joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582ae8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x582aff
add esp, 0xfffffff0
call fcn.00407388
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004ac538
mov eax, dword [0x5a0ec4]
cmp byte [eax], 0
jne 0x582b2c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x5a11c8]
cmp word [eax + 2], 0
jne 0x582b46
mov eax, dword [0x5a11c8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00584f70
mov eax, dword [0x5a12e8]
cmp word [eax + 2], 0
jne 0x582b60
mov eax, dword [0x5a12e8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00585388
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4d3aa4]
call fcn.004dadec
mov esi, eax
mov dword [ebx + 0x54], esi
mov byte [esi + 0x25], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x585838
mov dl, 1
mov eax, dword [0x471768]
call fcn.00406e34
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x471768]
call fcn.00406e34
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4d7c20]
call fcn.004e2298
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x582d54
mov eax, dword [0x5a107c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004e27fc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x585afc
mov dl, 1
mov eax, dword [0x471768]
call fcn.00406e34
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5a107c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421fe4
test eax, eax
je 0x582c77
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421de8
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421fc8
test eax, eax
je 0x582c8f
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040971c
push ebx
push 0x584948
call fcn.00573160
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5a0ec4]
cmp byte [eax], 0
jne 0x582ce0
mov eax, ebx
call fcn.00582f1c
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00585ea4
mov eax, ebx
call fcn.005869dc
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x582d4b
call fcn.004073e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58324c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5832ee
cmp dword [ebx + 0xac], 0
jne 0x5832e8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x58318c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5832e8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5832ae
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5832e8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.0049adf8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5832bd
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x583624
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5a8c34]
cmp dword [eax + 0x190], 0
je 0x583789
test bl, bl
jne 0x5836de
cmp dword [esi + 0xb4], 0
jne 0x5836d3
mov eax, esi
call fcn.0058682c
push eax
push 0x58352c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5836a4
mov eax, dword [0x5a8c34]
cmp byte [eax + 0xeb], 0
je 0x5836a4
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x583685
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5836a4
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x58368d
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5836d3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0049adf8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5836b3
inc dword [esi + 0xb4]
jmp 0x583789
cmp dword [esi + 0xb4], 0
jle 0x583789
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x583789
cmp dword [esi + 0x58], 0
je 0x58373e
mov eax, dword [0x5a8c34]
cmp byte [eax + 0xeb], 0
je 0x58373e
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x58371f
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x58373e
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x583727
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x58376d
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0049adf8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x58374d
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x56fb74]
call fcn.0040bc04
pop edi
pop esi
pop ebx
ret
Function at 0x584554
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5845af
cmp byte [ebx + 0xeb], 0
jne 0x5845af
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00408d64
mov eax, dword [esi]
test eax, eax
je 0x58459c
mov eax, dword [eax - 4]
test eax, eax
jne 0x5845bc
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00408fbc
jmp 0x5845bc
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00408fbc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5860b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x586129
mov eax, esi
call fcn.00507bd8
test al, al
je 0x586129
mov eax, dword [ebx + 0x98]
call fcn.00507770
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x586129
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x17c]
test al, al
je 0x58611a
push 0
mov eax, dword [ebx + 0x98]
call fcn.00507770
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.004fda9c
