joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f6a
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x100d048]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x14]
push 0x7e
mov dword [ebp - 0x40c], eax
pop ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x404], ebx
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
mov dword [ebp - 0x204], ebx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.01009c28
cmp eax, 1
jne 0x100a017
cmp dword [ebp - 0x408], ebx
je 0x100a010
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100a010
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x157e
call fcn.01008098
push eax
call fcn.01007143
mov eax, esi
jmp 0x100a15f
xor eax, eax
jmp 0x100a15f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x204]
push eax
call edi
push esi
call fcn.01009c04
cmp eax, 1
jne 0x100a03f
add esi, 4
push esi
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call fcn.010099bc
test eax, eax
jne 0x100a05a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100a15f
mov esi, 0x10012cc
push esi
lea eax, [ebp - 0x404]
push eax
call edi
cmp dword [ebp - 0x40c], ebx
je 0x100a0a5
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100a0a5
push dword [ebp - 0x40c]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x10016d0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x100a0c1
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x10016a4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 8
pop ecx
xor eax, eax
push ebx
push dword [ebp - 0x408]
lea edi, [ebp - 0x430]
push dword [ebp - 0x410]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x420], ebx
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, ebx
je 0x100a121
cmp edi, 0x4b8
je 0x100a11a
call fcn.010073ca
jmp 0x100a15d
call fcn.01007421
jmp 0x100a15d
push esi
xor edi, edi
call fcn.01007143
lea eax, [ebp - 0x204]
push eax
call fcn.01009d2e
cmp eax, 0x1388
jae 0x100a15d
lea eax, [ebp - 0x204]
push eax
call fcn.01009f4d
push 0x157f
call fcn.01008098
push eax
call fcn.01007143
mov edi, 0x4b8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006b1c
leave
ret 0x10
Function at 0x100a194
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100d048]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
push 0x7e
mov dword [ebp - 0x208], eax
pop ecx
mov dword [ebp - 0x204], edx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x214], edx
stosw word es:[edi], ax
call esi
xor edi, edi
inc edi
cmp dword [ebp + 0x1c], edi
jne 0x100a20f
cmp dword [ebp - 0x208], 0
je 0x100a20f
push 0x10012d4
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100a2e6
and dword [ebp - 0x210], 0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x100a238
push eax
push eax
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], edi
call fcn.0100a173
mov edi, eax
jmp 0x100a266
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x208]
push eax
push ebx
push dword [ebp - 0x20c]
call fcn.0100a173
cmp dword [ebp + 0x1c], 0
mov edi, eax
jne 0x100a266
mov dword [ebp - 0x210], 1
test edi, edi
jne 0x100a283
cmp dword [ebp - 0x210], 1
jne 0x100a3ca
push 0x50010001
call esi
jmp 0x100a3ca
mov eax, 0x4c3
cmp edi, eax
ja 0x100a2c4
je 0x100a3d2
cmp edi, 0x34
je 0x100a2a4
cmp edi, 0x56
je 0x100a2e0
cmp edi, 0x4be
jne 0x100a2b3
push 0x4c6
call esi
call fcn.010073ca
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006b1c
leave
ret 0x18
cmp edi, 0x4cf
jb 0x100a2b3
cmp edi, 0x4d1
jbe 0x100a2a4
cmp edi, 0x52e
jne 0x100a3aa
cmp dword [ebp + 0x1c], 0
je 0x100a2b3
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
test eax, eax
jne 0x100a30a
lea eax, [ebp + 0x10]
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x100a30a
call fcn.010073ca
jmp 0x100a2b3
push ebx
push 0x157d
call fcn.01008098
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
call edi
push eax
lea eax, [ebp - 0x204]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x40
push dword [ebp - 0x208]
call fcn.01007863
push dword [ebp - 0x208]
push ebx
push dword [ebp - 0x20c]
call fcn.0100a173
mov edi, eax
test edi, edi
je 0x100a3ca
cmp edi, 0x34
je 0x100a2a4
cmp edi, 0x4be
je 0x100a2a4
mov eax, 0x4c3
cmp edi, eax
je 0x100a3d2
cmp edi, 0x4ce
jbe 0x100a2b3
cmp edi, 0x4d1
jbe 0x100a2a4
mov eax, 0xa0010001
cmp edi, eax
jne 0x100a2b3
push eax
call esi
push 0x157e
call fcn.01008098
push eax
call fcn.01007143
xor eax, eax
inc eax
jmp 0x100a2b5
push eax
jmp 0x100a27c
Function at 0x404172
Capabilities:
Packed with generic packer

Disassembly:
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 4]
call fcn.00408610
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x404172
or al, 0xc4
lodsd eax, dword [esi]
test eax, 0xaca1a3a5
test al, 0xb4
ljmp 0x4589
Function at 0x406bfa
Capabilities:
Packed with generic packer

Disassembly:
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00408230
nop
nop
nop
lea ecx, [ebp - 4]
call fcn.00408610
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406c51
or dh, byte [ebx - 0x78147919]
xchg byte [edx + 0x58d8d8d0], bl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 8]
call fcn.00408610
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], fcn.00407fa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x40f3b4], 0
jne 0x406d3e
pushal
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [ebp - 0xc]
add esp, 8
mov dword [0x40f3b4], eax
popal
cmp dword [0x40f3b4], 0
je 0x406d59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x40f3b4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406c51
Capabilities:
Packed with generic packer

