joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015a806
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
jmp 0x1015a786
jmp 0x1010884a
mov word [eax], dx
bswap eax
mov ah, byte [esp]
mov al, byte [esp]
inc eax
jae 0x1015a186
jb 0x1010884a
sub esp, 0xe
push dword [esp + 0xc]
lea esp, [esp + 2]
jmp 0x1015a7c1
jmp 0x1015a881
neg ax
jmp 0x1015a7f6
inc al
jmp 0x1015a7c6
add ebp, 8
call fcn.1015a7e0
mov dword [ebx], edx
call 0x1015a806
inc esi
lea esp, [esp]
lea eax, [edx*4]
jmp fcn.101079cf
mov edx, dword [ebp + 4]
mov eax, 0x716793d5
add ax, 0xe9df
jg 0x1015a7dc
inc al
neg ax
jmp 0x1015a7f6
mov ebx, dword [ebp]
lea edx, [ecx*4]
setbe ah
mov edx, esp
mov dx, word [esp]
jmp 0x1015a81e

Function at 0x1015bfb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, byte [eax]
sub esp, 0x1a
jmp 0x1015c006
pop word [esp + 0x12]
jmp 0x1015bff0
jle 0x1015bfc4
pop word [esp + 0x12]
jmp 0x1015bff0

Function at 0x1015c037
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, edx
shl edx, 7
jmp 0x1015bf41
lea esp, [esp + 6]
lea esp, [esp + 3]
jmp 0x1015bf2b
shr ecx, 0x19
push esp
add esp, 3
jne 0x1015bfa8
je 0x1015bf7f
sbb bl, byte [ebp + 0x16a7540d]
insb byte es:[edi], dx
jg 0x1015bf85
int1
invalid
sub esp, 0xd
jge 0x1015bf0c
lea esp, [esp + 6]
lea esp, [esp + 3]
jmp 0x1015bf2b
lea esp, [esp + 1]
lea esp, [esp + 1]
jne 0x1015bf05
mov ch, bl
lea eax, [edx*4]
lea ecx, [edx - 0x26b5ebdb]
jmp 0x1015c041
mov byte [esp + 1], ch
lea esp, [esp + 0x28]
jmp 0x1015c00f
mov eax, ebp
mov dword [eax], edx
mov cx, word [esp]
mov edx, dword [esp]
jmp 0x1015c092
mov dh, 0x8f
mov ax, word [esp]
jmp fcn.10105686

Function at 0x10169a00
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr edx, ebx
rdtsc
shr dl, 6
jmp 0x1012f2d9
mov word [ebp], ax
bsr bx, cx
jge 0x101699ea
bsr edx, ebx
jmp 0x10169a49
rdtsc
shr dl, 6
jmp 0x1012f2d9

Function at 0x101723a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x18
lea edx, [esi*4]
lea esp, [esp + 1]
jmp 0x10172351
sub esp, 0x19
add esp, 0x18
lea edx, [esi*4]
lea esp, [esp + 1]
jmp 0x10172376
mov dx, word [esp]
setge dl
push bx
lea esp, [esp + 2]
jmp fcn.10105686
mov ax, word [ecx]
stc
jp 0x10172340
sub esp, 0x19
jmp 0x1017232a
mov word [ebp], ax
neg dx
jle 0x10172353
mov dx, word [esp]
jmp 0x10172389
setge dl
push bx
lea esp, [esp + 2]
jmp fcn.10105686
bswap edx
jmp 0x1017236b
Function at 0x10179d7b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1017ae49
xchg edi, eax
dec cl
fidiv dword [esi]
inc edx
xchg dword [esi], eax
ljmp 0xc341
inc dword [esp + 0x18]
lea ecx, [eax + edx]
jmp 0x10179f22
mov ecx, 0x6b079414
add cx, 0x538b
jmp 0x10179e16
jmp 0x10179f54
cmp esi, dword [eax + ebx + 4]
jmp 0x10179dd4
jbe 0x100eddb4
ja 0x100edde0
jg 0x10179d71
insb byte es:[edi], dx
or eax, dword [esi]
stc
dec edi
salc
inc ecx
ret
lea esp, [esp + 4]
cmp dword [eax], ebx
jmp 0x10179d65
sub esp, 0xc
jmp 0x10179de7
xor ecx, ecx
stc
lea esp, [esp + 0x3c]
mov dword [esp + 0x14], ecx
jmp 0x10179d9d
jne 0x100edd87
sub esp, 0x1e
pushal
bsr ecx, esi
lea esp, [esp + 2]
jmp 0x10179db3
lea esp, [esp + 0xc]
cmp dword [eax + ebx + 8], ecx
jmp 0x10179e2c
mov ecx, 0x4d470671
jmp 0x10179e6e
jbe 0x100edd87
mov dword [esp + 0x10], ecx
jmp 0x100edd9d
lea esp, [esp + 0xc]
add ecx, dword [esp + 0x10]
mov eax, 0x176b466f
jmp 0x10179e8c
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
sub esp, 0xc
lea eax, [ebp*4]
jmp 0x10179e3b
push ebp
mov ebp, ebx
lea ebp, [eax + ebp]
jmp 0x10179e51
call fcn.1010a8e3
jmp 0x10179e9a
mov ax, word [esp]
mov eax, dword [ebp + 0xc]
push esi
lea esp, [esp + 4]
jmp 0x10179e76
test eax, eax
je 0x100edd71
ror cx, cl
jmp 0x10179f6b
add dword [esp + 0x10], 0x14
jmp 0x10179f19
mov ecx, dword [esp + 0x14]
clc
jmp 0x10179ebf
mov eax, dword [0x53e9e04]
mov ecx, 0x47cb9d2b
lea ecx, [eax + ebx]
mov cl, bh
lea esp, [esp + 8]
jmp 0x10179ed5
cmp ecx, dword [eax + ebx + 8]
call fcn.10179f03
bswap ecx
sub esp, 0x1f
pop dword [esp]
lea esp, [esp + 3]
jmp 0x10179f48
lea esp, [esp + 0x18]
mov ecx, dword [esp + 0x18]
clc
stc
jmp 0x10179fb9
mov ecx, esi
jmp 0x10179f93
inc dword [esp + 0x14]
xchg cx, ax
sub esp, 9
lea esp, [esp + 1]
jmp 0x10179eee
push edi
jmp 0x10179fca
call fcn.1010a7b5
dec bx
xchg ch, bl
lea ecx, [ebx*4]
jmp 0x10179f7d
add ebx, 0xc
cmp ecx, dword [eax]
jb 0x100edde0
jae 0x100eddb4
mov edi, eax
add edi, 0x7c
mov ecx, dword [edi]
pop edi
jmp 0x1017a440
mov eax, dword [0x53e9e80]
lea ecx, [eax + ebp]
jmp 0x1017a032
cmp ebx, esi
lea esp, [esp + 4]
jbe 0x100ee30f
bsr ax, cx
jmp 0x10179ff4
xor eax, edi
sub esp, 0x12
mov ecx, eax
pushal
sets cl
jmp 0x1017a07a
xor eax, 0x53e9e80
xchg cl, ch
setg ch
bts cx, bp
jmp 0x1017a01c
lea esp, [esp + 2]
je 0x100ee30f
push esp
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x1017a00a
push ecx
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x1017a0a1
lea esp, [esp + 2]
lea esp, [esp + 0x30]
add eax, 0xa0
mov ecx, dword [eax]
jmp 0x1017a064
pushal
pop dword [esp + 3]
jmp 0x1017a38a
xor ecx, eax
stc
lea esp, [esp + 4]
push 0x53e9e24
jmp 0x1017a08b
lea esp, [esp + 0x14]
mov dword [esp + 0x2c], ecx
test ecx, ecx
push bp
jmp 0x1017a04e
lea esp, [esp + 0x1c]
call ecx
mov cl, 0x41
bswap eax
call fcn.1017a244
xor ecx, edi
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x1017a279
mov ebx, dword [eax + 0x78]
sub esp, 0x16
lea esp, [esp + 2]
add ebx, esi
jmp 0x1017a0bf

Function at 0x10179f03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], ecx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x10179f38
lea esp, [esp + 4]
jb 0x100edd9d
jae 0x100edd87
Function at 0x40192b
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x414130]
mov byte [0x404130], 0
cmp byte [eax + 0x180], 0x68
push esi
mov esi, 0x404130
jne 0x40196a
cmp byte [eax + 0x181], 0x74
jne 0x40196a
cmp byte [eax + 0x182], 0x74
jne 0x40196a
cmp byte [eax + 0x183], 0x70
jne 0x40196a
cmp byte [eax + 0x184], 0x3a
je 0x40197c
push 0x4012fc
push esi
call sub.msvcrt.dll_strcpy
mov eax, dword [0x414130]
pop ecx
pop ecx
add eax, 0x180
push eax
push esi
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
push 1
push 0
push 0
push esi
push 0
push dword [esp + 0x1c]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret 4

