push edx
mov edi, 0xca
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0xab12c9
lea eax, [ebp - 0x210]
push eax
mov edi, 0xc9
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.DumpIt.sys
lea ecx, [ebp - 0x210]
push ecx
push str._sDrivers_s
push 0x105
push esi
call fcn.00ab1dc5
movzx edi, di
push esi
mov eax, edi
call fcn.00ab1190
add esp, 0x18
test al, al
jne 0xab13b0
push 0x20a
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.00ab76b0
push str.DumpIt.sys
push str._TEMP__s
lea eax, [ebp - 0x210]
push 0x20a
push eax
call fcn.00ab1dc5
add esp, 0x1c
push 0x105
push esi
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
mov eax, edi
call fcn.00ab1190
add esp, 4
test al, al
jne 0xab13b0
push 0x20a
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.00ab76b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.DumpIt.sys
lea ecx, [ebp - 0x210]
push ecx
push str._s_s
push 0x105
push esi
call fcn.00ab1dc5
push esi
mov eax, edi
call fcn.00ab1190
add esp, 0x18
test al, al
jne 0xab13b0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop edi
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
Function at 0xab1720
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xac0008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.DumpIt
push str.RegistryMachineSystemCurrentControlSetServices_s
lea eax, [ebp - 0x218]
push 0x20a
xor esi, esi
push eax
mov dword [ebp - 0x21c], esi
call fcn.00ab1dc5
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [0xac1b48]
lea eax, [ebp - 0x224]
push eax
call dword [0xac1b4c]
test eax, eax
jne 0xab17b9
lea ecx, [ebp - 0x21c]
push ecx
push 0xf003f
push eax
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xab17b9
mov edx, dword [ebp - 0x21c]
push str.DumpIt
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0xab17b9
lea esi, [eax + 1]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0xab17ca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret

Function at 0xab1870
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0xac0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x664], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x20a
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00ab76b0
movzx ecx, word [ebp - 0x654]
movzx edx, word [ebp - 0x656]
movzx eax, word [ebp - 0x658]
add esp, 0xc
push ecx
movzx ecx, word [ebp - 0x65a]
push edx
movzx edx, word [ebp - 0x65e]
push eax
movzx eax, word [ebp - 0x660]
push ecx
push edx
push eax
lea ecx, [ebp - 0x24]
push ecx
push str._s__04d_02d_02d__02d_02d_02d.raw
lea edx, [ebp - 0x238]
push 0x20a
push edx
call fcn.00ab1dc5
push 0x20a
lea eax, [ebp - 0x448]
push 0
push eax
call fcn.00ab76b0
add esp, 0x34
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x448]
push edx
push 0x105
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x650]
push ecx
lea edx, [ebp - 0x66c]
push edx
call dword [0xac1b48]
push 0
push 0
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x448]
push ecx
call dword [0xac1b44]
mov bl, al
test bl, bl
je 0xab19a1
movzx eax, word [ebp - 0x66c]
lea esi, [eax + 2]
shr esi, 1
cmp esi, 0x20a
ja 0xab19a1
mov edx, dword [ebp - 0x668]
push eax
push edx
push edi
call fcn.00abab20
add esp, 0xc
xor eax, eax
mov word [edi + esi*2 - 2], ax
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
Function at 0xab1a70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0xac0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0xab1ab2
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
push str.NtQuerySystemInformation
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0xac1b40], esi
test esi, esi
je 0xab1a9f
push 0x2c
lea ecx, [ebp - 0x30]
push 0
push ecx
call fcn.00ab76b0
add esp, 0xc
push 0
push 0x2c
lea edx, [ebp - 0x30]
push edx
push 0
call esi
test eax, eax
js 0xab1a9f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
inc eax
mul dword [ebp - 0x28]
mov ebx, eax
mov eax, dword [ebp - 0x38]
mov esi, edx
mul dword [ebp - 0x3c]
push 0
push ecx
push edx
push eax
call fcn.00abb2e0
mov dword [ebp - 0x48], eax
mov edi, edx
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x14
shr eax, 0x14
push eax
push edx
push 7
push esi
push ebx
push 0xf
push str._n____Address_space_size:____I64d_bytes___I64d_Mb__n
call fcn.00ab1e01
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, edi
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
push 7
push edi
push eax
push 0xf
push str.____Free_space_size:_______I64d_bytes___I64d_Mb__n_n
call fcn.00ab1e01
add esp, 0x38
cmp edi, esi
ja 0xab1b6b
jb 0xab1a9f
cmp dword [ebp - 0x48], ebx
jb 0xab1a9f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
Function at 0xab1b80
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
mov eax, dword [0xac0008]
xor eax, esp
mov dword [esp + 0x3c8], eax
push ebx
push esi
push edi
push str.__DumpIt___v1.3.2.20110401___One_click_memory_memory_dumper_n
call fcn.00ab1060
add esp, 4
push 0xabe348
call fcn.00ab1e01
add esp, 4
push str.__Copyright__c__2010___2011__MoonSols__http:__www.moonsols.com__n_n
call fcn.00ab1e01
add esp, 4
call fcn.00ab17e0
test al, al
jne 0xab1bf6
push str._______Error:_Cannot_import_functions._n
call fcn.00ab1000
add esp, 4
call fcn.00ab2140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], ebx
mov word [esp + 0x48], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0xab1c54
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0xab1c43
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0xc], ebx
jne 0xab1c7d
push str._______Error:_This_application_requires_Administrator_privileges._n
call fcn.00ab1000
add esp, 4
call fcn.00ab2140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
call fcn.00ab1a70
test al, al
jne 0xab1caf
push str._______You_dont_have_enough_space_on_disk_to_dump_the_physical_memory._n
call fcn.00ab1000
add esp, 4
call fcn.00ab2140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
push 0x3b0
lea edx, [esp + 0x24]
push ebx
push edx
call fcn.00ab76b0
add esp, 0xc
lea edi, [esp + 0x94]
mov dword [esp + 0x28], 0x300021
call fcn.00ab1870
push str._____Destination_
call fcn.00ab1060
add esp, 4
mov eax, edi
push eax
push 0xabe5f8
call fcn.00ab10c0
add esp, 8
call fcn.00ab1120
test eax, eax
je 0xab1d9f
call fcn.00ab19c0
mov esi, eax
cmp esi, 0xffffffff
je 0xab1d9f
push str._____Processing...
call fcn.00ab1060
add esp, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0x3b0
lea edx, [esp + 0x2c]
push edx
push 0x3b0
mov eax, edx
push eax
push 0x22c000
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0xab1d65
push str.Failed._r_n_r_n
call fcn.00ab1e01
add esp, 4
push str._______Error:_DeviceIoControl____Cannot_send_IOCTL._r_n_r_n
call fcn.00ab1e01
add esp, 4
jmp 0xab1d93
cmp dword [esp + 0x24], ebx
jl 0xab1d81
cmp dword [esp + 0x20], 0x57333244
jne 0xab1d81
push str.Success._n
call fcn.00ab10c0
jmp 0xab1d8b
push str.Failed._n
call fcn.00ab1000
add esp, 4
call fcn.00ab2140
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00ab1720
mov ecx, dword [esp + 0x3d4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00ab1db6
mov esp, ebp
pop ebp
ret
Function at 0xab1db6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xac0008]
jne 0xab1dc0
repz ret
jmp fcn.00ab22d9

