joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41139c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x411483
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x41144d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403494
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x41140f
pop dword fs:[0]
add esp, 8
jmp 0x411462
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x411437
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.00407130
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.004036f8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x411416
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x411457
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004034e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41148a
lea eax, [ebp - 0x204]
call fcn.00403494
lea eax, [ebp - 8]
call fcn.00403494
ret
Function at 0x412a0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x412a14
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x412c36
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x41534c]
mov edx, dword [0x415348]
mov eax, 0x80000000
call fcn.004111f0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040f710
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040352c
cmp dword [ebp - 4], 0
je 0x412a6e
mov eax, dword [ebp - 4]
call fcn.00406e34
test al, al
jne 0x412a78
call fcn.00412968
call fcn.00411030
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x415350]
mov edx, dword [0x415348]
mov eax, 0x80000000
call fcn.004111f0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040f710
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040352c
cmp dword [ebp - 8], 0
je 0x412aba
mov eax, dword [ebp - 8]
call fcn.00406e34
test al, al
jne 0x412af4
lea eax, [ebp - 8]
call fcn.004127c0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040f4b4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.0040352c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x415350]
mov edx, dword [0x415348]
mov eax, 0x80000000
call fcn.00411120
jmp 0x412afe
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004126d4
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x41534c]
mov edx, dword [0x415348]
mov eax, 0x80000000
call fcn.004111f0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040f710
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.0040352c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00406ed4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00406b08
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
call fcn.004110e8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00406ed4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00406b08
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00403800
jne 0x412b8d
mov eax, dword [0x415358]
call fcn.00413f4c
call fcn.004112b0
cmp al, 1
jne 0x412bd1
xor eax, eax
call fcn.004033f8
jmp 0x412bd1
xor eax, eax
push ebp
push 0x412bc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x416718]
push eax
call sub.KERNEL32.DLL_ReleaseMutex
push 0xa
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
call fcn.004033f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x412bd1
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00406ed4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00406b08
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
call fcn.004110e8
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00406ed4
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00406b08
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00403800
je 0x412c1b
xor eax, eax
call fcn.004033f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412c3d
lea eax, [ebp - 0x40]
mov edx, 0x10
call fcn.004034b8
ret
Function at 0x413574
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x413772
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
mov eax, 0xc8
call fcn.004025a8
mov ebx, eax
mov byte [ebp - 0xd], 1
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x14]
mov edx, 0x413788
call fcn.00403800
je 0x4135e5
mov byte [ebp - 0xd], 0
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040364c
mov eax, dword [ebp - 0x18]
mov edx, 0x413798
call fcn.00403800
je 0x41360e
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
jne 0x41362f
cmp dword [edi + 0x4c], 0
je 0x41373b
mov eax, edi
call fcn.00413508
xor eax, eax
mov dword [edi + 0x4c], eax
jmp 0x41373b
mov dword [edi + 0x4c], esi
push 0
push 0x4137a4
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x413678
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 0x4137b8
call fcn.0040373c
lea eax, [edi + 0x44]
mov edx, dword [ebp - 8]
call fcn.004034e8
push 0
push 0x4137c0
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x41373b
mov eax, dword [0x41543c]
mov eax, dword [eax]
mov edx, 0x4137d0
call fcn.00403800
jne 0x4136d9
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 0x4137dc
call fcn.0040373c
lea eax, [edi + 0x48]
mov edx, dword [ebp - 8]
call fcn.004034e8
jmp 0x41373b
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040364c
cmp dword [ebp - 0xc], 0
je 0x41373b
lea eax, [edi + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.004034e8
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4137dc
call fcn.0040373c
lea eax, [edi + 0x48]
mov edx, dword [ebp - 8]
call fcn.004034e8
mov eax, dword [ebp - 4]
call fcn.004025c0
mov eax, ebx
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413779
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004034b8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004034b8
ret
Function at 0x413aa8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x413ca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 8], eax
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 1
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0xc8
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040364c
mov eax, dword [ebp - 0x14]
mov edx, 0x413cbc
call fcn.00403800
je 0x413b1e
mov byte [ebp - 0xd], 0
push 0xc8
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x18]
mov edx, 0x413ccc
call fcn.00403800
je 0x413b4b
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
jne 0x413b6c
cmp dword [esi + 0x3c], 0
je 0x413c71
mov eax, esi
call fcn.00413a1c
xor eax, eax
mov dword [esi + 0x3c], eax
jmp 0x413c71
mov dword [esi + 0x3c], ebx
xor edx, edx
push ebp
push 0x413c67
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x413cd8
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x413c5d
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov edx, 0x413ce8
call fcn.0040373c
push 0
push 0x413cd8
push edi
push ebx
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x413c5d
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x38]
mov ecx, dword [ebp - 0xc]
mov edx, 0x413cfc
call fcn.0040373c
push 0
push 0x413cd8
push edi
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x413c5d
