joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
xor ecx, ecx
sub esp, 0x18
test eax, eax
je 0x40155a
cmp word [ebx], 0
mov edx, eax
je 0x401630
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x401540
sub eax, ebx
sar eax, 1
lea ecx, [edx - 1]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
cmp dword [ebp - 0x1c], eax
jbe 0x401568
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx + edx]
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x18
call dword [sym.imp.kernel32.dll_GetThreadLocale]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CompareStringW]
mov ecx, dword [ebp - 0x24]
sub esp, 0x18
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor ecx, ecx
sub esp, 0xc
cmp ebx, 2
sete cl
lea esp, [ebp - 0xc]
pop ebx
mov eax, ecx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40154d
Function at 0x4016d0
Capabilities:
Create service
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x260
mov dword [esp + 8], 2
mov dword [esp + 4], str.ServicesActive
mov dword [esp], 0
call sym._OpenSCManagerW_12
sub esp, 0xc
test eax, eax
je 0x401808
lea esi, [ebp - 0x228]
mov dword [esp + 4], 0x104
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edx, 0x5c
lea ecx, [esi + eax*2]
sub esp, 8
xor eax, eax
jmp 0x401737
movzx edx, word [eax + str.msiexec__V]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x401730
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], 0x10000000
mov dword [esp + 8], 0x407066
mov dword [esp + 4], 0x407066
mov dword [esp], ebx
call sym._CreateServiceW_52
sub esp, 0x34
test eax, eax
je 0x4017d0
mov dword [esp], eax
xor esi, esi
call sym._CloseServiceHandle_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseServiceHandle_4
mov eax, esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor esi, esi
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x431
je 0x4017bb
mov dword [esp], 2
mov esi, 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_create_MSI_service_n
mov dword [esp], eax
call sym._fprintf
jmp 0x4017bb
mov dword [esp], 2
mov esi, 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_open_the_service_control_manager._n
mov dword [esp], eax
call sym._fprintf
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret

Function at 0x401840
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov ecx, edx
movzx edx, word [eax]
and edx, 0xfffffffd
cmp dx, 0x2d
je 0x401858
xor eax, eax
ret
add eax, 2
mov edx, ecx
jmp sym._msi_strequal
Function at 0x401d80
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x10
cmp word [edx], 0
je 0x401e10
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401d98
sub eax, esi
add eax, 6
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x401e17
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ecx + eax + 4], dx
add eax, 2
test dx, dx
jne 0x401dd8
mov dword [ecx], 0
mov eax, dword [ebx]
test eax, eax
je 0x401e00
lea esi, [esi]
mov ebx, eax
mov eax, dword [eax]
test eax, eax
jne 0x401df8
mov dword [ebx], ecx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, 6
jmp 0x401da6
test byte [section..data], 2
jne 0x401e2d
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.StringListAppend
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401e20

