joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4055df
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40560d
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x405614
cmp ebx, dword [eax + 4]
jae 0x405614
xor eax, eax
jmp 0x405804
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x405625
xor eax, eax
inc eax
jmp 0x405803
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40563b
cmp ecx, edx
jae 0x405780
cmp dword [eax + 4], 0
je 0x405644
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40562c
cmp dword [ebp + 8], 0
je 0x405666
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x405780
cmp eax, esi
jae 0x405780
mov eax, dword [0x409580]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40568b
cmp dword [esi*4 + 0x409588], edi
je 0x405784
inc esi
cmp esi, eax
jl 0x405679
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405800
cmp dword [ebp - 8], 0x1000000
jne 0x405800
test byte [ebp - 0xc], 0xcc
je 0x405709
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x405800
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x405800
cmp word [eax + 0x18], 0x10b
jne 0x405800
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x405800
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x405709
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x405709
test byte [ecx + 0x27], 0x80
jne 0x405780
push 1
push 0x4095c8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x40561d
mov ecx, dword [0x409580]
test ecx, ecx
mov edx, ecx
jle 0x40573d
lea eax, [ecx*4 + 0x409584]
cmp dword [eax], edi
je 0x40573d
dec edx
sub eax, 4
test edx, edx
jg 0x405731
test edx, edx
jne 0x40576e
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40574a
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x405762
lea eax, [edx*4 + 0x409588]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x405750
cmp ecx, 0x10
jge 0x40576e
inc ecx
mov dword [0x409580], ecx
push 0
push 0x4095c8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40561d
xor eax, eax
jmp 0x405803
test esi, esi
jle 0x40561d
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4095c8
call ebx
test eax, eax
jne 0x40561d
cmp dword [esi*4 + 0x409588], edi
je 0x4057da
mov eax, dword [0x409580]
lea esi, [eax - 1]
test esi, esi
jl 0x4057c8
cmp dword [esi*4 + 0x409588], edi
je 0x4057c4
dec esi
jns 0x4057b8
test esi, esi
jge 0x4057d8
cmp eax, 0x10
jge 0x4057d3
inc eax
mov dword [0x409580], eax
lea esi, [eax - 1]
jmp 0x4057da
je 0x4057f2
xor ecx, ecx
test esi, esi
jl 0x4057f2
lea eax, [ecx*4 + 0x409588]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4057e0
push 0
push 0x4095c8
call ebx
jmp 0x40561d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40636c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004038e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x406407
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4093f0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x406407
cmp eax, 1
je 0x406428
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x406407
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4063d4
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x406403
xor eax, eax
inc eax
jmp 0x406447
cmp edi, eax
jae 0x40640b
xor eax, eax
jmp 0x406447
cmp eax, esi
jae 0x406412
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4093f0]
jmp 0x40642b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x710c8c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
add esi, edx
sub esi, edx
call fcn.00710ccf
add esi, 1
add esi, 0xaf2b5a72
sub edx, edx
xor dword [ebx], eax
mov edx, esi
mov esi, 0xbe6e94d5
inc ebx
push 0x706bd9b3
mov esi, dword [esp]
add esp, 4
cmp ebx, ecx
jne fcn.00710c8c
add edx, 0x1ec38627
inc edx
ret
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret

Function at 0x43cadc
Capabilities:
Encode data using xor

Disassembly:
pop es
adc al, byte [ecx]
sub byte [ecx], ch
add byte [eax], al
or ch, byte [eax]
pop es
add dword [eax], eax
or ah, byte [edx + 0x92808]
add byte [esi], al
jae 0x43cab1
add byte [eax], al
or al, byte [edx]
adc al, 0x28
inc ebx
add byte [eax], al
push es
push ss
sub dl, byte [edi]
sub bl, byte [esi + 0xf57b02]
add byte [ebp - 0x1fdfdee], al
push es
cmpsb byte [esi], byte es:[edi]
add dword [eax], eax
push es
jae 0x43cb87
add byte [eax], al
or bh, byte [ebp - 0xb]
add byte [eax], al
add al, 2
jnp 0x43cb12
add byte [eax], al
add al, 3
sub byte [edx + 0x2a0a0000], dh
add byte [eax], al
add byte [ebx], dl
xor byte [edx], al
add byte [edi], cl
add byte [eax], al
add byte [edx], ah
add byte [ecx], dl
add esi, dword [ebp + 0x27]
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x4016d0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x15c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x120]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x13c], eax
