joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e2d20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [esp + 0x14], esi
nop
cmp dword [esi + 0x10], 3
jae 0x100e2d40
mov ecx, esi
call fcn.100e3db0
dec ebx
jmp 0x100e2dbe
mov eax, dword [esi + 8]
mov ebp, ebx
mov edi, dword [esi + 4]
sub eax, edi
cmp ebx, eax
jbe 0x100e2d50
mov ebp, eax
mov ecx, dword [esi + 0x14]
sub ebx, ebp
mov eax, dword [esi + 0x28]
mov dword [esp + 0x18], ebx
lea ebx, [eax + ecx*4]
lea eax, [ecx + ebp]
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], ecx
mov edi, edi
movzx ecx, byte [eax + 2]
lea edx, [eax + 1]
movzx eax, byte [eax]
lea ebx, [ebx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx]
xor ecx, dword [esi + eax*4 + 0x60]
mov esi, dword [esp + 0x10]
movzx eax, cx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + eax*4]
mov dword [esi + eax*4], edi
inc edi
mov esi, dword [esp + 0x14]
mov eax, edx
mov dword [ebx - 4], ecx
sub ebp, 1
jne 0x100e2d70
mov ebx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], edi
cmp edi, dword [esi + 8]
jne 0x100e2dbe
mov ecx, esi
call fcn.100e3670
test ebx, ebx
jne 0x100e2d30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x100e3710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx], 0
lea esi, [ecx + 0x60]
mov dword [ecx + 0x34], 0
xor edx, edx
mov word [ecx + 0x1e], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x468], 0xffffffff
mov dword [ecx + 0x46c], 0xffffffff
mov dword [ecx + 0x30], 0x20
mov byte [ecx + 0x1d], 1
mov dword [ecx + 0x48], 4
mov word [ecx + 0x58], 2
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x100e3763
pop esi
ret
Function at 0x343f19f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x343f6b04]
jne 0x34415a46
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34419cd8], eax
mov dword [0x34419cd4], ecx
mov dword [0x34419cd0], edx
mov dword [0x34419ccc], ebx
mov dword [0x34419cc8], esi
mov dword [0x34419cc4], edi
mov word [0x34419cf0], ss
mov word [0x34419ce4], cs
mov word [0x34419cc0], ds
mov word [0x34419cbc], es
mov word [0x34419cb8], fs
mov word [0x34419cb4], gs
pushfd
pop dword [0x34419ce8]
mov eax, dword [ebp]
mov dword [0x34419cdc], eax
mov eax, dword [ebp + 4]
mov dword [0x34419ce0], eax
lea eax, [ebp + 8]
mov dword [0x34419cec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x34419c28], 0x10001
mov eax, dword [0x34419ce0]
mov dword [0x34419bdc], eax
mov dword [0x34419bd0], 0xc0000409
mov dword [0x34419bd4], 1
mov eax, dword [0x343f6b04]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34417ca0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x34419c20], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34415b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x34419c20], 0
jne 0x34415b36
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x3440e49e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x3440e4ad
pop dword [ebp - 0x38]
mov eax, 0xea833434
sub eax, 0xb6424f87
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xb48f0a59
add dword [ebp - 0x48], 0x99c33af2
mov dword [ebp - 0x44], 0x318b3ad5
sub dword [ebp - 0x44], 0xff57ee90
mov dword [ebp - 0x40], 0x272eff86
add dword [ebp - 0x40], 0x251d44a8
mov dword [ebp - 0x3c], 0x28197a73
add dword [ebp - 0x3c], 0xd7e6858d
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x955bfe3e
sub dword [ebp - 0x48], 0x20e994e8
mov dword [ebp - 0x44], 0xe7b718d2
add dword [ebp - 0x44], 0x59b548a3
mov dword [ebp - 0x40], 0x68152bc4
sub dword [ebp - 0x40], 0x4a5bf58
mov dword [ebp - 0x3c], 0x47b7f3a0
add dword [ebp - 0x3c], 0xb8480c60
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3ffff
push 0
call eax
mov ecx, 0x79fd63aa
add ecx, 0x8602e81f
mov ebx, eax
mov esi, 0xe31fe95e
add esi, 0x5121e6a2
add esi, dword [ebp - 0x38]
mov edi, 0x70f17412
add edi, 0x33c1f104
add dword [ebp - 0x20], 0xb6efd5fd
mov edx, dword [esi]
xor dword [ebp - 0x2c], 0x78f47e8f
sub edx, edi
mov dword [ebx], edx
mov dword [ebp - 8], 0x246b5254
add ebx, 0xe6607ef7
add ebx, 0x199f810d
add esi, 0x88673af
add esi, 0xf7798c55
loop 0x3440e5c5
add eax, 0x121f7
mov ebx, eax
add eax, 0x5cb42263
add eax, 0xa34bdda2
mov ecx, 0x4285234c
add ecx, 0xf1b9dcb4
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1002529b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x1002529b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100252aa
pop dword [ebp - 0x20]
mov eax, 0x2eba40b9
add eax, 0xe14811f1
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x401ba
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4784
mov edx, eax
mov esi, 0xe21ecbe1
add esi, 0x2de5f01f