jmp 0x586129
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00585ec4
pop esi
pop ebx
ret
Function at 0x58bc14
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x98], 0
jne 0x58bc9a
mov eax, dword [ebx + 8]
call fcn.00507770
mov ecx, eax
mov dl, 1
mov eax, dword [0x514be4]
call fcn.00501280
mov dword [ebx + 0x98], eax
mov esi, dword [ebx + 0x98]
xor edx, edx
mov eax, esi
call fcn.0051a314
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f0], 0x58b4e4
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x98]
call fcn.00507770
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x98]
call fcn.00507770
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa8], 0
jne 0x58bd1c
mov eax, dword [ebx + 8]
call fcn.00507770
mov ecx, eax
mov dl, 1
mov eax, dword [0x514be4]
call fcn.00501280
mov dword [ebx + 0xa8], eax
mov esi, dword [ebx + 0xa8]
mov dl, 1
mov eax, esi
call fcn.0051a314
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f0], 0x58b530
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa8]
call fcn.00507770
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa8]
call fcn.00507770
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa0], 0
jne 0x58bd9a
mov eax, dword [ebx + 8]
call fcn.00507770
mov ecx, eax
mov dl, 1
mov eax, dword [0x515728]
call fcn.00501280
mov dword [ebx + 0xa0], eax
mov esi, dword [ebx + 0xa0]
mov byte [esi + 0x2c8], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa0]
call fcn.00507770
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa0]
call fcn.00507770
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5910e0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9c8
push ebx
xor edx, edx
mov dword [ebp - 0x634], edx
mov dword [ebp - 0x638], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5911df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x591157
lea edx, [ebp - 0x638]
lea eax, [ebp - 0x21a]
call fcn.004220cc
mov eax, dword [ebp - 0x638]
lea edx, [ebp - 0x634]
call fcn.00421c38
mov edx, dword [ebp - 0x634]
lea eax, [ebp - 4]
mov ecx, 0x5911f8
call fcn.004098cc
jmp 0x591164
lea eax, [ebp - 4]
mov edx, 0x591208
call fcn.00409004
push 0x20a
lea eax, [ebp - 0x62e]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x20a
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.00409680
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x5911ab
mov ecx, ebx
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.00421314
jmp 0x5911b7
mov eax, ebx
mov edx, 0x59121c
call fcn.00408fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5911e6
lea eax, [ebp - 0x638]
mov edx, 2
call fcn.00408c2c
lea eax, [ebp - 4]
call fcn.00408bcc
pop eax
jmp eax
Function at 0x591474
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x59147c
push ecx
push ebx
xor eax, eax
push ebp
push 0x591840
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004097f4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5914aa
mov ebx, dword [ebx - 4]
push ebx
mov eax, dword [ebp - 4]
call fcn.00409680
push eax
push 0x59184c
call sub.kernel32.dll_GetEnvironmentVariableW
mov edx, eax
lea eax, [ebp - 4]
call fcn.004097f4
lea eax, [ebp - 0x28]
call fcn.005910e0
lea eax, [ebp - 0x28]
mov edx, 0x591868
call fcn.00409874
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 8]
push eax
mov cl, 1
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004cd188
lea eax, [ebp - 0x30]
call fcn.005910e0
lea eax, [ebp - 0x30]
mov edx, 0x591880
call fcn.00409874
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004cd188
lea eax, [ebp - 0x34]
call fcn.005910e0
lea eax, [ebp - 0x34]
mov edx, 0x591898
call fcn.00409874
mov ebx, dword [ebp - 0x34]
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004cd188
mov edx, dword [ebp - 8]
mov eax, 0x5918b0
call fcn.00591228
mov edx, dword [ebp - 0xc]
mov eax, 0x591910
call fcn.00591228
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00421864
test al, al
je 0x5917d4
mov dl, 1
mov eax, dword [0x4cdd4c]
call fcn.004cefb0
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x591607
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.004cf098
mov cl, 1
mov edx, 0x591970
mov eax, dword [ebp - 0x24]
call fcn.004cf0fc
test al, al
je 0x5915ef
push 0x5919d8
push dword [ebp - 8]
push 0x5919e8
push dword [ebp - 0xc]
push 0x5919d8
lea eax, [ebp - 0x38]
mov edx, 5
call fcn.00409954
mov ecx, dword [ebp - 0x38]
mov edx, 0x5919fc
mov eax, dword [ebp - 0x24]
call fcn.004cf640
mov eax, dword [ebp - 0x24]
call fcn.004cf068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59160e
mov eax, dword [ebp - 0x24]
call fcn.00406e64
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591847
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00408c2c
lea eax, [ebp - 0x4c]
call fcn.00408c14
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00408c2c
lea eax, [ebp - 0x40]
call fcn.0040d6bc
