joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd2b13c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0d15aec
jmp 0xd2b1c0
mov word [edi], ds
push dword [esp + 0xc]
ret 0x10
mov dword [esp + 1], eax
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
call 0xd2b13c
jp 0xd2b114
jp 0xd2b14f
in al, dx
pop ebp
xchg ecx, eax
adc bh, bh
je 0xd2b15d
push dword [esp + 4]
jmp 0xd2b11d
add al, 0xeb
loope 0xd2b125
push ebx
add byte [eax], al
add byte [esi - 1], ah
je 0xd2b169
add edi, dword [edx + 0x36]
push word [esp + 6]
mov word [esp + 4], cx
dec esp
and al, 4
mov dword [esp + 0x28], esi
jmp 0xd2b19a
mov al, byte [0x47d4a50a]
mov word [esp], si
push word [esp]
jno 0xd2b136
and al, 0x71
retf 0x74ff
push dword [esp + 4]
mov dword [esp + 1], eax
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
jmp 0xd2b129
call fcn.00d2b25b
lea esp, [esp + 0x24]
jmp 0xd2b1d6
xchg ch, ah
lea eax, reloc.MSVFW32.dll_DrawDibDraw
mov ax, word [esp]
xchg bh, al
jmp 0xd2b1f2
pushfd
jmp 0xd2a612
jmp 0xd2b22e
mov esi, dword [esp + 0x2c]
lea ebx, [eax*4]
rdtsc
sub esp, 0x1e
jbe 0xd2b1dc
lea esp, [esp + 2]
jmp 0xd2b232
xor bx, bp
jg 0xd2b240
jle 0xd2b240
mov ebp, esp
rcl cx, cl
jne 0xd2b2bc
mov eax, 0xc08c2263
mov edx, esi
jmp 0xd2b287
lea esp, [esp + 2]
lea edi, [esp + 0x1c]
xchg dx, bx
mov ebp, 0xe43ce8f
jmp 0xd2b20a
sub esp, 0xa4
jmp 0xd2b211
mov edx, esi
mov eax, 0xc08c2263
jmp 0xd2b285

Function at 0xd2b162
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0d15aec
jmp 0xd2b1c0
mov word [edi], ds
push dword [esp + 0xc]
ret 0x10
mov dword [esp + 1], eax
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
call 0xd2b13c
jp 0xd2b114
jp 0xd2b14f
in al, dx
pop ebp
xchg ecx, eax
adc bh, bh
je 0xd2b15d
push dword [esp + 4]
jmp 0xd2b11d
add al, 0xeb
loope 0xd2b125
push ebx
add byte [eax], al
add byte [esi - 1], ah
je 0xd2b169
add edi, dword [edx + 0x36]
push word [esp + 6]
mov word [esp + 4], cx
dec esp
and al, 4
mov dword [esp + 0x28], esi
jmp 0xd2b19a
mov al, byte [0x47d4a50a]
mov word [esp], si
push word [esp]
jno 0xd2b136
and al, 0x71
retf 0x74ff
push dword [esp + 4]
mov dword [esp + 1], eax
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
jmp 0xd2b129
call fcn.00d2b25b
lea esp, [esp + 0x24]
jmp 0xd2b1d6
xchg ch, ah
lea eax, reloc.MSVFW32.dll_DrawDibDraw
mov ax, word [esp]
xchg bh, al
jmp 0xd2b1f2
pushfd
jmp 0xd2a612
jmp 0xd2b22e
mov esi, dword [esp + 0x2c]
lea ebx, [eax*4]
rdtsc
sub esp, 0x1e
jbe 0xd2b1dc
lea esp, [esp + 2]
jmp 0xd2b232
xor bx, bp
jg 0xd2b240
jle 0xd2b240
mov ebp, esp
rcl cx, cl
jne 0xd2b2bc
mov eax, 0xc08c2263
mov edx, esi
jmp 0xd2b287
lea esp, [esp + 2]
lea edi, [esp + 0x1c]
xchg dx, bx
mov ebp, 0xe43ce8f
jmp 0xd2b20a
sub esp, 0xa4
jmp 0xd2b211
mov edx, esi
mov eax, 0xc08c2263
jmp 0xd2b285

Function at 0xd2b25b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x24], edi
jmp 0xd2b19f
Function at 0xe0b110
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
neg esi