mov edx, dword [ebp - 4]
push edx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x34]
mov edx, 0x413d10
call fcn.004034e8
mov edx, dword [ebp - 0xc]
mov eax, 0x413d24
call fcn.00403980
test eax, eax
jg 0x413c5d
lea eax, [esi + 0x34]
mov edx, dword [ebp - 0xc]
call fcn.004036f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413c71
mov eax, dword [ebp - 8]
call fcn.004025c0
mov eax, dword [ebp - 4]
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413cab
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004034b8
lea eax, [ebp - 0xc]
call fcn.00403494
ret
Function at 0x413fa8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x414122
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40ec68]
call fcn.00402af4
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040352c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040ecbc
mov eax, dword [ebp - 0x14c]
mov edx, 0x414138
call fcn.00403800
je 0x414052
push dword [ebp - 4]
push 0x414138
push 0x414144
lea eax, [ebp - 4]
mov edx, 3
call fcn.004037b0
lea eax, [ebp - 8]
mov ecx, 0x414138
mov edx, dword [ebp - 4]
call fcn.0040373c
jmp 0x41405f
lea eax, [ebp - 4]
mov edx, 0x414144
call fcn.004036f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4140f7
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x414091
add eax, 0xffffffe8
sub eax, 8
jae 0x4140e0
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x4140e0
lea eax, [ebp - 0x11c]
cmp eax, 0x414148
je 0x4140e0
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036c4
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.0040373c
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x41407b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414129
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004034b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret
Function at 0x5c6250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x154000]
push edi
or ebp, 0xffffffff
jmp 0x5c6272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c6279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6268
mov eax, 1
add ebx, ebx
jne 0x5c628b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c629c
jne 0x5c62bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c62bb
dec eax
add ebx, ebx
jne 0x5c62a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c6280
add ebx, ebx
jne 0x5c62b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c630d
xor ecx, ecx
sub eax, 3
jb 0x5c62d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c6342
sar eax, 1
mov ebp, eax
jmp 0x5c62de
add ebx, ebx
jne 0x5c62de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c62ac
inc ecx
add ebx, ebx
jne 0x5c62ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c62ac
add ebx, ebx
jne 0x5c62f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c62ee
jne 0x5c630a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c62ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c632c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c631e
jmp 0x5c626e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c632c
add edi, ecx
jmp 0x5c626e
pop esi
mov edi, esi
mov ecx, 0xc6c8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c634a
cmp byte [edi], 0x13
jne 0x5c634a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c634f
lea edi, [esi + 0x1c4000]
mov eax, dword [edi]
or eax, eax
je 0x5c63c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c6a84]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c6b24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c637c
mov ecx, edi
jns 0x5c63ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c6b28]
or eax, eax
je 0x5c63c1
mov dword [ebx], eax
add ebx, 4
jmp 0x5c6399
call dword [esi + 0x1c6b2c]
popal
jmp 0x51080a
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
adc bh, dh
invalid
xor dword [edx], eax
add byte [eax], al
add esp, 4
pop edi
pop esi
inc edx
mov esp, dword [ecx + 0x5d]
ret
push ebp
mov ebp, esp
add dword [eax + ecx*8 + 0xc588b56], 0x56
lea eax, [ebp - 0x78]
push 0x78
push eax
push esi
jg 0x401ddd
push 0x4d8b2000
outsd dx, dword [esi]
mov edx, dword [0x5e40c089]
inc eax
pop esi
push eax
push ecx
add edx, 0x40
push str._s:__s___d__n
push edx
mov ch, 0xf9
add cl, 0x40
add byte [ecx + 0x2f02ac], ah
arpl sp, ax
adc al, 0x85
sal byte [edi + ecx + 0x50], 0x37
push esp
shl byte [eax], cl
add bh, bh
sub esp, dword [edi + eax*8 + 0x40]
clc
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
adc edx, dword [eax - 0x6f6f6f70]
loopne 0x401e2b
nop
nop
nop
nop
nop

Function at 0x402517
Capabilities:
Encode data using xor

Disassembly:
call fcn.004023df
xor ecx, ecx
sub cx, 0xff7f
call 0x402517
rcr byte [esi - 0x7f], 0x76
push cs
test dword ds:[edx + 0xf], edx
xor dword [esi + 0xe], 0xf52853e
sub esi, 0xfffffffc
loop 0x40251a
in al, 0x54
ljmp 0x4ad6
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x69a86569
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x59071447
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x4283e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42849c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428497
mov ecx, dword [ebp - 8]
push ecx
call fcn.00428990
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428456
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428456
xor eax, eax
jmp 0x42849c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283ef
mov esp, ebp
pop ebp
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x402c54
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040ded0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x432b78], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x402ca4
push 0x4026c8
push 0x4026d8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x4026f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4284a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4284ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00402c4d
mov eax, dword [0x4284b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4284b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x402ce3
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x432b78], 0xc
mov dword [ebp - 4], eax
jne 0x402d45
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x104c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x432b78]
cmp eax, 0xfa9
jne 0x402d61
mov dword [0x432114], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402d6e
mov dword [0x431ac0], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x432110], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x432b78], 0x213
mov dword [ebp - 0x18], edx
jne 0x402dae
push 0x402710
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00402c47
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x402ce0
cmp dword [0x432b78], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x402e18
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4