joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b670
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000b834
pushal
mov esi, 0x1000a015
lea edi, [esi - 0x9015]
push edi
jmp 0x1000b69a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1000b6a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1000b690
mov eax, 1
add ebx, ebx
jne 0x1000b6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1000b6a8
jne 0x1000b6c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000b6a8
xor ecx, ecx
sub eax, 3
jb 0x1000b6d8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000b74a
mov ebp, eax
add ebx, ebx
jne 0x1000b6e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1000b6f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1000b714
inc ecx
add ebx, ebx
jne 0x1000b700
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1000b6f5
jne 0x1000b711
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000b6f5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1000b734
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1000b725
jmp 0x1000b696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1000b734
add edi, ecx
jmp 0x1000b696
pop esi
mov edi, esi
mov ecx, 0xf4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1000b752
cmp byte [edi], 0
jne 0x1000b752
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1000b757
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x1000b7c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1000b784
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb07c]
or eax, eax
je 0x1000b7c0
mov dword [ebx], eax
add ebx, 4
jmp 0x1000b7a1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1000b7f7
cmp al, 0xef
ja 0x1000b7ea
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1000b7cc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1000b7d9
mov ebp, dword [esi + 0xb080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1000b82b
sub esp, 0xffffff80
jmp 0x10001060
Function at 0x5f65f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15c000]
mov dword [edi + 0x176098], 0x8001c00d
push edi
or ebp, 0xffffffff
jmp 0x5f661a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5f6621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f6610
mov eax, 1
add ebx, ebx
jne 0x5f6633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5f6644
jne 0x5f6654
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f6654
dec eax
add ebx, ebx
jne 0x5f6650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5f6628
xor ecx, ecx
sub eax, 3
jb 0x5f666c
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5f66de
sar eax, 1
mov ebp, eax
jmp 0x5f6677
add ebx, ebx
jne 0x5f6677
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x5f6684
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x5f66a8
inc ecx
add ebx, ebx
jne 0x5f6694
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5f6689
jne 0x5f66a5
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5f6689
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5f66c8
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5f66b9
jmp 0x5f6616
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5f66c8
add edi, ecx
jmp 0x5f6616
pop esi
mov edi, esi
mov ecx, 0xab39
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5f66e6
cmp byte [edi], 0x2a
jne 0x5f66e6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x5f66eb
lea edi, [esi + 0x1f3000]
mov eax, dword [edi]
or eax, eax
je 0x5f6763
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f8a90]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f8b94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5f6718
mov ecx, edi
jns 0x5f6747
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f8b98]
or eax, eax
je 0x5f675d
mov dword [ebx], eax
add ebx, 4
jmp 0x5f6735
call dword [esi + 0x1f8b9c]
popal
jmp 0x4015b8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x668a6396
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6e466ef7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10021bb
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100221c
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1002222
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x10], ebx
pop ebx
je 0x1002231
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
call fcn.010046a3
leave
ret

Function at 0x1002440
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1002481
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1002479
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1002519
lea eax, [ebp - 0x14]
push eax
push 0x1001460
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1002465
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1002465
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov ebx, 0x80020007
push ebx
push 4
push esi
push esi
push esi
call edi
mov esi, eax
cmp esi, 0x4a7
jne 0x1002500
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
xor esi, esi
call fcn.01001f2c
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x10024fa
push ebx
push 5
push eax
push eax
push eax
call edi
mov esi, eax
jmp 0x1002500
cmp dword [ebp - 4], 1
jne 0x1002515
test esi, esi
je 0x1002515
jle 0x1002512
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
pop edi
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
pop esi
jge 0x100253b
mov ecx, dword [ebp + 8]
push 0xcca
push 0xcc9
push dword [ebp - 4]
call fcn.010022e4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x10027ad
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, esi
jne 0x10027d4
mov dword [ebp - 4], 0x80004005
jmp 0x1002923
push ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
jne 0x1002802
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10027fa
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1002917
mov eax, dword [ebp - 0xc]
dec eax
mov dword [0x1007028], esi
mov dword [0x100702c], esi
mov dword [0x1007030], esi
je 0x1002911
dec eax
je 0x10028a5
sub eax, 4
mov esi, dword [sym.imp.msvcrt.dll_wcstol]
je 0x1002853
dec eax
je 0x100283f
mov dword [ebp - 4], 0x80070667
jmp 0x1002917
push 0xa
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x18]
call esi
add esp, 0xc
mov dword [edi + 0x448], eax
push 0xa
lea eax, [ebp - 8]
push eax
push dword [ebx + 8]
call esi
mov dword [edi + 0x438], eax
push 0xa