lea edx, [ecx*4]
pop esi
mov word [esp], ax
jmp 0xe0b138
mov si, word [esp + 5]
mov cl, 0x9c
mov bx, word [esp + 6]
mov dx, 0xe6f8
jmp 0xe0b0fa
cpuid
mov dl, bh
mov edi, 0x35d4965f
mov byte [esp + 2], bl
mov al, 0x9e
jmp 0xe0b18d
lea edi, [edx*4]
cld
mov dl, byte [esp + 1]
pop esi
mov ah, ch
xor bh, dh
jmp 0xe0b122
sub esp, 0x1e
mov di, word [esp + 0x16]
mov byte [esp + 0x1c], dh
bts edi, ecx
jmp 0xe0b1a8
add esp, 0
neg bl
sub esp, 1
pop cx
bsr si, dx
cpuid
jmp 0xe0b15e
lea esp, [esp + 4]
lea edx, [edi*4]
mov cx, word [esp + 1]
lea esp, [esp + 1]
mov bl, 0xa
cmp si, di
jmp 0xe0b174
rdtsc
mov word [esp + 0xa], cx
xchg byte [esp + 0x15], bl
mov dl, byte [esp + 5]
jmp 0xe0b28e
sub esp, 0x19
lea esp, [esp + 0x4c]
bswap eax
cmp bx, 0x4d30
jmp 0xe0b25f
enter 0xffffffffffff8166, 0xfffffffffffffffb
xor byte [ebp - 0x15], cl
jg 0xe0b214
sub al, byte [ebp - 0xc]
out 0xe, eax
stc
setae dl
xchg ebp, ebx
sub esp, 0x13
push ebx
pop word [esp + 2]
jmp 0xe0b1d0
mov dl, 0x31
not bx
cpuid
call fcn.00e0b23f
mov word [ecx], ds
mov eax, ebp
sbb esi, dword [eax - 0x70178512]
jp 0xe0b1d8
invalid
mov dh, byte [esp]
lea ecx, [esi*4]
and al, 0x8d
or al, 0xb5
add byte [eax], al
add byte [eax], al
bts ebp, ecx
bt di, cx
xchg edx, ebp
cpuid
jmp 0xe0b1f7
rcl dx, 3
mov dx, 0xafcd
lea ebp, [esp + ecx]
dec ebp
rcr cx, cl
btc dx, cx
jmp 0xe0b212
xchg dword [esp + 7], ecx
not ebx
mov ah, dl
add si, sp
xchg dword [esp + 5], edi
rdtsc
jmp 0xe0b1e6

Function at 0xe0b3c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xc], dx
not si
pop word [esp + 5]
xchg ebx, esi
mov bl, 0x21
jmp 0xe0b3ad

Function at 0xe0b64c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0xd], ch
bswap edx
add esp, 4
push word [esp + 0x1b]

Function at 0xe0b930
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xf
lea ebp, [esp + edx]
push word [esp]
sub esp, 0xb
rdtsc
jmp 0xe0b99c
mov al, 0xb6
xor cl, cl
xchg di, cx
xchg dh, al
jmp 0xe0b91a
mov si, sp
mov ch, 0xe7
ror al, cl
setp dl
xchg word [esp + 0x11], bp
bsf bx, cx
jmp 0xe0b957
sub esp, 0xc
pop bp
lea esp, [esp + 5]
mov eax, dword [esp + 0xe]
lea edx, [ecx + ecx]
bsr si, si
jmp 0xe0b96d
Function at 0xe0bae4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xb], si
call fcn.00e0b8db
mov dl, cl
bsf dx, sp
bsf eax, edx
btc ax, bp
xchg bh, bl
jmp 0xe0b982
mov dl, 0x63
pop di
neg ax
btc esi, eax
push sp
dec di
jmp 0xe0b9c8
mov ax, word [esp + 3]
sub esp, 9
sub esp, 0x1e
lea esp, [esp + 0x23]
jmp 0xe0ba64
lea ebp, [esp + 0xe6]
neg ah
pop word [esp + 1]
mov al, 0x15
add esp, 0xd
push word [esp + 3]
jmp 0xe0b9b2
sub cl, bl
mov cl, bl
mov ah, bh
jmp 0xe0b94d
mov di, sp
pop ebx
pop word [esp + 1]
inc ecx
push ebp
rol ebx, 0x11
jmp 0xe0ba3d
xchg byte [esp + 2], dl
pop ax
neg cx
mov byte [esp + 7], ah
pushfd
pop word [esp + 2]
jmp 0xe0b9fc
mov eax, ebp
mov ch, byte [esp + 6]
neg ebp
mov ch, 0x74
xchg al, ah
bswap ebp
jmp 0xe0bafa
dec ch
xchg word [esp + 3], di
cmc
push word [esp + 5]
sub di, 0x1b99
push dword [esp]
jmp 0xe0ba27
adc cl, 0xac
mov al, bl
mov ebp, 0x20ce7a64
xchg dword [esp + 1], esi
cld
inc edi
jmp 0xe0ba12
mov eax, dword [esp + 3]
cpuid
mov si, bx
rdtsc
rcr dl, 0
btr ebp, ebx
jmp 0xe0baa8
lea ebp, [ebx + 0x96]
lea eax, [ebp + ebp]
mov byte [esp + 4], dl
add esp, 3
mov edx, dword [esp + 2]
mov edx, dword [esp]
jmp 0xe0ba76
pop word [esp + 1]
push word [esp + 3]
pop bx
mov byte [esp + 1], cl
jmp 0xe0bad0
lea ebx, [edx + ebp]
cmc
push dword [esp]
xchg byte [esp + 7], dl
cpuid
xchg edi, ebx
jmp 0xe0ba8e
setne al
mov dl, 0xed
pushal
mov byte [esp + 0xe], bh
xchg bp, cx
popal
call 0xe0bae4
jbe 0xe0bace
mov al, byte [0x68000000]
loope 0xe0bb5d
adc bl, ah
inc esi
stosb byte es:[edi], al
and dh, byte [eax - 0x1c09dd29]
sbb dh, byte [ebp + 0x64]
xchg edi, eax
lea eax, [esp + ecx]
xchg byte [esp + 1], bh
add esp, 0xc
mov byte [esp + 2], dh
inc eax
bswap eax
jmp 0xe0babf
cmp esi, dword [edx + reloc.MSVFW32.dll_DrawDibDraw]
xor ebp, dword [edx]
inc ebp
hlt

Function at 0xe0bd31
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0xc]
jmp 0xe0bd5f
mov ebp, dword [esp + 0xd]
cpuid
pop di
pop word [esp + 0x1b]
mov si, word [esp + 0xb]
xchg bl, cl
jmp 0xe0bdb0
xchg byte [esp + 0x31], dl
cpuid
btr si, sp
mov bh, bl
rdtsc
neg edx
jmp 0xe0bdc9
pop dword [esp + 0x16]
push ss
lea ebx, [ebp + 0xec]
xchg dx, ax
xchg word [esp + 0x26], bx
mov dword [esp + 0xa], edx
std
jmp 0xe0bd9a
popal
adc al, 0x81
setp bl
rdtsc
xchg dl, cl
pop edi
jmp 0xe0bed6
mov esi, dword [esp + 0xe]
pop word [esp + 5]
lea edi, reloc.MSVFW32.dll_DrawDibDraw
jmp 0xe0be1f
lea edi, reloc.MSVFW32.dll_DrawDibDraw
mov cx, word [esp + 0xa]
mov ax, word [esp + 0xa]
std
mov esi, edx
btr ebx, ebp
jmp 0xe0bdf1
setp al
pop dword [esp + 4]
call 0xe0be2c
jl 0xe0bdb3
out 0x87, eax
ljmp 0xebe6
xchg ch, al
pop word [esp + 1]
not cx
xchg byte [esp + 1], ch
lea ebp, [edx*4]
xchg word [esp + 3], bx
jmp 0xe0be07
rdtsc
mov dword [esp], eax
btr eax, edi
mov si, word [esp + 7]
rcr ah, 6
mov word [esp + 0xa], bp
jmp 0xe0be44
Function at 0xe106be
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00e1020b
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0xe10886
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xe10206
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xe10818
Function at 0x625ee1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x625ef0
mov dword [esp + 0xb], esi
push word [esp + 1]
push dword [esp + 4]
jmp 0x625eca
pushfd
cmc
jo 0x62606b
xchg ecx, esi
not dh
lea edx, [esi*4]
jmp 0x625fb5
push dword [esp]
ret 4
xchg dword [esp], ebp
lea ebp, [eax + edi]
xor ebp, esi
mov di, word [esp]
not ax
bswap ebx
jmp 0x625f4c
lea ebp, [ebp - 0x13c]
lea ebx, [esi*4]
xchg si, dx
setge ah
bsf si, si
sub edx, eax
jmp 0x625f66
btc esi, edi
and cl, bh
jmp 0x62600f
mov edi, dword [esp + 0x28]
lea ebp, [ebx*4]
btr ecx, esp
jl 0x625f9c
jge 0x62602c
pushfd
sbb eax, 0x3027d48d
out dx, al
outsb dx, byte [esi]
cld
wait
jbe 0x626041