Function at 0xab8f75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xac0008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00ab5809
and dword [ebp - 0x14], 0
cmp dword [0xac1b20], 0
mov dword [ebp - 0x18], eax
jne 0xab9028
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0xab90d0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0xab90d0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xac1b20], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xac1b24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xac1b28], eax
call edi
push eax
call esi
mov dword [0xac1b30], eax
test eax, eax
je 0xab9028
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xac1b2c], eax
mov eax, dword [0xac1b2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0xab9081
cmp dword [0xac1b30], ecx
je 0xab9081
push eax
call esi
push dword [0xac1b30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0xab9081
test ebx, ebx
je 0xab9081
call edi
test eax, eax
je 0xab9078
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0xab9078
test byte [ebp - 8], 1
jne 0xab9081
or dword [ebp + 0x10], 0x200000
jmp 0xab90b4
mov eax, dword [0xac1b24]
cmp eax, dword [ebp - 0x18]
je 0xab90b4
push eax
call esi
test eax, eax
je 0xab90b4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0xab90b4
mov eax, dword [0xac1b28]
cmp eax, dword [ebp - 0x18]
je 0xab90b4
push eax
call esi
test eax, eax
je 0xab90b4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xac1b20]
call esi
test eax, eax
je 0xab90d0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0xab90d2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab1db6
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
mov ecx, 0x2e6f209b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x2bd14b28
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x100413d2
Capabilities:
Get file attributes

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret

Function at 0x10042e2a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ca89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
cmp dword [0x1154a570], 0
jne 0x100432c5
mov byte [ebp - 0x40], 5
mov byte [ebp - 0x3f], 0x91
mov byte [ebp - 0x3e], 7
mov byte [ebp - 0x3d], 0x5e
mov byte [ebp - 0x3c], 3
mov byte [ebp + 0x55], 0x8b
push ebp
mov ebp, esp
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10042f0a
push eax
push esi
push dword [ebp + 8]
call fcn.10042ebf
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
inc ebp
fsub dword [edi - 0x3a]
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10043395

Function at 0x10043328
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fsub dword [edi - 0x3a]
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10043395
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10042f0a
push eax
push esi
push dword [ebp + 8]
call fcn.10042ebf
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10042efa
sbb al, 0x45
pushal
xchg edi, eax
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10042efa
sub byte [edi - 0x7a72acab], ah
jl 0x100433e5
invalid
invalid
Function at 0x100435dc
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100435d1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100435ef
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add byte [eax], al
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1004364d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10043634
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1004363d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10043647
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10043629
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100435b3
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1004369a
dec eax
je 0x10043691
sub eax, 3
je 0x10043688
mov dword [ebp - 4], 0x40
jmp 0x100436b7
mov dword [ebp - 4], 4
jmp 0x1004369d
mov dword [ebp - 4], 0x20
jmp 0x1004369d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100436e9
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10043669
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10042efa
mov eax, 0xff68dd0f
jne 0x100436f4
push 1
push esi
call edi
mov eax, esi
jmp 0x100436f5
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10043e4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [eax]
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10042f0a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10042ebf
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10042efa
sar dword [ebp + 0x468752e], 1
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid