joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c682
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x57c6ba
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x57c6a8
mov al, 1
jmp 0x57c704
cmp dword [ebx + 0x54], ecx
jne 0x57c6b1
mov al, 2
jmp 0x57c704
cmp dword [ebx + 0x7c], ecx
jne 0x57c704
mov al, 3
jmp 0x57c704
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x57c6cf
mov al, 4
jmp 0x57c704
cmp ecx, 5
jne 0x57c6ef
cmp ebx, 0
jne 0x57c6dd
mov al, 5
jmp 0x57c704
cmp ebx, 1
jne 0x57c6e6
mov al, 6
jmp 0x57c704
cmp ebx, 2
jne 0x57c6ef
mov al, 7
jmp 0x57c704
cmp ecx, 6
jne 0x57c6fb
cmp ebx, 0
jne 0x57c6fd
mov al, 8
jmp 0x57c704
cmp ebx, 1
jne 0x57c704
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57d221
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0057d3d1
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x57d31f
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x57d2c2
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x57d305
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x57d2d9
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x57d2f4
test al, 0x40
je 0x57d2eb
mov ecx, dword [edi + 0x20]
jmp 0x57d2f2
test al, 0x80
je 0x57d305
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x57d305
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x57d291
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x5808483e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x62d874e4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x402160
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x426ec5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x4324f4]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x118], 1
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push 0x4320c0
push eax
call fcn.0041acd5
mov esi, dword [esp + 0x12c]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0041cd8f
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x118], 0
call fcn.0041d01a
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret 4

Function at 0x4023e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x426f35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
mov eax, dword [0x4324f4]
push ebx
xor ebx, ebx
push esi
push edi
mov edx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x34]
mov dword [esp + 0x140], 1
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x1c]
lea eax, [esp + 0x14]
lea edx, [esp + 0x34]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0x4322dc
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
cmp eax, ebx
je 0x402488
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x402488
lea edx, [esp + 0x34]
lea eax, [esp + 0xc]
push edx
push 0x4320c0
push eax
call fcn.0041acd5
add esp, 0xc
mov esi, dword [esp + 0x148]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0041cd8f
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x140], bl
call fcn.0041d01a
mov ecx, dword [esp + 0x138]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret 4

Function at 0x40aa99
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40aab9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d044
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40aadc
test byte [esp + 8], 2
je 0x40aadc
call fcn.0040d0b7
mov dword [eax], 0xd
call fcn.0040d0c0
mov dword [eax], 5
jmp 0x40aab5
xor eax, eax
ret
Function at 0x4164e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x120
push ebp
mov ebp, dword [esp + 0x128]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 1
test ecx, ecx
mov dword [esp + 0x1c], ecx
mov byte [esp + 0xb], al
mov dword [esp + 0xc], 0
jle 0x4165e1
lea edx, [esp + 0x25]
push ebx
sub edx, ebp
sub eax, ebp
push esi
mov ebx, ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
jmp 0x416536
mov edx, dword [esp + 0x1c]
mov al, byte [ebx]
cmp al, 0x2f
je 0x416544
cmp al, 0x5c
jne 0x4165cf
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x138]
cmp eax, ecx
jge 0x41655a
inc eax
mov dword [esp + 0x14], eax
jmp 0x4165cf
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x28], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x30]
mov byte [edx + ebx], 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [esp + 0x20]
lea eax, [edx + ebx]
mov edx, dword [esp + 0x24]
cmp eax, edx
jge 0x4165b5
mov cl, byte [eax + ebp]
cmp cl, 0x2f
je 0x4165ea
cmp cl, 0x5c
je 0x4165ea
inc eax
cmp eax, edx
jl 0x4165a3
mov al, byte [esp + 0x13]
test al, al
jne 0x4165cf
mov eax, dword [esp + 0x138]
inc eax
push eax
push ebp
call fcn.004164e0
add esp, 8
mov eax, dword [esp + 0x18]
inc ebx
dec eax
mov dword [esp + 0x18], eax
jne 0x416532
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x120
ret
mov byte [esp + 0x13], 0
jmp 0x4165bd
Function at 0x416da0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xb04
push ebx
push esi
push edi
mov edi, dword [esp + 0xb14]
test edi, edi
jne 0x416dc0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xb04
ret
push 0
call fcn.0040ce08
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
call fcn.0040cee4
mov esi, eax
add esp, 8
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0x11c]
push str.._fronlineLog_04d_02d_02d.txt
push ecx
call fcn.0040a873
lea edx, [esp + 0x124]
push 0x436284
push edx
call fcn.0040a860
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jne 0x416e41
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push 0x436270
push ecx
call fcn.0040a873
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xb04
ret
mov eax, dword [esp + 0xb18]
push edi
test eax, eax
je 0x416e6f
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
push eax
push ecx
push edx
lea eax, [esp + 0x320]
push str._02d_02d_02d:_s_n
push eax
call fcn.0040a873
add esp, 0x18
jmp 0x416e84
lea ecx, [esp + 0x314]
push 0x436258
push ecx
call fcn.0040a873
add esp, 0xc
lea edi, [esp + 0x310]
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
lea edx, [esp + 0x318]
push ecx
push edx
call fcn.0040a8c5
push ebx
call fcn.0040a5e2
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xb04
ret
Function at 0x419fc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040c2a0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41a08b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41a08b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41a03e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41a049
or bh, 8
and edi, 0x8000000
je 0x41a064
mov eax, dword [0x43a0dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41a08b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41a48b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41a4af
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41a4ca
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41f7df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41f821
call fcn.00423da0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41f821
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41f818
xor eax, eax
jmp 0x41f829
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041f82f
pop edi
pop esi
pop ebx
ret 4