cld
adc dword [ebx], 0x76
test ecx, esp
mov byte [edi - 0x30f0dbd4], 0x66
mov ebx, dword [esp]
xchg bh, cl
mov bx, 0xd077
bswap ecx
jmp 0x625f81
sub esp, 0xa4
mov esi, esp
lea eax, [eax + edi]
sub esp, 6
jmp 0x626033
lea ebp, [esp]
pushal
pop dword [esp + 0xc]
mov ecx, 0xd11185ee
xchg dword [esp + 0x12], ecx
jmp 0x625fed
btc esi, edi
and cl, bh
jmp 0x62600f
jae 0x62604a
mov ax, bx
mov dh, byte [esp + 3]
jmp 0x62608d
or eax, dword [esi]
dec edi
salc
inc ecx
ret
mov ax, bx
mov dh, byte [esp + 3]
lea esp, [esp + 2]
mov ebx, edi
bswap ecx
mov edx, esp
bsf ax, ax
je 0x626072
xchg ecx, eax
jmp fcn.00625c82
xchg ecx, esi
call fcn.00625f1d
jmp 0x6265c4
lea esp, [esp + 2]
jmp 0x626055
xchg ecx, eax
jmp fcn.00625c82
Function at 0x11c4c90
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [eax*4]
setae ch
add esp, 8
shl bp, cl
push esp
xchg di, ax
jmp 0x11c4af2
mov dl, dh
pop dword [esp + 3]
mov edi, dword [esp]
lea eax, [esp + ebx]
clc
xchg word [esp + 1], dx
jmp 0x11c49e3
btr ebx, edx
lea esi, [eax*4]
xchg esi, edi
neg ecx
mov bx, word [esp + 0xe]
jmp 0x11c4ab3
rdtsc
xchg bp, cx
btr ebp, esp
mov bh, byte [esp + 7]
bswap ebp
bswap ecx
jmp 0x11c4a1c
rdtsc
lea esp, [esp + 4]
inc cl
stc
xchg ah, bl
mov ch, byte [esp + 5]
jmp 0x11c4a9b
stc
setnp dh
push edx
add esp, 2
mov ecx, eax
lea ecx, [esi - 0x4d]
jmp 0x11c4a81
rdtsc
rcl dx, cl
xchg dx, di
rdtsc
cpuid
sub esp, 0xc
jmp 0x11c4a48
mov al, ah
lea ecx, [esi*4]
mov byte [esp + 1], ch
sub esp, 0x10
jmp 0x11c4ac7
xchg word [esp + 0xa], dx
xchg dh, al
pop ebp
not ah
xchg bh, cl
add esp, 0xc
jmp 0x11c4a59
neg bx
ror ebp, 3
btc edx, edi
lea esp, [esp + 6]
xchg dword [esp + 2], ecx
clc
jmp 0x11c4a70
xchg word [esp + 9], si
neg esi
pop dword [esp + 1]
pushal
bswap ebp
mov bp, word [esp + 0x1f]
jmp 0x11c4b11
mov ax, 0xec8d
btc ecx, edi
lea esi, [esp + ecx]
sub esp, 0xa
rdtsc
jmp 0x11c4b90
mov edx, 0x507d0e0a
push word [esp + 6]
push word [esp + 7]
push word [esp + 2]
push word [esp]
neg ebx
jmp 0x11c4a36
bsr dx, cx
mov ax, 0x2e93
bswap esi
sub esp, 0x18
lea esp, [esp + 0x47]
rdtsc
jmp 0x11c4adc
mov cl, ch
btr ebx, edx
add esp, 0xd
xchg di, si
push dword [esp + 0xa]
mov bx, word [esp]
jmp 0x11c4a08
xchg dword [esp + 0x14], edx
pop word [esp + 0x14]
cpuid
mov dword [esp + 0x19], esi
xchg byte [esp + 0x10], al
jmp 0x11c4bd3
add cx, 0x7b3e
neg ebp
pop dword [esp + 4]
push dword [esp + 0x16]
xchg bh, cl
jmp 0x11c4b42
add esp, 9
mov dl, 0x14
clc
pushal
pop cx
xchg ebp, esi
jmp 0x11c4b5b
mov dl, dh
xchg word [esp + 5], bp
bsf bx, si
push word [esp + 3]
push word [esp + 7]
cld
jmp 0x11c4b72
sub esp, 0xc
clc
call fcn.011c4bb2
mov al, byte [0xb24748a]
mov dh, byte [esp + 0xb]
mov cx, di
xchg edi, ebx
popal
mov byte [esp], ch
rdtsc
stc
jmp 0x11c4ba8
inc ebp
mov bl, 0xe8
xchg word [esp + 3], si
xchg byte [esp + 0x10], dl
btr ecx, edx
mov dh, byte [esp + 7]
jmp 0x11c4b2a
sub esp, 0x18
mov di, 0xa7ef
pop dword [esp + 8]
jmp 0x11c4bfd

Function at 0x11c4cee