lea eax, [ebp - 8]
push eax
push dword [ebx + 0xc]
call esi
mov dword [edi + 0x43c], eax
push 0xa
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x10]
call esi
mov dword [edi + 0x440], eax
push 0xa
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x14]
call esi
xor esi, esi
add esp, 0x30
inc esi
mov dword [edi + 0x444], eax
mov dword [0x100702c], esi
jmp 0x10028a8
xor esi, esi
inc esi
push 0xa50
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x10028c1
push esi
mov ecx, eax
call sub.BDEUI.dll_public:_void___thiscall_BuiVolume::constructor_bool_
jmp 0x10028c3
xor eax, eax
mov dword [edi + 0x10], eax
test eax, eax
jne 0x10028d3
mov dword [ebp - 4], 0x8007000e
jmp 0x1002917
push dword [ebx + 4]
mov ecx, eax
call sub.BDEUI.dll_public:_long_int___thiscall_BuiVolume::Init_unsigned_short_int__
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002917
cmp dword [0x100702c], eax
jne 0x1002905
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
shr eax, 0x16
test al, 1
je 0x1002901
call sym.fvenotify.exe_public:_bool___thiscall_VolumeFveStatus::IsDisabled_void_
test al, al
je 0x1002905
xor eax, eax
jmp 0x1002907
mov eax, esi
mov dword [0x1007028], eax
mov dword [0x1007030], eax
mov dword [edi + 0x434], esi
test ebx, ebx
je 0x1002922
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x1003248
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x808], 0
push esi
push edi
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x804]
mov dword [ebp - 0x810], eax
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
mov dword [ebp - 0x80c], 0x400
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x10032d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10032c5
mov esi, eax
jmp 0x1003350
and eax, 0xffff
or eax, 0x80070000
jmp 0x10032be
xor eax, eax
inc eax
cmp dword [ebp - 0x808], eax
push ebx
jle 0x100333b
lea ebx, [eax + 1]
mov ecx, 0x10014a0
cmp ebx, dword [ebp - 0x808]
je 0x10032f2
mov ecx, 0x1001498
push dword [edi + eax*4]
lea eax, [ebp - 0x80c]
push ecx
push 0
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x80c]
push dword [ebp - 0x810]
call fcn.01002969
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1003348
mov eax, ebx
cmp eax, dword [ebp - 0x808]
jl 0x10032dd
cmp dword [ebp - 0x808], 1
jle 0x100333b
lea eax, [ebp - 0x804]
jmp 0x100333d
xor eax, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.010046a3
leave
ret

Function at 0x1003fed
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call sub.BDEUI.dll_public:_static_long_int___stdcall_BuiVolume::GetAllVolumes_struct__BuiVolumeNode___
mov dword [ebp - 8], eax
test eax, eax
jne 0x1004045
push edi
mov edi, dword [ebp - 4]
test edi, edi
je 0x1004044
push esi
mov esi, dword [edi]
mov ecx, esi
call sym.fvenotify.exe_public:_bool___thiscall_VolumeFveStatus::IsFveNotifyNecessary_void_
test al, al
je 0x100403c
push dword [ebp + 8]
add esi, 0x210
push 0
push esi
push 0x100156c
push 0x10014a8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, dword [edi + 4]
test edi, edi
jne 0x1004011
pop esi
pop edi
lea eax, [ebp - 4]
push eax
call sub.BDEUI.dll_public:_static_void___stdcall_BuiVolume::DeleteVolumeList_struct__BuiVolumeNode___
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x1024378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shl ecx, 1
mov edi, dword [edx + 0x1c]
add edi, ebx
jmp 0x1024514
adc edi, esi
test ch, 0xf7
nop
pop ecx
inc ecx
xchg edi, edi
lodsd eax, dword [esi]
cld
cld
cld
cmp ecx, dword [edx + 0x18]
mov eax, eax
lea edi, [eax + ebx]
jmp 0x102428f
cld
nop
je 0x1024472
add ebx, 0
push 0
sahf
pop eax
cld
mov edi, edi
test ah, cl
nop
clc
nop
test ecx, 0x47d1abb3
lea eax, [eax + eax*4]
jmp 0x10244aa
lea ebx, [ebx]
mov ebx, ebx
sahf
nop
nop
lea ecx, [ecx]
dec edi
cld
sub dword [esp], eax
lea edi, [edi]
add edi, 2
cmp byte [edi], 1
jmp 0x1024324
pop eax
ja 0x10242ac
mov edx, edx
push eax
jmp 0x10243d6
mov edx, ebx
mov esi, ebx
mov eax, ebx
jmp 0x1024492
xor dword [esp], 0xc93741b7
mov eax, 0x98595dbc
and eax, esi
pop eax
nop
xor eax, dword [esp + 4]
jne 0x1024262
mov esi, dword [edx + 0x24]
jmp 0x101f632
ret
add esi, ebx
ret 4
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
sbb edi, 0xfb26c9d4
xchg ecx, edi
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
jmp 0x102425b
imul eax, eax, 3
push eax
nop
movzx eax, byte [edi]
jmp 0x10242ed
add esi, ebx
adc dh, dl
not dh
movzx esi, word [ecx + esi]
mov esi, dword [edi + esi*4]
jmp 0x102447b
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x164c28bb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53d21a4f
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x505a64b4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2b0a1216
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4dda073f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5e253364
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402dec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043a8
test esi, esi
jne 0x402e23
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404498
jmp 0x402e44
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c88
mov dword [esp], eax
test esi, esi
je 0x402e44
cmp dword [ebx], 0
je 0x402e44
dec esi
jmp 0x402e2b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4034a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x453020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403540
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403520
xor eax, eax
push ebp
push 0x403519
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40355c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403520
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x453020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x453020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404224
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x455048], 0
je 0x404285
cmp word [0x45521c], 0xd7b2
jne 0x40424d
cmp dword [0x455224], 0
jbe 0x40424d
mov eax, 0x455218
call dword [0x455234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45306c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042ac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x453030], 0
jne 0x4042a1
push 0
push 0x453064
push 0x45306c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret