joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405df4
Capabilities:
Move file

Disassembly:
mov eax, 0x407087
call fcn.004067f0
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
nop
nop
nop
nop
nop
nop
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00401084
pop ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.00401805
pop ecx
pop ecx
mov dword [ebp - 4], 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 1
lea eax, [ebp - 0x1c]
pop edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004035a3
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.004065d8
mov byte [ebp - 4], 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
mov esi, 0x40a50c
push eax
push esi
call fcn.00404dfd
add esp, 0x14
test al, al
je 0x405ea3
mov ecx, dword [ebp + 8]
push esi
call fcn.0040366d
mov dword [ebp - 0x10], edi
jmp 0x405f64
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.004035a3
mov byte [ebp - 4], 4
call section..text
cmp eax, ebx
pop ecx
jne 0x405ed1
mov ecx, dword [ebp + 8]
push esi
call fcn.0040366d
mov dword [ebp - 0x10], edi
jmp 0x405f64
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
call fcn.004035a3
mov byte [ebp - 4], 6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x40a470
push 0x40a46c
lea ecx, [ebp - 0x18]
call fcn.0040387b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x18]
call fcn.004031b5
push eax
lea ecx, [ebp - 0x14]
call fcn.004031b5
push eax
call dword [sym.imp.MSVCRT.dll_rename]
pop ecx
test eax, eax
pop ecx
jne 0x405f49
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.004035a3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
call fcn.0040355b
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040355b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0040355b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x100c26a0
Capabilities:
Encode data using xor

Disassembly:
sub bh, ch
invalid
pop eax
or byte ss:[ecx + edx*8 + 0x4bd8bded], bl
jp 0x100c26ba
in al, dx
pop eax
scasb al, byte es:[edi]
mov byte [ecx - 0x2f], ah
test byte [edi], al
pushfd
aad 0x69
mov es, ebx
mov ecx, 0x4e2b87f6
xchg dword [ebx], ebp
dec esi
push esi
cmc
sti
fldcw word [edx + 9]
cdq
inc ecx
jns 0x100c264e
wait
and byte [ebx + 0x6b21c0d4], bh
test al, bl
push eax
das
lea esi, [ebx]
and eax, 0xbb5a77f6
imul eax, dword [eax + ebx*8 + 0x63c8dedd], 0x1d
outsd dx, dword [esi]
xchg dword [ebx + 0x5b8cb358], ebp
invalid
Function at 0x40175e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 1
pop esi
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftClipArt_Gallery
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4017bc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.UserAdded
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4017b3
cmp dword [ebp - 0x10], 4
je 0x4017b3
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x4027a8
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
lea eax, [ebp - 0x108]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x10
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], bl
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x402836
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x40281e
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
lea eax, [ebp - 0x108]
push ebx
push eax
push 5
call fcn.00401680
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
push dword [esi]
lea ecx, [esi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
cmp eax, dword [esi]
je 0x402898
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x40286e
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
lea eax, [ebp - 0x108]
push ebx
push eax
push 5
call fcn.00401680
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402830
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402830
Function at 0x403242
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 3
pop ecx
jb 0x40327f
cmp word [ebx], 0x5c
je 0x403270
cmp word [ebx + 2], 0x3a
jne 0x40327f
cmp word [ebx + 4], 0x5c
jne 0x40327f
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
pop ebx
leave
ret
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strlen
mov edi, dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x104]
push esi
push eax
push edi
call dword [sym.imp.MSVCRT.dll_mbstowcs]
and word [edi + esi*2], 0
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
push 0x40560c
push edi
call esi
push ebx
push edi
call esi
add esp, 0x20
pop edi
pop esi
jmp 0x40327c
Function at 0x4032d1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
and dword [ebp - 4], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push 0
push eax
call dword [sym.imp.mcps.dll_void___stdcall_CagGetAppDataDirectory_char___int_]
push dword [0x40504c]
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCRT.dll__mkdir]
mov esi, dword [ebp + 0x10]
mov edi, dword [sym.imp.MSVCRT.dll_wcsrchr]
push 0x5c
push esi
call edi
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4033d8
inc ebx
inc ebx
mov dword [ebp + 0x10], ebx
push 0x3a
push ebx
call dword [sym.imp.MSVCRT.dll_wcschr]
pop ecx
test eax, eax
pop ecx
je 0x403353
lea eax, [ebp + 0x10]
push 0x403bd8
push eax
mov dword [ebp + 0x10], 4
call sub.MSVCRT.dll__CxxThrowException
cmp word [ebx], 0
mov esi, ebx
je 0x403372
mov ax, word [esi]
push eax
call dword [sym.imp.MSVCRT.dll_iswalpha]
test eax, eax
pop ecx
je 0x403372
inc esi
inc esi
cmp word [esi], 0
jne 0x40335b
mov ax, word [esi]
and dword [ebp - 8], 0
test ax, ax
je 0x4033a8
lea ebx, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll_iswxdigit]
test eax, eax
pop ecx
je 0x4033a5
mov ax, word [esi]
inc esi
inc esi
inc dword [ebp - 8]
mov word [ebx], ax
inc ebx
mov ax, word [esi]
inc ebx
test ax, ax
jne 0x403384
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
and word [ebp + eax*2 - 0x418], 0
cmp eax, 2
jae 0x4033e2
mov cx, word [ebx]
mov eax, ebx
test cx, cx
je 0x4033fb
mov edx, dword [ebp - 4]
imul edx, edx, 0x21
movzx ecx, cx
add edx, ecx
inc eax
inc eax
mov dword [ebp - 4], edx
mov cx, word [eax]
jmp 0x4033be
mov dword [ebp + 0x10], esi
mov ebx, esi
jmp 0x40332f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x418]
push 0x405624
push eax
call dword [sym.imp.MSVCRT.dll_swscanf]
add esp, 0xc
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 0x9c4
div ecx
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push str._scl_x_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.MSVCRT.dll__mkdir]
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strlen
add esi, eax
add esp, 0x1c
cmp esi, dword [ebp + 0xc]
jb 0x403462
lea eax, [ebp + 0x10]
push 0x403bd8
push eax
mov dword [ebp + 0x10], 3
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strlen
mov esi, dword [ebp + 8]
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.MSVCRT.dll_mbstowcs]
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
push 0x5c
push esi
call edi
push 0x2e
push esi
mov ebx, eax
call edi
add esp, 0x28
mov edi, eax
test ebx, ebx
je 0x4034c7
test edi, edi
je 0x4034c7
cmp edi, ebx
jbe 0x4034c7
inc edi
mov esi, 0x405060
inc edi
push dword [esi]
push edi
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x4034cc
add esi, 4
cmp esi, 0x405094
jl 0x4034ad
pop edi
pop esi
pop ebx
leave
ret
push 8
push 0x405610
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x4034c7
Function at 0x4010a0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x68
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401117
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push eax
push str.ScreenSaveUtility
push edx
mov dword [esp + 0x28], eax
call esi
test eax, eax
jne 0x401117
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x40
call ebp
mov edi, eax
test edi, edi
je 0x401117
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push 0
push str.ScreenSaveUtility
push edx
call esi
test eax, eax
je 0x401120
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68
ret
mov ecx, 0x10
lea eax, [esp + 0x18]
lea esp, [esp]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x401130
mov ecx, 0x44
lea eax, [esp + 0x28]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x401144
push edi
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x58], 0x81
mov word [esp + 0x5c], cx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
add eax, eax
push eax
push 0x40
call ebp
push edi
mov esi, eax
push str.__s___c
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x68
ret

Function at 0x4011c0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push 0x402060
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401208
push ebx
push edi
push ebp
lea edi, [esp + 0x10]
mov ebx, str.ScreenSaveBackup
jmp loc.00404000
push esi
push 0x2080
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40123f
push esi
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40123f
push str.scrnsave.scr
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x401245
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov dword [ebp], esi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x10012560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100125b9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100125b9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100125a8
cmp esi, edx
jae 0x100125b9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10012596
cmp esi, edx
jae 0x100125b9
cmp word [esi], 0
je 0x100125b9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x100188f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0x17622
