joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a150
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x1005a177
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x1005a166
pop edi
movzx eax, dl
pop esi
ret

Function at 0x1005a2e0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.10071fa0
mov eax, dword [0x100f51d4]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x1005a376
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1005a376
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.100124a0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.1009ca77
add esp, 0x1c
test eax, eax
jns 0x1005a34c
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10071699
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.100124a0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.1009ca77
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.1005a1a0
test eax, eax
jle 0x1005a40a
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x1005a41e
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10071699
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.10071699
add esp, 0x108
ret
Function at 0x10066150
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.10071fa0
mov edx, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp esi, 0x10
jb 0x100661cc
mov eax, esi
shr eax, 4
mov dword [esp + 0x10], eax
lea esp, [esp]
mov eax, edi
sub edx, ebp
sub eax, ebp
mov ecx, ebp
mov dword [esp + 0x14], eax
mov ebx, 4
mov esi, eax
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [esi + ecx - 4], eax
sub ebx, 1
jne 0x10066193
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov edx, edi
sub esi, 0x10
add esp, 0xc
add ebp, 0x10
mov dword [esp + 0x30], esi
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x10066180
test esi, esi
je 0x100662c7
mov ebx, edi
mov ecx, edx
sub ebx, ebp
sub ecx, ebp
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 1
mov dword [esp + 0x20], ecx
sub ebx, ebp
mov dword [esp + 0x10], ebx
mov ebx, 2
sub ebx, ebp
mov dword [esp + 0x18], ebx
mov ebx, 3
sub ebx, ebp
mov dword [esp + 0x1c], ebx
cmp eax, esi
jae 0x10066279
mov esi, dword [esp + 0x14]
lea ebx, [eax + ebp]
mov cl, byte [ecx + ebx]
xor cl, byte [ebx]
mov byte [esi + ebx], cl
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
add ecx, ebx
cmp ecx, esi
jae 0x10066278
mov cl, byte [eax + ebp + 1]
xor cl, byte [eax + edx + 1]
mov byte [edi + eax + 1], cl
mov ecx, dword [esp + 0x18]
add ecx, ebx
cmp ecx, esi
jae 0x10066273
mov cl, byte [eax + ebp + 2]
xor cl, byte [eax + edx + 2]
mov byte [edi + eax + 2], cl
mov ecx, dword [esp + 0x1c]
add ecx, ebx
cmp ecx, esi
jae 0x1006626e
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + edx + 3]
mov byte [edi + eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x20]
cmp eax, 0x10
jb 0x10066207
jmp 0x1006629e
add eax, 3
jmp 0x10066279
add eax, 2
jmp 0x10066279
inc eax
cmp eax, 0x10
jae 0x1006629e
mov ebx, 0x10
lea ecx, [eax + edi]
sub edx, edi
sub ebx, eax
lea ebx, [ebx]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub ebx, 1
jne 0x10066290
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov edx, edi
cmp esi, 0x10
jbe 0x100662c7
sub esi, 0x10
add ebp, 0x10
add edi, 0x10
mov dword [esp + 0x30], esi
test esi, esi
jne 0x100661d4
mov ecx, dword [esp + 0x38]
mov eax, dword [edx]
pop edi
pop esi
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 0x14
ret
Function at 0x100704b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x1007054d
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100704d1
cmp al, 0x6b
jne 0x1007054d
inc ecx
cmp al, 0x6b
jne 0x10070515
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x100704f2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x100704f2
cmp dl, 0xbb
jne 0x100704f8
inc eax
cmp eax, esi
jl 0x100704e0
sub esi, eax
test eax, eax
jne 0x10070518
push 0
push 0
push 0x8a
push 0x80
push 4
call fcn.1005ece0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x1007053b
push 0
push 0
push 0x8b
push 0x80