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [esp]
mov edx, dword [esp]
lea ebp, [ecx + 0x13]
lea esp, [esp]
sub esp, 0x18
mov ax, word [esp + 1]
jmp 0x11c4cfd
btr eax, edx
xchg ah, bl
add esp, 4
mov byte [esp], dh
xchg ah, bl
jmp 0x11c4ccf
not dh
mov byte [esp + 0xf], ch
mov di, word [esp + 0xc]
mov word [esp], bx
ror ch, 5
jmp 0x11c4d61
lea ebx, [edx*4]
mov ax, 0x2421
pop dword [esp + 0x10]
lea ecx, [ecx + 0x4b]
jmp 0x11c4d2a
lea ebp, [edx*4]
neg bp
lea edi, [eax + edx]
xchg ebx, esi
mov ah, byte [esp + 1]
lea esi, [esi - 0x65]
jmp 0x11c4d48
Function at 0x11c5046
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pop ecx
neg bh
btr ebx, esp
mov word [esp + 2], dx
xchg edi, eax
jmp 0x11c5030
bsf ax, ax
pop word [esp + 1]
mov dl, dh
push edx
mov dword [esp + 3], esi
jmp 0x11c5061
jmp 0x11c501d
btc eax, edi
cld
xchg ecx, ebp
shr eax, 5
mov eax, dword [esp + 1]
lea ebp, [esi + edi]
jmp 0x11c50aa
lea ebp, [edx*4]
not ah
setge ch
mov ah, byte [esp + 1]
jmp 0x11c5048
bswap eax
push word [esp + 7]
mov cl, ch
rcr ah, 1
mov edx, dword [esp + 7]
stc
jmp 0x11c5094

Function at 0x11c7c07
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.011c605c
mov word [esp + 7], dx
lea esp, [esp + 1]
mov dword [esp + 0x94], edi
jmp 0x11c7ee5
push eax
jmp 0x11c6057
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x11c7e77
lea esp, [esp + 0x94]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x11c7ec5

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x401050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x42a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x424bd0
push 0x84
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.004022a6
push str.net451
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x40109e
inc esi
jmp 0x401148
push str.net452
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x4010b6
push 2
jmp 0x401147
push 0x424bfc
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x4010cb
push 3
jmp 0x401147
push str.net461
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x4010e0
push 4
jmp 0x401147
push str.net462
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x4010f5
push 5
jmp 0x401147
push 0x424c28
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x40110a
push 6
jmp 0x401147
push str.net471
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x40111f
push 7
jmp 0x401147
push str.net472
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x401134
push 8
jmp 0x401147
push 0x424c54
lea ecx, [ebp - 8]
call fcn.00401e95
test eax, eax
jne 0x401148
push 9
pop esi
lea ecx, [ebp - 8]
call fcn.00401ecc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040a3ad
leave
ret
Function at 0x439940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x29000]
push edi
jmp 0x43995a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x439961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x439950
mov eax, 1
add ebx, ebx
jne 0x439973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x439968