Function at 0x10021810
Capabilities:
Encode data using xor

Disassembly:
sahf
push edi
or byte [eax], cl
mov ebx, ebp
pop ss
push esi
or byte [eax], cl
arpl word [esi + 0x5a], bx
mov ecx, esp
or al, 0x89
salc
outsd dx, dword [esi]
or byte [eax], cl
or byte [ecx + 0x934f6ce], cl
or byte [esi + 0x6c], ah
test eax, 0x8080820
xchg ecx, eax
invalid

Function at 0x10038c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bb0cc
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x100f51d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x214], ecx
push 0x8c
call fcn.10071942
mov ebx, eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], 0
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x21c], ecx
xor eax, eax
mov dword [ecx], 0
add ecx, 4
mov dword [ebp - 0x220], ecx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov byte [ecx + 0x18], al
mov byte [ebp - 4], 3
lea esi, [ebx + 8]
mov dword [ebx + 0x2c], eax
mov dword [ebx], vtable.CMID.2.0
mov dword [ebx + 4], vtable.CMID.1.0
mov dword [esi], vtable.CMID.0
mov word [ebx + 0x30], ax
mov dword [ebp - 4], 0xffffffff
push 0x100
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.10097030
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x80
push eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov edi, 0x80
test eax, eax
js 0x10038d03
push SysReAllocString
lea eax, [ebp - 0x210]
mov edx, edi
push eax
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0xb40
call fcn.10021880
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.10097030
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
add esp, 0xc
cmp eax, vtable.CMID.1.0
jne 0x10038de9
mov edx, edi
lea ecx, [ebp - 0x110]
call fcn.10050960
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, 0x80004005
mov edx, dword [ebx]
mov ecx, ebx
push 1
call dword [edx + 0x2c]
test esi, esi
js 0x10038d7d
push SysReAllocString
lea eax, [ebp - 0x110]
mov edx, edi
push eax
push ecx
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx + 0xa40]
call fcn.10021880
mov eax, 1
jmp 0x10038dcd
mov esi, dword [ebp - 0x214]
push ecx
add esi, 0xa40
push esi
call fcn.1003a570
test eax, eax
je 0x10038dcb
mov edx, edi
mov eax, esi
cmp word [eax], 0
je 0x10038dab
add eax, 2
sub edx, 1
jne 0x10038d98
lea eax, [edx + 1]
jmp 0x10038dcd
test edx, edx
je 0x10038dc4
push SysReAllocString
sub edi, edx
push str._error_from_GetMID
push ecx
lea ecx, [esi + edi*2]
call fcn.1003aa60
mov eax, 1
jmp 0x10038dcd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
push 0x80
lea edx, [ebp - 0x110]
push edx
push ecx
call dword [eax + 0xc]
mov esi, eax
jmp 0x10038d49
Function at 0x10038f20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x100f51d4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x20], 0xffffffff
jne 0x100390a4
push edi
call fcn.1009cd43
add esp, 4
mov esi, eax
lea eax, [ebx + 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10038f81
mov dword [ebx + 0x1c], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.10071699
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x14], eax
jmp 0x10038f90
push str..log2
push eax
push esi
push str.New360_tmp_
lea eax, [ebx + 0x428]
inc edi
push eax
push str._s_s_d__d_s
lea eax, [esp + 0x30]
push 0x104
push eax
call fcn.10021620
add esp, 0x20
lea eax, [esp + 0x18]
push eax
call fcn.1003a4d0
test eax, eax
je 0x10038fea
mov eax, dword [esp + 0x14]
inc esi
cmp edi, 0x64
jl 0x10038f90
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.10071699
mov esp, ebp
pop ebp
ret
lea edi, [ebx + 0x838]
mov edx, 0x104
lea esi, [esp + 0x18]
mov ecx, edi
sub esi, edi
lea ecx, [ecx]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10039020
movzx eax, word [esi + ecx]
test ax, ax
je 0x10039020
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10039000
jmp 0x10039024
test edx, edx
jne 0x10039027
sub ecx, 2
xor eax, eax
lea esi, [ebx + 0x20]
mov word [ecx], ax
test esi, esi
je 0x10038f6a
push esi
mov ecx, edi
call fcn.10039db0
test eax, eax
je 0x10038f6a
push 0
mov dword [ebx + 0xc48], 0
call fcn.1009cd43
add esp, 4
mov dword [ebx + 0xc4c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push 0
push eax
push 0xc8
lea eax, [ebx + 0xcb0]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10038f6a
cmp dword [esp + 0x10], 0xc8
jne 0x10038f6a
add dword [ebx + 0xc48], 0xc8
mov ecx, dword [esp + 0x224]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10071699
mov esp, ebp
pop ebp
ret
Function at 0x458ae0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3c000]
push edi
jmp 0x458afa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x458b01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458af0
mov eax, 1
add ebx, ebx
jne 0x458b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x458b24
