joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46791c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x467986
mov eax, ebx
call fcn.00469ce0
test al, al
jne 0x467986
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404afc
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x467973
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x467993
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a60
jmp 0x467993
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a60
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x468e04
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x468e72
mov eax, esi
call fcn.00451b30
test al, al
je 0x468e72
mov eax, dword [ebx + 0x84]
call fcn.004517bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x468e72
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x468e66
push 0
mov eax, dword [ebx + 0x84]
call fcn.004517bc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00449638
jmp 0x468e72
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00468c40
pop esi
pop ebx
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x323f5cf7
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xc384709
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100022de
pop dword [ebp - 0x10]
mov eax, 0x100022de
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7f67aa88
sub dword [ebp - 0x20], 0x3115653d
mov dword [ebp - 0x1c], 0x2ee77ef5
sub dword [ebp - 0x1c], 0xfcb432b0
mov dword [ebp - 0x18], 0x23362e7b
add dword [ebp - 0x18], 0x291615b3
mov dword [ebp - 0x14], 0x28862497
add dword [ebp - 0x14], 0xd779db69
lea eax, [ebp - 0x20]
push eax
mov eax, 0xa8490d1c
sub eax, 0x9848dd18
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xcaa1909e
sub dword [ebp - 0x20], 0x562f2748
mov dword [ebp - 0x1c], 0x2d2eb6e7
add dword [ebp - 0x1c], 0x143daa8e
mov dword [ebp - 0x18], 0x63132a7c
add dword [ebp - 0x18], 0x5c41f0
mov dword [ebp - 0x14], 0x32515b4c
sub dword [ebp - 0x14], 0x32515b4c
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39cc2
push 0
call eax
mov ecx, 0x4313f3bf
sub ecx, 0x43139e81
xor edx, edx
add edx, eax
mov ebx, 0x10006200
add ebx, dword [ebp - 0x10]
mov esi, 0x9e982dfd
add esi, 0xb4c20a5c
mov edi, dword [ebx]
add dword [ebp - 4], 0x43367df6
xor edi, esi
add dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 8], 0xf6fb7cc0
add edx, 0xd978d010
sub edx, 0xd978d00c
add ebx, 4
loop 0x100023f2
add eax, 0x147cb
xor ebx, ebx
add ebx, eax
add eax, 0x5a87f7fe
sub eax, 0x5a87f7f9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40dedb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408cd1
mov dword [ebp - 0x14], eax
cmp dword [0x455f5c], esi
jne 0x40dfce
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40df5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e0ae
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e0ae
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e0ae
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x455f5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x455f60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x455f64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x455f6c], eax
test eax, eax
je 0x40dfcb
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x455f68], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dff3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dfe6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e008
push 4
pop eax
jmp 0x40e0b0
cmp dword [ebp - 0x14], esi
je 0x40e008
push dword [0x455f5c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40dfed
mov eax, dword [0x455f68]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e066
cmp dword [0x455f6c], edi
je 0x40e066
push eax
call ebx
push dword [0x455f6c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e066
test eax, eax
je 0x40e066
call ecx
test eax, eax
je 0x40e05b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e05b
test byte [ebp - 8], 1
jne 0x40e066
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e096
mov eax, dword [0x455f60]
cmp eax, edi
je 0x40e093
push eax
call ebx
test eax, eax
je 0x40e093
call eax
mov esi, eax
test esi, esi
je 0x40e093
mov eax, dword [0x455f64]
cmp eax, edi
je 0x40e093
push eax
call ebx
test eax, eax
je 0x40e093
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x455f5c]
call ebx
test eax, eax
je 0x40e0ae
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e0b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404293
mov esp, ebp
pop ebp
ret
Function at 0x10061b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10061b1f
pop dword [ebp - 0x4c]
mov eax, 0x10061b1f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x40c24
push 0
mov eax, 0x54c97f11
add eax, 0xbb3e020b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x7d48204a
sub ecx, 0x7d47e1dd
mov esi, eax
mov edx, 0xc121db91
sub edx, 0xb1096991
add edx, dword [ebp - 0x4c]
mov edi, 0x2000e026
add edi, 0xb5cce3a8
xor dword [ebp - 0x20], 0x107cb622
mov ebx, dword [edx]
xor dword [ebp - 0xc], ebx
sub ebx, edi
xor dword [ebp - 0x48], ebx
mov dword [esi], ebx
add dword [ebp - 0xc], 0x66bc141f
add esi, 4
add edx, 4
loop 0x10061b79
add eax, 0x1736624d
sub eax, 0x173575c6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x804628e4
sub ecx, 0x704628e4
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvDX9.x3d_public:_void___stdcall_MATRIX3D::Invert_struct_MATRIX3D_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4
Function at 0x40e550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCasting.exe_gMozillaPoisonSize], eax
call fcn.0040b99f
pop ecx
mov ecx, dword [sym.TestCasting.exe_gMozillaPoisonSize]
mov dword [sym.TestCasting.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40e588
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCasting.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401c66
pop dword [ebp - 0x4c]
mov eax, 0x33e2ad9f
sub eax, 0x33a29139
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x31c6fa4b
add dword [ebp - 0x5c], 0x1c8b4b00
mov dword [ebp - 0x58], 0x5920762c
add dword [ebp - 0x58], 0xd912d619
mov dword [ebp - 0x54], 0x15fc9c66
add dword [ebp - 0x54], 0x364fa7c8
mov dword [ebp - 0x50], 0xb4923c6f
add dword [ebp - 0x50], 0x4b6dc391
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x36c87bb7
add eax, 0xc977b49d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf255032b
sub dword [ebp - 0x5c], 0x7de299d5
mov dword [ebp - 0x58], 0xd3ebcfdb
add dword [ebp - 0x58], 0x6d80919a
mov dword [ebp - 0x54], 0xc3db373a
add dword [ebp - 0x54], 0x9f943532
mov dword [ebp - 0x50], 0x1604ad78
add dword [ebp - 0x50], 0xe9fb5288
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xc563af47
sub eax, 0xc5237f1b
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac9a
push 0
call eax
mov ecx, 0x593a
xor esi, esi
add esi, eax
mov edx, 0xc8660879
add edx, 0x37da6787
add edx, dword [ebp - 0x4c]
mov ebx, 0xd6fecdce
sub ebx, 0x911ffb7a
mov dword [ebp - 0x38], 0xde2318f8
mov edi, dword [edx]
xor dword [ebp - 0xc], 0x16d32164
sub edi, ebx
xor dword [ebp - 0x24], 0xa3cc9090
mov dword [esi], edi
sub dword [ebp - 0x34], 0x1b905adc
add esi, 0xa2ecf57f
add esi, 0x5d130a85
add edx, 0xbe7458f4
sub edx, 0xbe7458f0
loop 0x401d84
add eax, 0x157bb
xor ebx, ebx
add ebx, eax
add eax, 0x10a4bb74
sub eax, 0x10a4bb6f
mov ecx, 0x4d273f5b
sub ecx, 0x4ce73f5b
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x88cd90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x276000]
push edi
jmp 0x88cdaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x88cdb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88cda0
mov eax, 1
add ebx, ebx
jne 0x88cdc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x88cdd4
jne 0x88cdf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88cdf3
dec eax
add ebx, ebx
jne 0x88cde0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x88cdb8
add ebx, ebx
jne 0x88cdef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x88ce45
xor ecx, ecx
sub eax, 3
jb 0x88ce0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x88ce7a
sar eax, 1
mov ebp, eax
jmp 0x88ce16
add ebx, ebx
jne 0x88ce16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88cde4
inc ecx
add ebx, ebx
jne 0x88ce24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x88cde4
add ebx, ebx
jne 0x88ce31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x88ce26
jne 0x88ce42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x88ce26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x88ce64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x88ce56
jmp 0x88cda6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x88ce64
add edi, ecx
jmp 0x88cda6
pop esi
mov edi, esi
mov ecx, 0xb3d1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x88ce82
cmp byte [edi], 0x22
jne 0x88ce82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x88ce87
lea edi, [esi + 0x489000]
mov eax, dword [edi]
or eax, eax