mov eax, dword [0x405008]
mov dword [ebp - 0x1c], eax
xor eax, eax
test ebx, ebx
js 0x401733
xor edx, edx
mov ecx, dword [esi + eax*4]
cmp edx, ecx
jge 0x40171d
mov edx, ecx
add eax, 1
cmp ebx, eax
jge 0x401714
add edx, 1
mov dword [ebp - 0x12c], edx
lea edi, [ebp - 0x120]
test ebx, ebx
mov dword [ebp - 0x120], 0
js 0x401771
xor ecx, ecx
xor edx, edx
xor eax, eax
jmp 0x401752
mov edx, ecx
cmp edx, 0x3f
ja 0x401764
mov ecx, dword [esi + eax*4]
mov dword [ebp + edx*4 - 0x11c], ecx
lea ecx, [edx + 1]
add eax, 1
cmp ebx, eax
jge 0x401750
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
js 0x401840
test ebx, ebx
js 0x401733
xor ecx, ecx
mov dword [ebp - 0x130], ebx
mov ebx, ecx
mov dword [ebp - 0x134], esi
mov dword [esp + 4], edi
mov eax, dword [esi]
mov dword [esp], eax
call sub.WS2_32.dll___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x4017ee
add ebx, 1
add esi, 4
cmp dword [ebp - 0x130], ebx
jge 0x4017ba
mov esi, dword [ebp - 0x134]
mov ebx, dword [ebp - 0x130]
jmp 0x401733
mov eax, dword [ebp - 0x13c]
mov edx, esi
mov dword [esp + 0xc], 0
mov esi, dword [ebp - 0x134]
mov ebx, dword [ebp - 0x130]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x138]
mov dword [esp + 4], eax
mov eax, dword [edx]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
jg 0x401733
mov eax, dword [ebp - 0x1c]
xor eax, dword [0x405008]
jne 0x401845
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00401310
call fcn.00401c94
lea esi, [esi]
Function at 0x401940
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov edx, dword [ebp + 8]
mov eax, dword [0x405008]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x34]
add eax, 0x20
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
nop
mov eax, 4
sub eax, ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], 0
mov dword [esp], edi
add eax, ebx
mov dword [esp + 4], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
mov esi, eax
js 0x401a21
mov edx, dword [ebp - 0x2c]
add ebx, esi
mov dword [esp], 0x2e
mov dword [esp + 4], edx
call sub.msvcrt.dll_fputc
cmp ebx, 3
jle 0x401970
mov edx, dword [ebp - 0x30]
mov edi, dword [edx]
test edi, edi
jle 0x401a0c
xor ebx, ebx
mov eax, edi
mov edx, dword [ebp - 0x34]
sub eax, ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], 0
mov dword [esp], edx
add eax, ebx
mov dword [esp + 4], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
mov esi, eax
js 0x401a21
mov edx, dword [ebp - 0x2c]
add ebx, esi
mov dword [esp], 0x2e
mov dword [esp + 4], edx
call sub.msvcrt.dll_fputc
cmp edi, ebx
jg 0x4019c6
mov edx, dword [ebp - 0x1c]
xor edx, dword [0x405008]
mov eax, edi
jne 0x401a26
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00401310
call fcn.00401c94
nop
lea esi, [esi]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov ecx, dword [0x405008]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
test edi, edi
je 0x401a6c
lea esi, [edx + edi]
mov ecx, eax
movzx ebx, byte [edx]
add edx, 1
mov byte [ecx + 1], 0
mov byte [ecx], bl
add ecx, 2
cmp edx, esi
jne 0x401a56
lea eax, [eax + edi*2]
mov edx, dword [ebp - 0x1c]
xor edx, dword [0x405008]
jne 0x401a7f
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00401c94
lea esi, [esi]
lea edi, [edi]

Function at 0x401b00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [0x405008]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [esp], ebx
call sub.WS2_32.dll_inet_addr
sub esp, 4
cmp eax, 0xffffffff
je 0x401b34
mov edx, dword [ebp - 0xc]
xor edx, dword [0x405008]
jne 0x401b4c
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], ebx
call sub.WS2_32.dll_gethostbyname
sub esp, 4
test eax, eax
je 0x401b51
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x401b24
call fcn.00401c94
mov dword [esp + 4], ebx
mov dword [esp], str._nError:_Unable_to_resolve_hostname___s__n
call sub.msvcrt.dll_printf
mov dword [esp], 1
call sub.msvcrt.dll_exit
nop
nop
nop
Function at 0x401e68
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x401eb4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
test ecx, ecx
jne 0x401ed0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x401f80
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
je 0x401f74
cmp eax, 4
je 0x401f74
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
mov edx, dword [ebp - 0x40]
je 0x401ec5
cmp eax, 4
je 0x401ec5
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e68
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407358
mov ecx, 0x2b0c1b92
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cdf0
mov ecx, 0x74e37fdc
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x492bb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x492bfd
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, reloc.MSVCRT.dll___dllonexit
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x492c03