Function at 0x43e8f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
jmp 0x43e90a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43e911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43e900
mov eax, 1
add ebx, ebx
jne 0x43e923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43e918
jne 0x43e934
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e918
xor ecx, ecx
sub eax, 3
jb 0x43e948
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43e9ba
mov ebp, eax
add ebx, ebx
jne 0x43e953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43e960
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43e984
inc ecx
add ebx, ebx
jne 0x43e970
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43e965
jne 0x43e981
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e965
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43e9a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43e995
jmp 0x43e906
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43e9a4
add edi, ecx
jmp 0x43e906
pop esi
mov edi, esi
mov ecx, 0xb36
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43e9c2
cmp byte [edi], 0x11
jne 0x43e9c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43e9c7
lea edi, [esi + 0x3b000]
mov eax, dword [edi]
or eax, eax
je 0x43ea3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x421e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x42300]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43e9f4
mov ecx, edi
jns 0x43ea23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x42304]
or eax, eax
je 0x43ea39
mov dword [ebx], eax
add ebx, 4
jmp 0x43ea11
call dword [esi + 0x42314]
mov ebp, dword [esi + 0x42308]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43ea73
sub esp, 0xffffff80
jmp 0x40f5e8
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x34265157
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x23d568b2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10006c6e
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x10006c90
mov eax, 0xfffffffd
jmp 0x10006d08
mov ebx, dword [0x100e377c]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10006cd6
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x100e377c]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10006cfe
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10006d08
mov esp, ebp
pop ebp
ret 4
Function at 0x1002cfea
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret

Function at 0x10030740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a6790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1009b7fe
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10032140
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10030794
jmp dword [ecx*4 + 0x100308fc]
mov al, byte [esi]
test al, al
je 0x100307c2
cmp al, 0x20
je 0x100307ae
cmp al, 0xa1
jne 0x100307c2
cmp byte [esi + 1], al
jne 0x100307c2
test al, 0x80
je 0x100307ba
mov al, byte [esi + 1]
inc esi
test al, al
je 0x100307c2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x100307a1
test ecx, ecx
je case.default.0x10030794
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10030794
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10030808
cmp dl, 0xa1
jne 0x100307fc
cmp byte [eax + 1], 0xa1
jne 0x100307fc
test ecx, ecx
jne 0x100307f4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1003081c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10030836
jmp 0x1003081c
cmp dl, 0x20
jne 0x1003081a
test ecx, ecx
jne 0x10030813
mov edi, eax
mov ecx, 1
jmp 0x1003081c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x100307dc
cmp ecx, 1
jne case.default.0x10030794
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10030794
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10030794
mov al, byte [esi]
test al, al
je 0x1003088e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10030874
mov cl, byte [esi + 1]
test cl, cl
je 0x1003088e
cmp al, 0xa1
jne 0x10030864
cmp cl, al
je 0x10030871
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10032410
inc esi
jmp 0x10030886
cmp al, 0x20
je 0x10030886
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10032450
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1003084d
push 0
lea ecx, [esp + 0x14]
call fcn.10032450
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100442a0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x100308c1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x100bc2d0
call fcn.10032340
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1009b790
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x100318d0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, 0x100cf258
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
push ecx
call fcn.10031890
add esp, 8
mov byte [esp + 8], al
or esi, 0xffffffff
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003197a
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
push ecx
call eax
test eax, eax
je 0x100319db
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x1003195c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x10031964
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, 0xa
call fcn.1008bf70
mov edx, dword [esp + 0x28]
pop edi
pop esi
mov dword [edx], eax
add esp, 0x1c
ret
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x100319cf
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x30]
je 0x100319ad
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push 0x400
imul edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], eax
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
pop edi
mov dword [edx], esi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
add esp, 0x1c
ret