Function at 0x4019a1
Capabilities:
Create process on windows

Disassembly:
push esi
push 0x4012f4
mov esi, 0x404130
push esi
call sub.msvcrt.dll_strcpy
mov eax, dword [0x414130]
add eax, 0x200
push eax
push esi
call sub.msvcrt.dll_strcat
add esp, 0x10
push 1
xor eax, eax
push eax
push eax
push esi
push eax
push dword [esp + 0x1c]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret 4

Function at 0x401b38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0xa
push 0x182
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x401b59
pop esi
ret
push edi
push dword [esi]
call sub.msvcrt.dll_malloc
mov edi, eax
push edi
add esi, 4
push esi
call fcn.00402d60
add esp, 0xc
mov dword [0x414130], edi
xor eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x401ea5
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x414130]
cmp byte [eax + 0x16a0], bl
jne 0x401f74
xor edi, edi
cmp dword [eax + 0x16a4], ebx
je 0x401f4c
push esi
mov esi, 0x404130
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push ebx
push 0x4012c8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x28]
call fcn.0040295c
push 1
push esi
lea ecx, [ebp - 0x28]
call fcn.00402978
mov eax, dword [0x414130]
push ebx
push dword [eax + 0x16a4]
add eax, 0x1ea8
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a34
lea ecx, [ebp - 0x28]
call fcn.00402b9e
push 0x10
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
push esi
mov edi, eax
call sub.KERNEL32.dll_DeleteFileA
lea ecx, [ebp - 0x28]
call fcn.00402cb6
mov eax, dword [0x414130]
pop esi
push edi
push 0x4017fe
push dword [ebp + 8]
add eax, 0x16a8
push eax
push dword [0x404128]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp edi, ebx
je 0x401fa3
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x401fa3
lea ecx, [eax + 0x1ea8]
mov eax, dword [eax + 0x16a4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x401377
push dword [ebp + 8]
mov dword [ebp - 8], ecx
push 0x404008
push dword [0x404128]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
leave
ret 4
Function at 0x40208e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push edi
lea ecx, [ebp - 0x24]
call fcn.0040295c
push 1
push 0xc0000000
lea edi, [esi + 0x896]
push edi
lea ecx, [ebp - 0x24]
call fcn.00402a6a
test al, al
jne 0x4020ce
lea eax, [esi + 0x91c]
lea ebx, [ebp - 0x824]
call fcn.00402693
jmp 0x4020d5
mov byte [ebp - 0x824], 0
lea ecx, [ebp - 0x24]
call fcn.00402b9e
lea eax, [ebp - 0x824]
push edi
push eax
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
mov ebx, 0x404130
push 1
push 0xc0000000
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402cbb
push dword [ebp - 0x14]
push dword [0x414134]
call fcn.00401772
test eax, eax
jne 0x402184
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x88]
je 0x40214e
push dword [ebp - 0x14]
push ebx
call sub.msvcrt.dll_strcpy
push 0x401280
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x10
push 0x10
push 0
push ebx
push dword [0x414134]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40217c
lea edi, [esi + 0x90]
cmp dword [edi], 0
je 0x4021b4
push eax
push dword [ebp - 0x18]
call fcn.00402c3c
cmp eax, dword [edi]
je 0x4021b4
push 0x17
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x14]
push dword [0x414134]
call fcn.00401772
lea ecx, [ebp - 0x24]
call fcn.00402b9e
lea eax, [ebp - 0x824]
push eax
lea eax, [esi + 0x896]
push eax
call fcn.00402734
test al, al
jne 0x4020f1
push 0x403214
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 1
call sub.msvcrt.dll__CxxThrowException
cmp byte [esi + 0x95], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
je 0x4021cb
push dword [ebp - 0x14]
call fcn.004028bf
mov eax, dword [esi + 0x8c]
cmp dword [esi + 0x88], eax
je 0x402281
test eax, eax
je 0x402281
push eax
call sub.msvcrt.dll_malloc
push dword [esi + 0x8c]
mov edi, eax
push 0
push edi
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x88]
add esp, 0x10
cmp eax, ecx
jle 0x402211
push ecx
jmp 0x402212
push eax
push dword [ebp - 0x18]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00402b9e
lea eax, [ebp - 0x824]
push eax
call sub.KERNEL32.dll_DeleteFileA
xor ecx, ecx
cmp dword [esi + 0xa68], ecx
jle 0x402256
lea eax, [esi + 0xa6c]
mov edx, dword [eax]
mov bl, byte [eax + 5]
inc ecx
mov byte [edi + edx], bl
add eax, 8
cmp ecx, dword [esi + 0xa68]
jl 0x402242
push 1
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402978
push 0
push dword [esi + 0x8c]
lea ecx, [ebp - 0x24]
push edi
call fcn.00402a34
push edi
call sub.msvcrt.dll_free
pop ecx
jmp 0x4022a8
xor ecx, ecx
cmp dword [esi + 0xa68], ecx
jle 0x4022a8
lea eax, [esi + 0xa6c]
mov edx, dword [eax]
mov bl, byte [eax + 5]
mov edi, dword [ebp - 0x18]
inc ecx
mov byte [edi + edx], bl
add eax, 8
cmp ecx, dword [esi + 0xa68]
jl 0x402291
cmp byte [esi + 0x94], 1
pop edi
pop ebx
jne 0x4022be
push dword [ebp - 4]
lea ecx, [ebp - 0x24]
call fcn.00402b70
lea ecx, [ebp - 0x24]
call fcn.00402cb6
leave
ret
Function at 0x4024b1
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x88], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jle 0x402591
add esi, 0x1dc
push edi
cmp byte [esi - 0x150], bl
jne 0x40251c
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [esi - 0x148]
push eax
push dword [esi - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402567
push dword [esi]
lea eax, [esi + 4]
push eax
push dword [esi - 4]
lea eax, [esi - 0x44]
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x402567
lea edi, [esi - 0x44]
cmp byte [edi], bl
je 0x402554
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [esi - 0x148]
push eax
push dword [esi - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402567
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x402567
lea eax, [esi - 0x148]
push eax
push dword [esi - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], ebx
je 0x402575
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add esi, 0x554
cmp ecx, dword [eax + 0x88]
jl 0x4024d6
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402597
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, eax
lea eax, [esi + 0x488]
mov ebx, 0x404130
call fcn.00402693
lea eax, [esi + 0x5d4]
push eax
push ebx
call sub.msvcrt.dll_strcat
cmp byte [esi + 0x88], 0
pop ecx
pop ecx
jne 0x4025d1
push ebx
call sub.KERNEL32.dll_DeleteFileA
jmp 0x402603
lea ecx, [ebp - 0x20]
call fcn.0040295c
push 1
push ebx
lea ecx, [ebp - 0x20]
call fcn.00402978
push 0
push dword [esi + 0x654]
add esi, 0x658
push esi
lea ecx, [ebp - 0x20]
call fcn.00402a34
lea ecx, [ebp - 0x20]
call fcn.00402cb6
pop esi
pop ebx
leave
ret