add eax, 4
pop esi
dec esi
push esi
jne 0x492be5
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0xfa0a89
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [esp + 1]
bsf ecx, edx
jbe 0xfa0aa1
ja 0xfa0aa1
jmp 0xfa0a68
call fcn.00fa0a8b

Function at 0xfa0a8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, dx
mov ah, byte [esp]
jmp 0xfa0b0e
push esi
rcl ax, cl
jmp 0xfa0aa6
jb 0xfa0a73
mov cx, dx
mov ah, byte [esp]
jmp 0xfa0b0e
push edx
setg cl
rdtsc
call fcn.00fa0adf
Function at 0x401a14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x40166e
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push 0x230
mov eax, 0x56553d
call fcn.0053d399
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x230], 0
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x234], eax
call fcn.004013fa
push str.DCEX.Model
lea ecx, [ebp - 0x220]
call fcn.00402358
and dword [ebp - 4], 0
push edi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004018ec
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00402728
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.00401441
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402728
push 1
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 0x598e20
test eax, eax
je 0x401840
push ebx
lea ecx, [ebp - 0x238]
call fcn.00402358
push dword [ebp - 0x228]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004018ec
add esp, 0xc
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.00402728
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00402358
push str.epsonEpson_Scan_2ModelsES
push eax
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 6
call fcn.00401943
push dword [ebp - 0x228]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004018ec
push str.DCP.ini
push eax
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 8
call fcn.00401943
add esp, 0x24
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402728
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.00402728
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00402728
push dword [ebp - 0x220]
call edi
test eax, eax
je 0x401820
push dword [ebp - 0x220]
push 0
push str.DataVersion
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x401820
js 0x401820
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00401441
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00402728
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402728
push ebx
lea ecx, [ebp - 0x22c]
call fcn.00402358
push dword [ebp - 0x228]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004018ec
add esp, 0xc
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00402728
mov ebx, dword [ebp - 0x234]
push dword [ebx]
call edi
test eax, eax
je 0x4018b8
push dword [ebx]
push 0
push str.DataVersion
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4018b8
cmp eax, dword [ebp - 0x230]
jl 0x4018b8
lea eax, [ebp - 0x224]
push eax
mov ecx, ebx
call fcn.00401441
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402728
call fcn.0053d41c
ret 8
Function at 0x4027c5
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push 0xac
mov eax, 0x5654a7
call fcn.0053d399
push 0xf0000000
xor ebx, ebx
push 0x18
push ebx
push ebx
lea eax, [ebp - 0xb8]
push eax
mov esi, ecx
mov byte [ebp - 0xb1], bl
mov dword [ebp - 0xb8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x402872
push 0x2f
mov esi, str...COMMONHash256.cpp
push esi
call fcn.00538be0
pop ecx
pop ecx
test eax, eax
je 0x402815
push 0x2f
jmp 0x402825
push 0x5c
push esi
call fcn.00538be0
pop ecx
pop ecx
test eax, eax
je 0x402830
push 0x5c
push esi
call fcn.00538be0
pop ecx
pop ecx
inc eax
jmp 0x402832
mov eax, esi
push 4
push 0x12
push eax
lea esi, [ebp - 0x60]
call fcn.00404b6f
mov esi, eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_in_AcquireContext_0x_08x__n
push ebx
mov ecx, esi
call fcn.00404c4d
mov esi, eax
call fcn.0040279b
pop ecx
pop ecx
lea ecx, [ebp - 0x60]
or dword [ebp - 4], 0xffffffff
call fcn.00404bdb
jmp 0x402901
push esi
push 0x10
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4028fa
push 0x2f
mov esi, str...COMMONHash256.cpp
push esi
call fcn.00538be0
pop ecx
pop ecx
test eax, eax
je 0x40289c
push 0x2f
jmp 0x4028ac
push 0x5c
push esi
call fcn.00538be0
pop ecx
pop ecx
test eax, eax
je 0x4028b7
push 0x5c
push esi
call fcn.00538be0
pop ecx
pop ecx
inc eax
jmp 0x4028b9
mov eax, esi
push 4
push 0x18
push eax
lea esi, [ebp - 0xb0]
call fcn.00404b6f
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Error_in_CryptGenRandom_0x_08x__n
push ebx
mov ecx, esi
call fcn.00404c4d
mov esi, eax
call fcn.0040279b
pop ecx
pop ecx
lea ecx, [ebp - 0xb0]
jmp 0x402864
mov byte [ebp - 0xb1], 1
cmp dword [ebp - 0xb8], ebx
je 0x402916
push ebx
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 0xb1]
call fcn.0053d41c
ret