jne 0x439984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x439968
xor ecx, ecx
sub eax, 3
jb 0x439998
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x439a0a
mov ebp, eax
add ebx, ebx
jne 0x4399a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4399b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4399d4
inc ecx
add ebx, ebx
jne 0x4399c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4399b5
jne 0x4399d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4399b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4399f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4399e5
jmp 0x439956
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4399f4
add edi, ecx
jmp 0x439956
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x439a12
cmp byte [edi], 0x12
jne 0x439a12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x439a17
lea edi, [esi + 0x37000]
mov eax, dword [edi]
or eax, eax
je 0x439a8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4dc34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4dd14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x439a44
mov ecx, edi
jns 0x439a73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4dd1c]
or eax, eax
je 0x439a89
mov dword [ebx], eax
add ebx, 4
jmp 0x439a61
call dword [esi + 0x4dd18]
mov ebp, dword [esi + 0x4dd20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x439ac3
sub esp, 0xffffff80
jmp 0x41942f
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x484cda
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x484a08
inc ecx
and ecx, ecx
mov eax, ecx
call fcn.00484d0b
and eax, eax
or eax, ecx
xor dword [edx], edi
and eax, ecx
or ecx, eax
add edx, 2
sub eax, 0xe5faf5cc
cmp edx, ebx
jl fcn.00484cda
mov eax, eax
ret
Function at 0x4030ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x499020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403144
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403124
xor eax, eax
push ebp
push 0x40311d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403160
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403124
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x499020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x499020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49c04c], 0
je 0x403f91
cmp word [0x49c220], 0xd7b2
jne 0x403f59
cmp dword [0x49c228], 0
jbe 0x403f59
mov eax, 0x49c21c
call dword [0x49c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49906c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403fb8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x499030], 0
jne 0x403fad
push 0
push 0x499064
push 0x49906c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4040e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040278c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x49c04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4040ac
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc