joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eb9f0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.10101a60
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.MSVCR120.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x100ebaa7
push 0x4a
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100f64b0
push 0x101b5dcc
push esi
push 0x101b5dd0
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.100f5ca0
add esp, 0x2c
call sub.MSVCR120.dll__errno
cmp dword [eax], 2
je 0x100eba89
call sub.MSVCR120.dll__errno
cmp dword [eax], 6
je 0x100eba89
push 0x53
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100f64b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100f64b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x101b5d68
call fcn.100ebfc0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100ebac9
push edi
call sub.MSVCR120.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.100ebbd0
push edi
push ebx
push 0x6a
push esi
call fcn.100ebc00
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x100ee230
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
xor dl, dl
test edi, edi
je 0x100ee29a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100ee29a
movzx esi, byte [edi]
cmp dword [esp + 0x18], ecx
jne 0x100ee25f
cmp esi, 0x7f
jbe 0x100ee295
mov ecx, 1
lea ebp, [ecx + eax]
jmp 0x100ee2a1
or dl, 0xff
cmp esi, 0x80
jbe 0x100ee274
mov ecx, 1
lea ebp, [ecx + eax]
jmp 0x100ee2a1
jne 0x100ee295
xor edx, edx
lea esi, [edx + 1]
cmp eax, esi
jbe 0x100ee28b
nop
movzx ecx, byte [esi + edi]
inc esi
or edx, ecx
cmp esi, eax
jb 0x100ee280
neg edx
sbb dl, dl
movzx ecx, dl
and ecx, 1
lea ebp, [ecx + eax]
jmp 0x100ee2a1
mov ebp, 1
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x100ee2eb
mov esi, dword [esi]
test esi, esi
je 0x100ee2eb
mov byte [esi], dl
push ebx
movzx edx, dl
lea ebx, [esi + ecx]
mov dword [esp + 0x14], edx
lea esi, [edi + eax]
and edx, 1
add ebx, eax
test eax, eax
je 0x100ee2e4
mov edi, dword [esp + 0x14]
sub ebx, esi
mov edi, edi
movzx ecx, byte [esi - 1]
lea esi, [esi - 1]
xor ecx, edi
add edx, ecx
mov byte [ebx + esi], dl
shr edx, 8
dec eax
jne 0x100ee2d0
mov eax, dword [esp + 0x20]
pop ebx
add dword [eax], ebp
pop edi
pop esi
mov eax, ebp
pop ebp
ret

Function at 0x100ee300
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
movzx ebx, al
add esi, edx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
and eax, 1
add edi, edx
test edx, edx
je 0x100ee339
movzx ecx, byte [edi - 1]
lea edi, [edi - 1]
xor ecx, ebx
lea esi, [esi - 1]
add eax, ecx
mov byte [esi], al
shr eax, 8
dec edx
jne 0x100ee323
pop edi
pop esi
pop ebx
ret
Function at 0x100f0a60
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x100f0b4c
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x100f0ade
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
jmp 0x100f0b2f
shl edx, 0x10
cmp esi, 2
jne 0x100f0aee
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x100f0b1b
lea ecx, [esi + 0x3c]
jmp 0x100f0b28
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x100f0a80
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x100f91e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x100f9204
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
dec esi
jne 0x100f91f6
pop edi
movzx eax, dl
pop esi
ret