jne 0x458b43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458b43
dec eax
add ebx, ebx
jne 0x458b30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x458b08
add ebx, ebx
jne 0x458b3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x458b95
xor ecx, ecx
sub eax, 3
jb 0x458b5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x458bca
sar eax, 1
mov ebp, eax
jmp 0x458b66
add ebx, ebx
jne 0x458b66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458b34
inc ecx
add ebx, ebx
jne 0x458b74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458b34
add ebx, ebx
jne 0x458b81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x458b76
jne 0x458b92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x458b76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x458bb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x458ba6
jmp 0x458af6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x458bb4
add edi, ecx
jmp 0x458af6
pop esi
mov edi, esi
mov ecx, 0x604
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x458bd2
cmp byte [edi], 0xe
jne 0x458bd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x458bd7
lea edi, [esi + 0x55000]
mov eax, dword [edi]
or eax, eax
je 0x458c46
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5aca4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ad2c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x458c04
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ad34]
or eax, eax
je 0x458c40
mov dword [ebx], eax
add ebx, 4
jmp 0x458c21
call dword [esi + 0x5ad30]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x458c77
cmp al, 0xef
ja 0x458c6a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x458c4c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x458c59
mov ebp, dword [esi + 0x5ad38]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x458cab
sub esp, 0xffffff80
jmp 0x41b088
Function at 0x408ca0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x40c
mov eax, dword [0x82207c]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x82ee94]
push ebx
mov ebx, dword [0x82ebbc]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x408cec
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov eax, dword [0x82ee94]
push esi
mov esi, dword [0x822e60]
cmp eax, 0x930
jne 0x408d07
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x82ee94]
mov dword [0x82ebb8], esi
pop esi
cmp eax, 0x114e
jne 0x408d2e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x82ee94]
cmp eax, 0x2f
jne 0x408d4d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push edi
push ebx
call fcn.00408b90
mov ecx, dword [esp + 0x418]
add esp, 8
pop edi
pop ebx
xor ecx, esp
call fcn.0040160d
add esp, 0x40c
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403e59
pop dword [ebp - 0x10]
mov eax, 0xa3ffadc5
add eax, 0x5c409094
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1c71a006
add dword [ebp - 0x20], 0x31e0a545
mov dword [ebp - 0x1c], 0xf38b26e8
add dword [ebp - 0x1c], 0x3ea8255d
mov dword [ebp - 0x18], 0x256eb865
add dword [ebp - 0x18], 0x26dd8bc9
mov dword [ebp - 0x14], 0xcb7f2071
add dword [ebp - 0x14], 0x3480df8f
lea eax, [ebp - 0x20]
push eax
mov eax, 0x5a7bb50d
add eax, 0xa5c4bb57
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x65758c0b
add dword [ebp - 0x20], 0xefcdd4b
mov dword [ebp - 0x1c], 0x8f425ff7
add dword [ebp - 0x1c], 0xb22a017e
mov dword [ebp - 0x18], 0x45b84f18
add dword [ebp - 0x18], 0x1db71d54
mov dword [ebp - 0x14], 0x7a383740
add dword [ebp - 0x14], 0x85c7c8c0
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xa2254c83
sub eax, 0xa1e4dbdb
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x34191
push 0
call eax
mov ecx, 0x3d67
xor edi, edi
add edi, eax
mov ebx, 0x3bf5c30e
sub ebx, 0x3bb4c30e
add ebx, dword [ebp - 0x10]
mov edx, 0x7a7edf8e
add edx, 0x7d72802f
add dword [ebp - 8], ebx
mov esi, dword [ebx]
xor dword [ebp - 0xc], esi
xor esi, edx
xor dword [ebp - 4], ebx
mov dword [edi], esi
sub dword [ebp - 0xc], 0xe1fa24ab
add edi, 0xe0775d84
add edi, 0x1f88a280
add ebx, 0x28b34ced
sub ebx, 0x28b34ce9
loop 0x403f77
add eax, 0x75c4a862
sub eax, 0x75c3bff3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3cf10b84
add ecx, 0xc34ef47c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401679
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x881dac]
sub esp, 0x800
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x881d04]
test esi, esi
je 0x4016c7
cmp eax, 0x959
jne 0x4016b3
push 0
lea eax, [ebp - 0x800]
push eax
push str.Subasosu_nigukole_padisekadapoyi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, edi
call fcn.00401475
add edi, 8
dec esi
je 0x4016c7
mov eax, dword [0x881dac]
jmp 0x401698
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4