je 0x88ceff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4cf098]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4cf1f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x88ceb4
mov ecx, edi
jns 0x88cee3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4cf200]
or eax, eax
je 0x88cef9
mov dword [ebx], eax
add ebx, 4
jmp 0x88ced1
call dword [esi + 0x4cf1fc]
mov ebp, dword [esi + 0x4cf204]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x88cf33
sub esp, 0xffffff80
jmp 0x571fb2
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401c66
pop dword [ebp - 0x34]
mov eax, 0xef1e1cff
add eax, 0x1121ff67
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x48d0acd1
sub dword [ebp - 0x44], 0xfa7e6786
mov dword [ebp - 0x40], 0x83ca98cb
sub dword [ebp - 0x40], 0x51974c86
mov dword [ebp - 0x3c], 0x7afb5c31
add dword [ebp - 0x3c], 0xd150e7fd
mov dword [ebp - 0x38], 0xed359710
sub dword [ebp - 0x38], 0xed359710
lea eax, [ebp - 0x44]
push eax
mov eax, 0xec170d31
add eax, 0x14292323
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x5150d9ca
sub dword [ebp - 0x44], 0xdcde7074
mov dword [ebp - 0x40], 0xf07b7dc7
sub dword [ebp - 0x40], 0xaf0f1c52
mov dword [ebp - 0x3c], 0x8a5af021
add dword [ebp - 0x3c], 0xd9147c4b
mov dword [ebp - 0x38], 0x7ceb3a23
add dword [ebp - 0x38], 0x8314c5dd
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x6326ed80
sub eax, 0x62e6bd54
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b7ba
push 0
call eax
mov ecx, 0x6b15890c
add ecx, 0x94ead2f6
xor edx, edx
add edx, eax
mov ebx, 0xba7ae6b9
add ebx, 0x45c58947
add ebx, dword [ebp - 0x34]
mov esi, 0xfa8b6a0
sub esi, 0xa0785d07
add dword [ebp - 0x14], eax
mov edi, dword [ebx]
sub dword [ebp - 0x10], eax
sub edi, esi
sub dword [ebp - 0x30], edx
mov dword [edx], edi
xor dword [ebp - 0x1c], 0x22851907
add edx, 4
add ebx, 0xc6e1e33a
add ebx, 0x391e1cca
loop 0x401d8a
add eax, 0xa480ebc2
add eax, 0x5b807719
xor ebx, ebx
add ebx, eax
add eax, 0xe37e9d26
sub eax, 0xe37e9d21
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x437140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a000]
push edi
jmp 0x43715a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437150
mov eax, 1
add ebx, ebx
jne 0x437173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x437168
jne 0x437184
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437168
xor ecx, ecx
sub eax, 3
jb 0x437198
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43720a
mov ebp, eax
add ebx, ebx
jne 0x4371a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4371b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4371d4
inc ecx
add ebx, ebx
jne 0x4371c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4371b5
jne 0x4371d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4371b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4371f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4371e5
jmp 0x437156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4371f4
add edi, ecx
jmp 0x437156
pop esi
mov edi, esi
mov ecx, 0xbe1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x437212
cmp byte [edi], 7
jne 0x437212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x437217
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x43728f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4fdc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4fe60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x437244
mov ecx, edi
jns 0x437273
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4fe64]
or eax, eax
je 0x437289
mov dword [ebx], eax
add ebx, 4
jmp 0x437261
call dword [esi + 0x4fe74]
mov ebp, dword [esi + 0x4fe68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4372c3
sub esp, 0xffffff80
jmp 0x414da6
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x4015ee
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [eax]
cmp dword [esp + 0x14], esi
jb 0x4015c6
mov ebx, dword [eax + 4]
add ebx, esi
cmp dword [esp + 0x14], ebx
jb 0x4015d4
inc ecx
add eax, 0x28
cmp ecx, edi
jb 0x4015b3
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*8 + 0xf8]
mov eax, dword [edx + eax*8 + 0x10c]
sub eax, dword [ecx + 0xc]
add eax, dword [esp + 0x14]
jmp 0x4015d0
fiadd dword [eax + 0xc80a08a]
cmp edi, dword [eax + 0x62]
test bl, ch
dec edi
out 0xf2, eax
aas
lahf
neg byte [ecx + 0x4460a1f0]
push esi
jge 0x4015c0
cli
cdq
in al, dx
cmp ch, byte [esi + 0x7ab66b5b]
pop esp
push 0x63
pop edx
add byte [esi], 0x25
add bh, bh
das
invalid