Function at 0x100f9380
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.101845a0
mov eax, dword [0x102d5908]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x100f93f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100f93f5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push eax
call sub.MSVCR120.dll__vsnprintf
add esp, 0x10
lea ecx, [ebp - 0x208]
test eax, eax
push 0
push ecx
mov ecx, 0x200
cmovs eax, ecx
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100f9535
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f9400
sub ecx, edx
lea edi, [ecx + 1]
lea eax, [edi + edi]
call fcn.10185040
mov esi, esp
test esi, esi
jne 0x100f9424
mov esi, str.no_stack_
jmp 0x100f94b3
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x100f9451
xor ecx, ecx
test edi, edi
je 0x100f9451
lea esp, [esp]
mov eax, dword [ebp + 8]
movsx ax, byte [ecx + eax]
mov word [esi + ecx*2], ax
inc ecx
cmp ecx, edi
jb 0x100f9440
xor ecx, ecx
test edi, edi
je 0x100f94b3
lea ebx, [ecx + 0x53]
lea ebx, [ebx]
cmp word [esi + ecx*2], 0x25
jne case.0x100f9482.43
lea edx, [ecx + 1]
lea edx, [esi + edx*2]
lea ecx, [ecx]
movzx eax, word [edx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x100f9482.43
movzx eax, byte [eax + 0x100f9564]
jmp dword [eax*4 + 0x100f954c]
inc ecx
add edx, 2
jmp 0x100f9470
mov word [esi + ecx*2 + 2], bx
jmp case.0x100f9482.43
mov eax, 0x73
jmp 0x100f94a9
mov eax, 0x43
jmp 0x100f94a9
mov eax, 0x63
mov word [esi + ecx*2 + 2], ax
inc ecx
cmp ecx, edi
jb 0x100f9460
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 0x204]
push 0xff
push eax
call sub.MSVCR120.dll__vsnwprintf
add esp, 0x10
xor eax, eax
mov word [ebp - 6], ax
call fcn.100f9240
test eax, eax
jle 0x100f951f
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x100f9535
push 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x100f9535
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1018427c
mov esp, ebp
pop ebp
ret
Function at 0x100fa8d0
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call sub.MSVCR120.dll_getenv
add esp, 4
test eax, eax
je 0x100fa8f5
push 0x1e3
push str.....openssl_1.1.0fcryptoconfconf_mod.c
push eax
call fcn.10101610
add esp, 0xc
ret
call fcn.1012e320
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100fa900
push esi
push edi
sub eax, edx
push 0x1eb
push str.....openssl_1.1.0fcryptoconfconf_mod.c
lea edi, [eax + 0xd]
push edi
call fcn.100f8f10
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100fa92a
pop edi
pop esi
ret
push edi
call fcn.1012e320
push eax
push esi
call fcn.101019e0
push edi
push 0x10193670
push esi
call fcn.10101980
push edi
push str.openssl.cnf
push esi
call fcn.10101980
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
Function at 0x1012e400
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x1012e425
push 0x11f
push str.....openssl_1.1.0fcryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.100f64b0
add esp, 0x14
xor eax, eax
pop ebx
ret
push 0x100ffcc0
push 0x102db048
call fcn.100f8e40
add esp, 8
neg eax
sbb eax, eax
test dword [0x102db04c], eax
jne 0x1012e45f
push 0x123
push str.....openssl_1.1.0fcryptoengineeng_list.c
push 0x41
push 0x6a
push 0x26
call fcn.100f64b0
add esp, 0x14
xor eax, eax
pop ebx
ret
push esi
push edi
push dword [0x102dc510]
call fcn.100f8ec0
mov esi, dword [0x102db738]
add esp, 4
test esi, esi
je 0x1012e4dc
lea esp, [esp]
mov ecx, dword [esi]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1012e4a4
test dl, dl
je 0x1012e4a0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1012e4a4
add eax, 2
add ecx, 2
test dl, dl
jne 0x1012e484
xor eax, eax
jmp 0x1012e4a9
sbb eax, eax
or eax, 1
test eax, eax
je 0x1012e4b6
mov esi, dword [esi + 0x60]
test esi, esi
jne 0x1012e480
jmp 0x1012e4dc
test byte [esi + 0x4c], 4
je 0x1012e4d9
call fcn.100ffb00
mov edi, eax
test edi, edi
jne 0x1012e4cb
xor esi, esi
jmp 0x1012e4dc
push esi
push edi
call fcn.1012e6d0
add esp, 8
mov esi, edi
jmp 0x1012e4dc
inc dword [esi + 0x50]
push dword [0x102dc510]
call fcn.100f8e90
add esp, 4
test esi, esi
jne 0x1012e5c6
mov ecx, str.dynamic
mov eax, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1012e520
test dl, dl
je 0x1012e51c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1012e520
add eax, 2
add ecx, 2
test dl, dl
jne 0x1012e500
xor eax, eax
jmp 0x1012e525
sbb eax, eax
or eax, 1
test eax, eax
je 0x1012e5cc
push str.OPENSSL_ENGINES
call sub.MSVCR120.dll_getenv
test eax, eax
mov edi, str.D:opensourceopenssl_dist_1.1.0f_vs2013openssl_x86_static_release_vs2013libengines_1_1
push str.dynamic
cmovne edi, eax
call fcn.1012e400
mov esi, eax
add esp, 8
test esi, esi
je 0x1012e5cc
push 0
push ebx
push 0x101a4070
push esi
call fcn.10164050
add esp, 0x10
test eax, eax
je 0x1012e5cc
push 0
push 0x1019229c
push str.DIR_LOAD
push esi
call fcn.10164050
add esp, 0x10
test eax, eax
je 0x1012e5cc
push 0
push edi
push str.DIR_ADD
push esi
call fcn.10164050
add esp, 0x10
test eax, eax
je 0x1012e5cc
push 0
push 0x10192298
push str.LIST_ADD
push esi
call fcn.10164050
add esp, 0x10
test eax, eax
je 0x1012e5cc
push 0
push 0
push str.LOAD
push esi
call fcn.10164050
add esp, 0x10
test eax, eax
je 0x1012e5cc
pop edi
mov eax, esi
pop esi
pop ebx
ret
push esi
call fcn.100ffa70
push 0x153
push str.....openssl_1.1.0fcryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.100f64b0
push ebx
push 0x101d4344
push 2
call fcn.100f5ca0
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10147700
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.101845a0
mov eax, dword [0x102d5908]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10147776
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1014776a
mov eax, 8
call fcn.101845a0
movsd xmm0, qword [0x101e4e68]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.100f6d20
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x101477da
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x101477ce
mov eax, 8
call fcn.101845a0
movsd xmm0, qword [0x101e4e68]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.100f6d20
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.10147860
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.101845a0
movsd xmm0, qword [0x101a3ea0]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.100f6d20
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.101845a0
movsd xmm0, qword [0x101a3ea0]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.100f6d20
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.1018427c
add esp, 0x6c
ret
Function at 0x101492e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.101845a0
mov eax, dword [0x102d5908]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x10149346
cmp edi, dword [esi]
je 0x1014933d
test ebp, ebp
je 0x101493c0
test ebx, ebx
js 0x101493c0
mov eax, 1
mov dword [esi], edi
jmp 0x1014934c
mov edi, dword [esi]
test edi, edi
je 0x101493c0
test ebp, ebp
je 0x101494da
push edi
call fcn.100f5390
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x10149380
push 0x28
push str.....openssl_1.1.0fcryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.100f9210
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x101493db
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.100eef40
add esp, 0xc
test eax, eax
je 0x101493c0
push ebx
push ebp
push dword [esi + 4]
call fcn.100ef0f0
add esp, 0xc
test eax, eax
je 0x101493c0
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.100eeea0
add esp, 0xc
test eax, eax
jne 0x101493f7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1018427c
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x101493c0
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.MSVCR120.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x1014941a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x10149420
push edx
push edi
push dword [esi + 8]
call fcn.100eef40
add esp, 0xc
test eax, eax
je 0x101493c0
push edi
call fcn.100f5390
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.100ef0f0
add esp, 0x10
test eax, eax
je 0x101493c0
xor ecx, ecx
lea esp, [esp]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x10149470
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.100eef40
add esp, 0xc
test eax, eax
je 0x101493c0
push edi
call fcn.100f5390
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.100ef0f0
add esp, 0x10
test eax, eax
je 0x101493c0
push dword [esi + 8]
push dword [esi + 4]
call fcn.100ef100
add esp, 8
test eax, eax
je 0x101493c0
mov eax, 1
jmp 0x101493c2
test eax, eax
je 0x101494ba
jmp 0x1014941e
Function at 0x402ef0
Capabilities:
Create mailslot