Function at 0x402607
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea ecx, [ebp - 0x20]
call fcn.0040295c
push 0x104
mov esi, 0x404130
push esi
call fcn.00402bd6
push esi
call sub.KERNEL32.dll_DeleteFileA
push 0x401264
push esi
call sub.msvcrt.dll_strcat
pop ecx
pop ecx
push 2
push esi
lea ecx, [ebp - 0x20]
call fcn.00402978
lea ebx, [edi + 0x89]
push 0
push ebx
call sub.msvcrt.dll_strlen
pop ecx
inc eax
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.00402a34
lea ecx, [ebp - 0x20]
call fcn.00402b9e
xor eax, eax
cmp byte [edi + 0x88], 1
jne 0x402675
push eax
jmp 0x402677
push 0xa
push eax
push eax
push esi
push eax
push dword [0x414134]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.00402cb6
pop esi
pop ebx
leave
ret
Function at 0x402693
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 1
push edi
mov edi, 0x404130
jne 0x4026bb
lea eax, [esi + 8]
cmp byte [eax], 0
je 0x402707
push eax
push edi
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
jmp 0x402713
cmp eax, 2
jne 0x402713
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [esi + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402707
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
add esi, 0x10c
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x10000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402713
push edi
push 0x10000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x800
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
add eax, ebx
cmp byte [eax - 1], 0x5c
pop edi
pop esi
je 0x402732
mov byte [eax], 0x5c
mov byte [eax + 1], 0
leave
ret

Function at 0x4028bf
Capabilities:
Copy file

Disassembly:
push esi
push dword [esp + 8]
mov esi, 0x404130
push esi
call sub.msvcrt.dll_strcpy
push 0x40124c
push esi
call sub.msvcrt.dll_strcat
add esp, 0x10
push 0
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
pop esi
ret 4

Function at 0x402a6a
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call sub.msvcrt.dll_strlen
mov edi, eax
inc edi
push edi
call sub.msvcrt.dll_malloc
push dword [ebp + 8]
mov dword [esi + 0x10], eax
push eax
call sub.msvcrt.dll_strcpy
mov eax, dword [esi + 0x10]
add esp, 0x10
dec edi
cmp byte [eax + edi], 0x5c
je 0x402a9f
test edi, edi
jne 0x402a94
lea ecx, [eax + edi]
cmp byte [ecx], 0x5c
jne 0x402aad
inc ecx
mov dword [esi + 0x14], ecx
jmp 0x402ab0
mov dword [esi + 0x14], eax
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x402adb
and dword [esi + 8], 0
xor al, al
jmp 0x402afa
push dword [ebp + 8]
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push dword [esi + 8]
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x1c], eax
mov al, 1
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x402b70
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 4]
push dword [ecx + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x402bd6
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [esp + 4]
push 0
push 0x4011f8
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
ret 8
Function at 0x402c3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
pushal
pushf
xor eax, eax
mov edx, eax
mov cl, 8
shr edx, 1
jae 0x402c5b
xor edx, 0xedb88320
dec cl
jne 0x402c51
mov dword [ebp + eax*4 - 0x404], edx
inc eax
test eax, 0xff
jne 0x402c4d
lea esi, [ebp - 0x404]
mov edi, 0xffffffff
xor ecx, ecx
mov ebx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ebx + ecx]
mov eax, edi
xor eax, edx
and eax, 0xff
shl eax, 2
add eax, esi
mov eax, dword [eax]
shr edi, 8
and edi, 0xffffff
xor edi, eax
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x402c80
not edi
mov dword [ebp - 4], edi
popf
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x402d60
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00402de3
jae 0x402d6e
xor ecx, ecx
call fcn.00402de3
jae 0x402d9d
xor eax, eax
call fcn.00402de3
jae 0x402dad
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00402de3
adc al, al
jae 0x402d8f
jne 0x402dd9
stosb byte es:[edi], al
jmp 0x402d71
call fcn.00402def
sub ecx, ebx
jne 0x402db6
call fcn.00402ded
jmp 0x402dd5
lodsb al, byte [esi]
shr eax, 1
je 0x402dff
adc ecx, ecx
jmp 0x402dd2
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00402ded
cmp eax, 0x7d00
jae 0x402dd2
cmp ah, 5
jae 0x402dd3
cmp eax, 0x7f
ja 0x402dd4
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x402d71
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x402e10
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x401200
call fcn.004030ec
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x402e64
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x402e64
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x402e7c
cmp ecx, 0x20b
je 0x402e69
mov dword [ebp - 0x1c], ebx
jmp 0x402e93
cmp dword [eax + 0x400084], 0xe
jbe 0x402e64
xor ecx, ecx
cmp dword [eax + 0x4000f8], ebx
jmp 0x402e8d
cmp dword [eax + 0x400074], 0xe
jbe 0x402e64
xor ecx, ecx
cmp dword [eax + 0x4000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x4141d0], edi
mov dword [0x4141d4], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40411c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x404118]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4141d8], eax
call fcn.004030e6
cmp dword [section..data], ebx
jne 0x402ef0
push fcn.004030e6
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.004030d4
push 0x4011f0
push 0x4011ec
call sub.msvcrt.dll__initterm
mov eax, dword [0x404114]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x404110]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x4011e8
push 0x4011dc
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x402f7b
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x402f5b
cmp cl, 0x22
jne 0x402f4c
cmp byte [eax], 0x22
jne 0x402f64
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x402f6f
cmp cl, 0x20
jbe 0x402f60
test byte [ebp - 0x54], 1
je 0x402f86
movzx ecx, word [ebp - 0x50]
jmp 0x402f89
cmp byte [eax], 0x20
jbe 0x402f64
inc eax
mov dword [ebp - 0x20], eax
jmp 0x402f7b
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00401afe
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x402fa7
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x402fe3
mov eax, esi
jmp 0x402ff7
call fcn.00403127
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219