add esi, dword [ebp - 0x20]
mov ebx, 0x9487f112
sub ebx, 0xfe381b96
xor dword [ebp - 0x1c], 0x53842321
mov edi, dword [esi]
mov dword [ebp - 0x10], 0x642b932c
sub edi, ebx
mov dword [edx], edi
sub dword [ebp - 0x18], 0x93a70cd7
add edx, 4
add esi, 0x2ab63932
sub esi, 0x2ab6392e
loop 0x100252fe
add eax, 0x11a5f70b
add eax, 0xee5b19d8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7b283607
sub ecx, 0x6b283607
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x11a72a31
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x14677202
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x78bb1eb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78bbe5b0]
jne 0x78bb1ebd
repz ret
jmp fcn.78bb557c

Function at 0x78bb3c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x78bb3c2f
pop dword [ebp - 0x2c]
mov eax, 0x78bb3c2f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe3579e74
sub dword [ebp - 0x3c], 0x95055929
mov dword [ebp - 0x38], 0x207e6416
add dword [ebp - 0x38], 0x11b4e82f
mov dword [ebp - 0x34], 0xf192691d
add dword [ebp - 0x34], 0x5ab9db11
mov dword [ebp - 0x30], 0x5ba2d1f7
add dword [ebp - 0x30], 0xa45d2e09
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x12b51816
add dword [ebp - 0x3c], 0x61bd5140
mov dword [ebp - 0x38], 0xab36e9ad
add dword [ebp - 0x38], 0x963577c8
mov dword [ebp - 0x34], 0x11323a43
sub dword [ebp - 0x34], 0xadc2cdd7
mov dword [ebp - 0x30], 0x52b853df
sub dword [ebp - 0x30], 0x52b853df
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e99e
push 0
call eax
mov ecx, 0x153567a4
add ecx, 0xeacae8ee
mov ebx, eax
mov esi, 0x611734c4
add esi, 0x17a5013c
add esi, dword [ebp - 0x2c]
mov edi, 0x9811bdd4
sub edi, 0x2ca6e1a6
mov edx, dword [esi]
xor dword [ebp - 0x28], 0x86ca6a50
sub edx, edi
add dword [ebp - 4], eax
mov dword [ebx], edx
sub dword [ebp - 0x28], 0x72f555d4
add ebx, 4
add esi, 0x13e87450
sub esi, 0x13e8744c
loop 0x78bb3d42
add eax, 0xffa17200
sub eax, 0xffa03ce5
mov ebx, eax
add eax, 5
mov ecx, 0x78ba0000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1002aaee
pop dword [ebp - 0x18]
mov eax, 0x1002aaee
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe19eb39a
add dword [ebp - 0x28], 0x6cb391b1
mov dword [ebp - 0x24], 0x5c7c3da
sub dword [ebp - 0x24], 0xd3947795
mov dword [ebp - 0x20], 0xb82ad7fa
sub dword [ebp - 0x20], 0x6bde93cc
mov dword [ebp - 0x1c], 0xe076b2e8
sub dword [ebp - 0x1c], 0xe076b2e8
lea eax, [ebp - 0x28]
push eax
mov eax, 0x599004b
sub eax, 0xf5964013
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x54caa8e
sub dword [ebp - 0x28], 0x90da4138
mov dword [ebp - 0x24], 0x13d860
sub dword [ebp - 0x24], 0xbea776eb
mov dword [ebp - 0x20], 0x8a3a6ebe
sub dword [ebp - 0x20], 0x26cb0252
mov dword [ebp - 0x1c], 0x9092b7b3
sub dword [ebp - 0x1c], 0x9092b7b3
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38988
push 0
call eax
mov ecx, 0x5083
mov ebx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x18]
mov edi, 0x995d1dfb
sub edi, 0x4213fbfc
sub dword [ebp - 0xc], 0xf0f91a3e
mov edx, dword [esi]
mov dword [ebp - 4], 0x35bc2fc8
xor edx, edi
sub dword [ebp - 8], 0x1723c9fe
mov dword [ebx], edx
add dword [ebp - 0xc], ebx
add ebx, 0xea322719
add ebx, 0x15cdd8eb
add esi, 4
loop 0x1002abfa
add eax, 0x4c874418
add eax, 0xb379f0c7
mov ebx, eax
add eax, 0xb3569c8d
sub eax, 0xb3569c88
mov ecx, 0x7eec211a
sub ecx, 0x6eec211a
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x4051e6], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.immortable
push str.Odios
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4022c8
xor eax, eax
jmp 0x4022e3
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403750
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
call fcn.00403880
push 0x405004
push section..data
call fcn.00403850
add esp, 8
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x4037d1
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
test edx, edx
je 0x4037bb
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
je 0x4037bb
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x40379b
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4037cf
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x4037e7
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x20
jle 0x4037e7
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x4037d1
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x403807
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
cmp eax, 0x20
jg 0x403807
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x4037e7
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x403818