Disassembly:
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00408230
nop
nop
nop
lea ecx, [ebp - 4]
call fcn.00408610
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406c51
or dh, byte [ebx - 0x78147919]
xchg byte [edx + 0x58d8d8d0], bl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 8]
call fcn.00408610
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], fcn.00407fa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x40f3b4], 0
jne 0x406d3e
pushal
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [ebp - 0xc]
add esp, 8
mov dword [0x40f3b4], eax
popal
cmp dword [0x40f3b4], 0
je 0x406d59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x40f3b4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406d70
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406e15
or edx, ebp
mov dh, 0xb9
mov edx, 0xbaa6b0a6
mov dh, 0xbe
mov al, 0xa1
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 4]
call fcn.00408610
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406eb7
or dh, byte [ebx - 0x78147919]
xchg byte [edx + 0x58d8d8d0], bl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 8]
call fcn.00408610
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], fcn.00407fa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x40f3b8], 0
jne 0x406f55
pushal
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [ebp - 0xc]
add esp, 8
mov dword [0x40f3b8], eax
popal
cmp dword [0x40f3b8], 0
je 0x406f6a
push dword [ebp + 8]
call dword [0x40f3b8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e15
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406e15
or edx, ebp
mov dh, 0xb9
mov edx, 0xbaa6b0a6
mov dh, 0xbe
mov al, 0xa1
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 4]
call fcn.00408610
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406eb7
or dh, byte [ebx - 0x78147919]
xchg byte [edx + 0x58d8d8d0], bl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 8]
call fcn.00408610
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], fcn.00407fa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x40f3b8], 0
jne 0x406f55
pushal
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [ebp - 0xc]
add esp, 8
mov dword [0x40f3b8], eax
popal
cmp dword [0x40f3b8], 0
je 0x406f6a
push dword [ebp + 8]
call dword [0x40f3b8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406eb7
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406e15
or edx, ebp
mov dh, 0xb9
mov edx, 0xbaa6b0a6
mov dh, 0xbe
mov al, 0xa1
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 4]
call fcn.00408610
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], esi
call 0x406eb7
or dh, byte [ebx - 0x78147919]
xchg byte [edx + 0x58d8d8d0], bl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
call fcn.00408230
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 8]
call fcn.00408610
mov dword [ebp - 0x14], eax
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], fcn.00407fa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x40f3b8], 0
jne 0x406f55
pushal
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [ebp - 0xc]
add esp, 8
mov dword [0x40f3b8], eax
popal
cmp dword [0x40f3b8], 0
je 0x406f6a
push dword [ebp + 8]
call dword [0x40f3b8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, ecx
mov al, byte [edi]
mov esi, eax
xor eax, eax
mov al, byte [edi + 1]
mov dword [ebp + 8], esi
lea ecx, [esi + 1]
mov dword [ebp - 4], eax
push ecx
push 0x40
mov ecx, ebx
call fcn.004080a0
mov dword [ebx], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebx]
test eax, eax
je 0x408315
mov ecx, esi
lea esi, [edi + 2]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
xor eax, eax
test edi, edi
jle 0x408315
mov ecx, dword [ebx]
mov dl, byte [ebp - 4]
lea esi, [ecx + eax]
mov cl, byte [ecx + eax]
xor cl, dl
mov byte [esi], cl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, edi
jl 0x4082eb
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40aaa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [ebp + 0xc]
call fcn.00408fc0
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [edi]
mov dword [ebp - 4], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp + 0xc]
call fcn.00408610
mov ebx, eax
mov eax, 0xfffffffc
sub eax, esi
add ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edi, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor ecx, ecx
test ebx, ebx
jle 0x40aca5
mov eax, ecx
cdq
idiv dword [ebp - 4]
mov al, byte [ecx + esi]
mov dl, byte [edx + edi]
xor al, dl
mov byte [ecx + esi], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
cmp ecx, ebx
jl 0x40ac68
lea ecx, [ebp - 0x10]
call fcn.00408870
nop
nop
nop
nop
nop
nop
nop
push ebx
lea ecx, [ebp - 0x10]
call fcn.00409c40
mov ecx, ebx
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.004088d0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404300
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040438f
jae 0x40430e
xor ecx, ecx
call fcn.0040438f
jae 0x40433d
xor eax, eax
call fcn.0040438f
jae 0x40434d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040438f
adc al, al
jae 0x40432f
jne 0x404379
stosb byte es:[edi], al
jmp 0x404311
call fcn.0040439b
sub ecx, ebx
jne 0x404356
call fcn.00404399
jmp 0x404375
lodsb al, byte [esi]
shr eax, 1
je 0x404383
adc ecx, ecx
jmp 0x404372
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00404399
cmp eax, 0x7d00
jae 0x404372
cmp ah, 5
jae 0x404373
cmp eax, 0x7f
ja 0x404374
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x404311
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10004bb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call sub.mfc100.dll_Ordinal_9475
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.mfc100.dll_Ordinal_4340
push 0
push 0
push 0
push 0x10004910
push 0
push 0
mov dword [0x100ae910], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
ret