Function at 0x401f30
Capabilities:
Access peb ldr_data
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esi], eax
sub esp, 0xc
test eax, eax
je 0x401f7d
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x401fb4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unable_to_load_dll__s_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], 2
mov ebx, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Dll__s_does_not_implement_function__s_n
mov dword [esp], eax
call sym._fprintf
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push eax
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x402070
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
cmp word [eax], 0
je 0x402170
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402088
sub eax, esi
add eax, 0xa
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x4021ac
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x4020d0
movzx edx, word [ebx]
test dx, dx
je 0x402180
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x4020f0
sub eax, ebx
sar eax, 1
jne 0x402111
jmp 0x402168
cmp cx, 0x5c
je 0x40211e
dec eax
je 0x402168
movzx ecx, word [ebx + eax*2]
lea esi, [ecx - 0x2e]
cmp si, 1
ja 0x402108
cmp cx, 0x2e
je 0x402184
mov edx, ebx
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x402130
xor eax, eax
mov ecx, 0x2e
jmp 0x40214f
movzx ecx, word [eax + str..msi]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402148
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov ecx, edx
jmp 0x40211e
mov eax, 0xa
jmp 0x402096
mov edx, ebx
jmp 0x402139
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x40215b
test byte [section..data], 2
je 0x40215b
mov dword [esp + 0xc], str.No_memory._n
mov dword [esp + 8], str.get_path_with_extension
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x40215b
Function at 0x404c10
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
mov dword [esp + 4], sym._ServiceCtrlHandler_4
mov dword [esp], str.MSIServer
call sym._RegisterServiceCtrlHandlerA_8
mov dword [0x40900c], eax
sub esp, 8
test eax, eax
je 0x404da0
mov eax, 2
call sym._UpdateSCMStatus.constprop.0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x409004], eax
sub esp, 0x10
test eax, eax
je 0x404d50
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._ServiceExecutionThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x409008], eax
sub esp, 0x18
test eax, eax
je 0x404d00
mov eax, 4
call sym._UpdateSCMStatus.constprop.0
mov eax, dword [0x409008]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, 1
sub esp, 8
call sym._UpdateSCMStatus.constprop.0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_create_thread_n
mov dword [esp], eax
call sym._fprintf_1
test byte [0x406010], 8
jne 0x404d76
mov eax, dword [0x409004]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, 1
sub esp, 4
call sym._UpdateSCMStatus.constprop.0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_create_event_n
mov dword [esp], eax
call sym._fprintf_1
test byte [0x406010], 8
je 0x404d26
mov dword [esp + 0xc], str.Killing_service_n
mov dword [esp + 8], str.KillService
mov dword [esp + 4], 0x406010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x404d26
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 4], str.Failed_to_register_service_ctrl_handler_n
mov dword [esp], eax
call sym._fprintf_1
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret 8

Function at 0x404f50
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x405060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4050bb
cmp byte [esi + ebx - 1], 0xa
je 0x40508f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4090a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x405610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x4090b4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x4057d0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4090b4]
movzx eax, al
bt eax, esi
jae 0x405830
mov ecx, dword [0x4090a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x4056d6
test byte [0x406028], 8
jne 0x405770
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x406038], 8
jne 0x405720
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4056a5
cmp esi, 3
jbe 0x4056e0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x407ad4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x4056a5
mov ecx, dword [0x4090b4]
test ecx, ecx
je 0x405810
mov dword [esp], 0x406038
call dword [0x4090b4]
test al, 8
je 0x40567c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x40567c
mov ebx, dword [0x4090b4]
test ebx, ebx
je 0x4057f0
mov dword [esp], 0x406028
call dword [0x4090b4]
test al, 8
je 0x405669
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
shr edx, 6
imul ebx, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, ebx
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x40566f
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4090b4
call sym._load_func.part.0
jmp 0x405630
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4090b4
call sym._load_func.part.0
jmp 0x40577a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4090b4
call sym._load_func.part.0
jmp 0x40572e
mov eax, 0xffffffff
jmp 0x4056d6
Function at 0x405990
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x405a1d
cmp al, 9
je 0x405a10
cmp al, 0x20
je 0x405a10
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x405a78
cmp al, 0x22
je 0x405a80
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x405a1d
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4059d0
test edi, 1
jne 0x4059d0
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x405a10
cmp al, 0x20
je 0x405a10
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x405a38
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x4059e7
and dword [ebp - 0x6c], 1
jne 0x4059e0
xor edi, 1
jmp 0x4059e7
Function at 0x700eed6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x700eee5
pop dword [ebp - 0x3c]
mov eax, 0xce081a5
sub eax, 0x5df92c0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x6c8fbaa8
sub dword [ebp - 0x4c], 0x1e3d755d
mov dword [ebp - 0x48], 0x6f4f7423
add dword [ebp - 0x48], 0xc2e3d822
mov dword [ebp - 0x44], 0xc3eb13f2
add dword [ebp - 0x44], 0x8861303c
mov dword [ebp - 0x40], 0x9c503597
sub dword [ebp - 0x40], 0x9c503597
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xc7491635
sub eax, 0xc047e605
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa085e979
add dword [ebp - 0x4c], 0xd3ec7fdd
mov dword [ebp - 0x48], 0x8e576723
add dword [ebp - 0x48], 0xb314fa52
mov dword [ebp - 0x44], 0xdfb68a53
sub dword [ebp - 0x44], 0x7c471de7
mov dword [ebp - 0x40], 0x8a23b8b6
add dword [ebp - 0x40], 0x75dc474a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e90e
push 0
call eax
mov ecx, 0x5810
xor edx, edx
add edx, eax
mov edi, 0x3e2bfb80
sub edi, 0x3729f980
add edi, dword [ebp - 0x3c]
mov esi, 0xc11c88be
add esi, 0xe25a939f
mov dword [ebp - 0xc], 0xc339aa4b
mov ebx, dword [edi]
add dword [ebp - 0x14], ebx
sub ebx, esi
add dword [ebp - 4], ecx
mov dword [edx], ebx
xor dword [ebp - 8], edi
add edx, 0x9b8a6595
add edx, 0x64759a6f
add edi, 0xca20ecee
add edi, 0x35df1316
loop 0x700effe
add eax, 0xb838293c
sub eax, 0xb836d629
mov ebx, eax
add eax, 0xbfc38624
sub eax, 0xbfc3861f
mov ecx, 0x7000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x402634
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
call esi
cmp eax, 0xffffffff
je 0x402655
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
pop esi
jne 0x402682
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402682
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x402682
push 4
push eax
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x402689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
and dword [ebp - 4], 0
imul edx, edx, 0x9e3779b9
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
je 0x4026fe
mov esi, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, ecx
sub dword [ebp - 4], 0x61c88647
add ebx, eax
lea eax, [ebx + edi]
mov edi, eax
mov ebx, eax
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, eax
add ebx, ecx
cmp dword [ebp - 4], edx
lea ecx, [ebx + edi]
jne 0x4026ac
mov esi, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
leave
ret

Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6cca524c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x13af2143
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4012dc
Capabilities:
Create process on windows
Terminate process

Disassembly:
and al, 0x1c
call fcn.00402eba
add esp, 8
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0040b80d
mov ecx, esi
call fcn.00401700
cmp eax, 1
jne 0x401324
push ebx
mov ecx, esi
call fcn.00401f20
mov ecx, dword [esi + 0x1c]
push ecx
mov ecx, esi
call fcn.00401650
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x624
ret
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
push ebx
push edx
rep stosd dword es:[edi], eax
call fcn.00402e95
lea eax, [esp + 0x20]
xor ebx, ebx
push eax
call fcn.00402e4e
add esp, 0xc
sub eax, 5
js 0x401366
lea ecx, [esp + eax*2 + 0x18]
cmp word [ecx], 0x20
jne 0x401364
dec eax
sub ecx, 2
test eax, eax
jge 0x401354
jmp 0x401366
mov ebx, eax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x220]
inc ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ebx
lea edx, [esp + 0x224]
push ecx
push edx
call fcn.00402eba
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x434]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x22c]
lea ecx, [esp + 0x434]
push eax
push ecx
call fcn.00402e95
add esp, 0x14
lea edx, [esp + 0x428]
push 5
push 0
push edx
push str.explorer
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00401bc0
mov ecx, esi
call fcn.00401dd0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4014e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x414
cmp word [esp + 0x418], 0x100
push esi
mov esi, ecx
jne 0x401594
mov eax, dword [0x4180fc]
push edi
mov dword [esp + 0xc], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x424]
lea ecx, [esp + 0xc]
push edi
push ecx
call fcn.00402e95
add esp, 8
lea edx, [esp + 8]
push 0
push 0
push 0
push 0
push edx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x214]
lea edx, [esp + 0x214]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str.U_SerialNumber:__X__X
push edx
call fcn.00402ef7
add esp, 0x10
lea eax, [esp + 0x214]
mov ecx, esi
push eax
call fcn.00401a90
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00401770
pop edi
mov eax, 1
pop esi
add esp, 0x414
ret 8
mov eax, 1
pop esi
add esp, 0x414
ret 8