movzx eax, word [ebp - 0x18]
mov dword [ebp - 0x54], eax
jmp 0x40381f
mov dword [ebp - 0x54], 0xa
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00401000
mov dword [ebp - 0x50], eax
call fcn.004038f0
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d588
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d3c
mov dword [ebp - 0x14], eax
cmp dword [0x819838], esi
jne 0x40d67b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d608
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d75b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d75b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d75b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x819838], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x81983c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x819840], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x819848], eax
test eax, eax
je 0x40d678
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x819844], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6a0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d693
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push 4
pop eax
jmp 0x40d75d
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push dword [0x819838]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d69a
mov eax, dword [0x819844]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d713
cmp dword [0x819848], edi
je 0x40d713
push eax
call ebx
push dword [0x819848]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d713
test eax, eax
je 0x40d713
call ecx
test eax, eax
je 0x40d708
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d708
test byte [ebp - 8], 1
jne 0x40d713
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d743
mov eax, dword [0x81983c]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
call eax
mov esi, eax
test esi, esi
je 0x40d740
mov eax, dword [0x819840]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x819838]
call ebx
test eax, eax
je 0x40d75b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d75d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040f0
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x405e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435676
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x405ecc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x405ecc
call fcn.00402b30
mov esi, eax
jmp 0x405fbc
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x405eef
call fcn.00402b30
jmp 0x405faf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x405f0d
call fcn.00402b30
jmp 0x405faf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x405f2e
mov esi, 0x8007000e
jmp 0x405fb1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00402960
jmp 0x405f58
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x405f6f
mov esi, 0x8007000e
jmp 0x405fb1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x405f8f
call fcn.00402b30
jmp 0x405faf
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00405cc0
mov esi, eax
test edi, edi
je 0x405fbc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x405fe0
lea ecx, [ebp - 0x418]
call fcn.004042f0
jmp 0x405fe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4069a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4069b9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4069c5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4069c0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x406a15
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x406a20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406a20
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x409b90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x409bc1
mov eax, 0x80004003
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
cmp ecx, 0x41
jb 0x409c9f
cmp ecx, 0x5a
jbe 0x409bde
cmp ecx, 0x61
jb 0x409c9f
cmp ecx, 0x7a
ja 0x409c9f
mov eax, dword [0x43844c]
mov dword [ebp - 0xc], eax
mov eax, dword [0x438450]
mov dword [ebp - 8], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push eax
mov word [ebp - 0xc], cx
call fcn.00424e90
add esp, 0xc
lea eax, [ebp - 0x318]
push 0x105
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x409c55
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
push 0xffffffffffffffff
push str.Fail:_GetVolumeGUID
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.004244e4
add esp, 0x10
lea eax, [ebp - 0x10c]
push 0
push 0
push 0x43ca34
push 0
push 0
push eax
push 0x43cac4
call fcn.00408180
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x80070057
pop esi
call fcn.00424839
mov esp, ebp
pop ebp
ret 0xc