push 4
call fcn.1005ece0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.10096ab0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0
push 0
push 0x89
push 0x80
push 4
call fcn.1005ece0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x10071e56
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xd8
push 0x64
pop edx
push 0x6b
pop eax
push 0x65
mov dword [ebp - 0x44], ecx
pop ecx
push 0x72
mov byte [ebp - 0x2b], al
mov word [ebp - 0x68], ax
pop eax
push 0x6e
mov word [ebp - 0x64], ax
pop eax
push 0x6c
mov byte [ebp - 0x24], cl
mov word [ebp - 0x66], cx
mov word [ebp - 0x60], cx
pop ecx
push 0x33
mov word [ebp - 0x62], ax
mov dword [ebp - 0x62], eax
pop eax
push 0x32
mov word [ebp - 0x5c], ax
pop eax
mov word [ebp - 0x5a], ax
push 0x2e
pop eax
mov word [ebp - 0x58], ax
xor eax, eax
mov word [ebp - 0x5e], cx
mov word [ebp - 0x54], cx
mov word [ebp - 0x52], cx
mov ecx, 0x3d090c
mov byte [ebp - 0x2c], dl
mov dword [ebp - 0x2a], 0x5a2b7371
mov word [ebp - 0x26], 0x514b
dec ebx
push ecx
mov dword [ebp - 0x23], 0x3e784471
mov dword [ebp - 0x1f], 0x3f233f
mov word [ebp - 0x56], dx
mov word [ebp - 0x50], ax
xor eax, eax
mov byte [ebp + eax - 0xd8], al
inc eax
cmp eax, 0x6a
jb 0x10071edb
dec ecx
jne 0x10071ed9
cmp byte [ebp - 0xa8], 0x30
push ebx
push esi
push edi
jne 0x10071f24
call fcn.10072274
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
js 0x10071f0e
mov esi, edi
push ecx
mov ecx, dword [esi + 0x30]
lea edx, [ebp - 0x68]
call fcn.10072292
pop ecx
test eax, eax
je 0x10071f1f
mov esi, dword [esi]
cmp esi, edi
jne 0x10071f04
xor esi, esi
jmp 0x10071f27
mov esi, dword [esi + 0x18]
jmp 0x10071f27
mov esi, dword [ebp - 0x44]
mov edx, 0xe3142
mov ecx, esi
call fcn.10072314
mov ebx, eax
mov edx, 0xd5786
mov ecx, esi
mov dword [ebp - 0x18], ebx
call fcn.10072314
mov edx, 0x348bfa
mov dword [ebp - 0x6c], eax
mov ecx, esi
call fcn.10072314
push 4
push 0x3000
push 0x76200
push 0
mov dword [ebp - 0x34], eax
call ebx
movsx edx, byte [ebp - 0x80]
mov ebx, eax
invalid
invalid
lea ebp, [eax]
Function at 0x10071fa0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov dword [ebp - 4], 0x11
mov eax, esi
lea ecx, [esi + ebx]
div dword [ebp - 4]
sub edx, dword [ebp - 8]
mov al, byte [ebp + edx - 0x2c]
xor al, byte [ecx + edi]
inc esi
mov byte [ecx], al
cmp esi, 0x76200
jb 0x10071f88
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebx + eax + 0x50]
movsx eax, byte [ebp - 0xd0]
shl eax, 3
push eax
push 0x3000
push ecx
push 0
call dword [ebp - 0x18]
mov edi, eax
test edi, edi
je 0x100721d0
test bl, bh
add dword [eax], eax
invalid
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov dword [ebp - 0x10], esi
sub eax, dword [esi + 0x34]
movzx ecx, word [esi + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 8], ecx
mov dword [esi + 0x34], edi

Function at 0x100721d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x100f7995]
mov dword [ebp - 0x10], edx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
test eax, eax
je 0x10072268
mov ecx, dword [eax + esi + 0x18]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0xc], ecx
test ecx, ecx
jle 0x10072264
mov ecx, dword [eax + esi + 0x24]
mov ebx, dword [eax + esi + 0x1c]
mov dword [ebp - 8], ebx
mov ebx, dword [eax + esi + 0x20]
lea eax, [ecx + esi]
add ebx, esi
mov dword [ebp - 4], eax
movzx eax, word [eax]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax*4]
mov eax, dword [eax + esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
add eax, esi
jmp 0x10072235
cmp cl, byte [edx]
jne 0x1007223b
inc eax
inc edx
mov cl, byte [eax]
test cl, cl
jne 0x1007222f
mov cl, byte [eax]
mov al, byte [edx]
cmp al, cl
sbb edx, edx
neg edx
cmp cl, al
sbb eax, eax
neg eax
sub edx, eax
je 0x1007226d
mov eax, dword [ebp - 4]
inc edi
mov edx, dword [ebp - 0x10]
add eax, 2
add ebx, 4
mov dword [ebp - 4], eax
cmp edi, dword [ebp - 0xc]
jl 0x1007221a
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
add eax, esi
jmp 0x10072266

Function at 0x10072314