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00408c2c
lea eax, [ebp - 0x28]
call fcn.00408bcc
lea eax, [ebp - 0x20]
call fcn.0040d6bc
lea eax, [ebp - 0x1c]
call fcn.0040d6bc
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00408c2c
pop eax
jmp eax
Function at 0x591d08
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
add esp, 0xfffffff8
push 0
call sub.kernel32.dll_GetModuleHandleW
mov ecx, eax
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ebx, dword [eax + 0x34]
add ebx, dword [eax + 0x28]
mov eax, 0x591cdc
sub eax, 5
mov dword [esp], eax
mov eax, dword [esp]
sub eax, ebx
mov dword [esp], eax
lea eax, [esp + 4]
push eax
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x591d8b
mov eax, 0x5a0e8d
mov edx, eax
mov eax, esp
mov ecx, 4
call fcn.004058a0
mov edx, ebx
mov eax, 0x5a0e8c
mov ecx, 6
call fcn.004058a0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
pop ebx
ret

Function at 0x591ef4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov esi, edx
mov edi, ebx
sub esi, edi
sub esi, 5
push esp
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xe9
inc edi
mov dword [edi], esi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x403320
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4033a6
cmp ax, 9
je 0x403394
cmp ax, 0x20
je 0x403394
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4033f2
cmp ax, 0x22
je 0x403400
mov dword [ebp - 0x54], 0
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x4033a6
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403350
test edi, 1
jne 0x403350
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x403394
cmp ax, 0x20
je 0x403394
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x403412
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x40336b
and dword [ebp - 0x54], 1
jne 0x403364
xor edi, 1
jmp 0x40336b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x4033bf

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x217b6fb3
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..text
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5441e5b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x86340c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x487c0928
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401c10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x438ce2
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x441d90
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x401cfc
mov ebx, dword [sym.imp.MSVCR71.dll_fseek]
push 2
push 0
push esi
call ebx
push esi
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push esi
mov edi, eax
call ebx
push edi
call sub.MFC71.DLL_operator_new
push esi
push edi
mov ebx, eax
push 1
push ebx
call dword [sym.imp.MSVCR71.dll_fread]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x34
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov eax, dword [ebp + 0xf4]
push 0
push 0
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x401cd3
push 0
push str.CryptionRCC
push str.This_Mode_Disable
mov ecx, ebp
call sub.MFC71.DLL_CWnd::MessageBoxA
jmp 0x401cdd
push edi
push ebx
call fcn.00403490
add esp, 8
push 0x441d6c
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x401d27
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCR71.dll_fwrite]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x401d70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x438ce2
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x441d90
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x401e5c
mov ebx, dword [sym.imp.MSVCR71.dll_fseek]
push 2
push 0
push esi
call ebx
push esi
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push esi
mov edi, eax
call ebx
push edi
call sub.MFC71.DLL_operator_new
push esi
push edi
mov ebx, eax
push 1
push ebx
call dword [sym.imp.MSVCR71.dll_fread]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x34
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov eax, dword [ebp + 0xf4]
push 0
push 0
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x401e33
push 0
push str.CryptionRCC
push str.This_Mode_Disable
mov ecx, ebp
call sub.MFC71.DLL_CWnd::MessageBoxA
jmp 0x401e3d
push edi
push ebx
call fcn.004034c0
add esp, 8
push 0x441d6c
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x401e87
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCR71.dll_fwrite]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x24]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x403490
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x4034b1
mov ecx, dword [esp + 8]
nop
mov dl, byte [eax + ecx]
xor dl, 0xdf
add dl, 6
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jl 0x4034a0
pop esi
ret

Function at 0x4034c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x4034e1
mov ecx, dword [esp + 8]
nop
mov dl, byte [eax + ecx]
sub dl, 6
xor dl, 0xdf
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jl 0x4034d0
pop esi
ret