Disassembly:
push ecx
cmp dword [0x2b8767c], 3
jne 0x402f12
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
xor dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
pop ecx
ret 0xc

Function at 0x403120
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x2b8767c]
mov ecx, dword [0x2b84588]
shr eax, 3
sub esp, 0x808
test eax, eax
jbe 0x4031f1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b8767c], 0x959
jne 0x4031d3
call esi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00402f60
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403160
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x408c70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430c30]
jne 0x408c7a
repz ret
jmp fcn.0040b78c

Function at 0x40af57
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405107
and dword [ebp - 4], 0
cmp dword [0x431fc4], 0
mov ebx, eax
jne 0x40b008
push 0x402ac4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b0b9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ab8
push edi
call esi
test eax, eax
je 0x40b0b9
push eax
call fcn.00405095
mov dword [esp], 0x402aa8
push edi
mov dword [0x431fc4], eax
call esi
push eax
call fcn.00405095
mov dword [esp], 0x402a94
push edi
mov dword [0x431fc8], eax
call esi
push eax
call fcn.00405095
mov dword [esp], 0x402a78
push edi
mov dword [0x431fcc], eax
call esi
push eax
call fcn.00405095
pop ecx
mov dword [0x431fd4], eax
test eax, eax
je 0x40b008
push 0x402a60
push edi
call esi
push eax
call fcn.00405095
pop ecx
mov dword [0x431fd0], eax
mov eax, dword [0x431fd0]
cmp eax, ebx
je 0x40b060
cmp dword [0x431fd4], ebx
je 0x40b060
push eax
call fcn.00405110
push dword [0x431fd4]
mov esi, eax
call fcn.00405110
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b060
test edi, edi
je 0x40b060
call esi
test eax, eax
je 0x40b057
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b057
test byte [ebp - 0xc], 1
jne 0x40b060
or dword [ebp + 0x10], 0x200000
jmp 0x40b099
mov eax, dword [0x431fc8]
cmp eax, ebx
je 0x40b099
push eax
call fcn.00405110
pop ecx
test eax, eax
je 0x40b099
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b099
mov eax, dword [0x431fcc]
cmp eax, ebx
je 0x40b099
push eax
call fcn.00405110
pop ecx
test eax, eax
je 0x40b099
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431fc4]
call fcn.00405110
pop ecx
test eax, eax
je 0x40b0b9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b0bb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219