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x1c]
add edx, edi
mov eax, dword [eax + 0x18]
add ebx, edi
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
test eax, eax
je 0x10072374
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1008ddfa
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x1008e15a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x1008e419
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x100bd4e8
call fcn.10071ec1
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.10021620
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x1008e565
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1008e492
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.1008ea58
test eax, eax
je 0x1008e4c7
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x1008e565
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008e565
push 0x5c0
call fcn.1008e724
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1008e4ea
push edi
mov ecx, eax
call fcn.1008e5a6
jmp 0x1008e4ec
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x1008e56d
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.1008eba4
pop ecx
test eax, eax
jne 0x1008e4a0
mov dword [ebp - 0xa8], 3
push 0x100f3748
lea eax, [ebp - 0xa8]
jmp 0x1008e582
mov eax, esi
call fcn.10071e45
ret
mov dword [ebp - 0xa4], 1
push 0x100f3748
lea eax, [ebp - 0xa4]
push eax
call fcn.10098214
int3
Function at 0x1008e7be
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.1008e961
mov edi, eax
test edi, edi
je 0x1008e849
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x1008e7f9
mov esi, edi
jmp 0x1008e835
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x1008e82e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1008e821
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.1008e8fc
jmp 0x1008e835
push 0x100d38b0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1008e835
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.1008e961
mov edi, eax
test edi, edi
jne 0x1008e7ee
test esi, esi
jne 0x1008e85e
mov ecx, dword [ebx]
add ecx, 8
call fcn.1008eaf5
mov esi, eax
test esi, esi
je 0x1008e85e
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x302c870
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x302c887
push 0x57
call fcn.03049240
jmp 0x302c8e4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x302c8aa
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x302c8e2
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ecx + 0xc]
jb 0x302c8d7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0x10], ecx
jae 0x302c8d7
mov eax, dword [ebp - 4]
jmp 0x302c8e4
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x302c8a1
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3036370
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x14], 0
jne 0x3036396
cmp dword [ebp + 0x18], 0
je 0x303638a
cmp dword [ebp + 0x1c], 0
jne 0x3036396
push 0x57
call fcn.03049240
jmp 0x30364e5
mov eax, dword [ebp + 8]
push eax
call fcn.03049240
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x30363b4
push 6
call fcn.03049240
jmp 0x30364e5
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.03049240
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x30363dc
push 0x7e
call fcn.03049240
jmp 0x30364e5
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x303649b
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 0x14]
push ecx
call dword [0x30fa624]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x303641e
push 0x57
call fcn.03049240
jmp 0x30364e5
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x1c], 0
jne 0x3036449
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x57
call fcn.03049240
jmp 0x30364e5
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.03049240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x303648f
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x303648f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x1c]
je 0x303648f
mov ecx, dword [ebp - 4]
push ecx
call fcn.03049240
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x30364c1
mov eax, dword [ebp + 0x1c]
push eax
call fcn.03049240
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x30364c1
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x30364d0
push 0x57
call fcn.03049240
jmp 0x30364e5
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.03049240
mov esp, ebp
pop ebp
ret 0x18
Function at 0x3049240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x304924f
pop dword [ebp - 0x18]
mov eax, 0xcf88681
sub eax, 0x9f3f432
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x73c24
push 0
mov eax, 0xa8fc79f7
add eax, 0x5a0396d1
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3670e1b4
sub ecx, 0x36708de9
mov edi, eax
mov edx, 0x3120800
add edx, dword [ebp - 0x18]
mov esi, 0x4e142505
sub esi, 0xbd4b9862
mov ebx, dword [edx]
xor ebx, esi
sub dword [ebp - 0xc], 0x35de86ba
mov dword [edi], ebx
sub dword [ebp - 8], 0xace923a3
add edi, 4
add edx, 0x5af0a6a3
sub edx, 0x5af0a69f
loop 0x30492a8
add eax, 0x8c719665
add eax, 0x738fab9a
xor ebx, ebx
add ebx, eax
add eax, 0xe2f1842d
sub eax, 0xe2f18428
mov ecx, 0x305d71e
add ecx, 0xfffa28e2
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4021f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x148
mov eax, dword [0x40e3e0]
xor eax, esp
mov dword [esp + 0x144], eax
push ebp
mov ebp, dword [esp + 0x154]
push esi
push edi
push 0x104
lea eax, [esp + 0x50]
push 0
push eax
call fcn.00404c50
mov eax, dword [esp + 0x164]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
sub eax, 1
je 0x4022b0
sub eax, 1
je 0x40229e
sub eax, 1
jne 0x402300
lea ecx, [esp + 0x4c]
push ecx
push eax
push eax
push 0x23
push eax
call fcn.00403140
add esp, 0x14
lea edx, [esp + 0x4c]
push edx
call edi
cmp byte [esp + eax + 0x4b], 0x5c
je 0x40226c
mov byte [esp + eax + 0x4c], 0x5c
mov byte [esp + eax + 0x4d], 0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402300
mov byte [ebp], 0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.00404c23
add esp, 0x148
ret
lea ecx, [esp + 0x4c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x402254
push 0x104
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x4c]
push edx
call edi
cmp byte [esp + eax + 0x4b], 0x5c
je 0x4022d4
mov byte [esp + eax + 0x4c], 0x5c
inc eax
lea esi, [esp + eax + 0x4c]
push str.Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402280
push 0x40b28c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.2403311753122363299141804
call edi
dec eax
cmp eax, 8
jl 0x402284
mov al, byte [eax + str.2403311753122363299141804]
cmp al, 0x30
jl 0x402284
cmp al, 0x39
jg 0x402284
movsx esi, al
sub esi, 0x30
and esi, reloc.WS2_32.dll_closesocket
jns 0x40233a
dec esi
or esi, 0xfffffffc
inc esi
push str.2403311753122363299141804
add esi, 4
call edi
sub eax, esi
dec eax
xor ecx, ecx
lea eax, [eax + str.2403311753122363299141804]
nop
mov dl, byte [eax]
test dl, dl
je 0x4023b5
test esi, esi
jle 0x4023b5
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xc], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023aa
test esi, esi
jle 0x4023aa
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xd], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023ad
test esi, esi
jle 0x4023ad
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xe], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023b2
test esi, esi
jle 0x4023b2
add dl, dl
inc dl
mov byte [esp + ecx + 0xf], dl
add ecx, 4
dec esi
inc eax
cmp ecx, 0x40
jb 0x402350
jmp 0x4023b5
inc ecx
jmp 0x4023b5
add ecx, 2
jmp 0x4023b5
add ecx, 3
mov byte [esp + ecx + 0xc], 0x2e
push 0x40b288
lea ecx, [esp + ecx + 0x11]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x4c]
push edx
call edi
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x54]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + eax + 0x54]
push ecx
call esi
push 0x103
lea edx, [esp + 0x50]
push edx
push ebp
call esi
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00404c23
add esp, 0x148
ret