joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401088
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x404440
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret
Function at 0x401720
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x4050ff], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401767
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x401fad
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x401fc6
call eax
test eax, eax
jne 0x401fc6
push 0xfffffffffffffffe
jmp 0x401fe0
push 1
push 0x405010
push 0x405008
call fcn.00401b91
add esp, 0xc
test eax, eax
je 0x401fe6
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401b91
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x40200c
mov esi, 0x4049c2
mov cl, 0x20
jmp 0x402015
cmp al, 0x20
ja 0x40201f
inc esi
mov al, byte [esi]
test al, al
jne 0x402010
cmp al, 0x20
jbe 0x402036
mov al, byte [esi]
cmp al, 0x22
jne 0x402028
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x402021
jmp 0x402036
cmp al, cl
ja 0x40203c
inc esi
mov al, byte [esi]
test al, al
jne 0x402031
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x402065
movzx eax, word [ebp - 0x14]
jmp 0x402068
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040209d
pop ecx
pop esi
leave
ret

Function at 0x40209d
Capabilities:
Terminate process

Disassembly:
call fcn.004020e7
push 0
push 0x405018
push 0x405014
call fcn.00401b91
push 0
push 0x405020
push 0x40501c
call fcn.00401b91
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40915c
nop
mov ecx, 0x6efc2b0e
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc_1
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7c3e6f73
nop
nop
nop
nop
test eax, eax
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4f982a4d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x17175402
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x414dd2
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edi
mov edx, 0x29c39769
push edx
mov esi, dword [esp]
add esp, 4
add ecx, 4
sub edx, 0x1f3e1cc1
sub eax, edx
sub eax, esi
cmp ecx, ebx
jne fcn.00414dd2
or esi, esi
add eax, 0xf948195b
dec edx
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2c3535bd
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..7LWLf
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4c7d47b2
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x703c7b60
Capabilities:
Get graphical window text

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp eax, 1
je 0x703c7bb0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.user32.dll_DefWindowProcW]
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], ebx
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
sub esp, 4
lea eax, [edi + edi]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x703c7c3d
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
call sym.atl90.dll_AtlAxCreateControlLicEx
sub esp, 0x20
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, 1
jmp 0x703c7b9c
Function at 0x703c7cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x24], eax
test byte [0x703cd028], 8
jne 0x703c7da0
mov dword [esp + 4], ebx
mov dword [esp + 8], 5
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x703c7e20
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x703c7e20
mov dword [esp], eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.kernel32.dll_LockResource]
mov ecx, dword [ebp - 0x28]
sub esp, 4
test eax, eax
mov edi, eax
je 0x703c7e60
call sym._AX_ConvertDialogTemplate
mov edi, eax
test eax, eax
je 0x703c7d7b
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_CreateDialogIndirectParamW]
sub esp, 0x14
mov esi, eax
mov dword [esp], edi
mov edi, esi
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeResource]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
test ebx, ebx
je 0x703c7e50
mov eax, ebx
shr eax, 0x10
je 0x703c7e38
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x703cf73b
test edx, edx
jne 0x703c7dd9
mov eax, ebx
call sym._wine_dbgstr_wn.part.0.constprop.0
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 0xc], str.__p__s__p__p__Ix__n
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], str.AtlAxCreateDialogW
mov dword [esp + 0x18], edx
mov dword [esp + 4], 0x703cd028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x703c7ce8
lea esp, [ebp - 0x10]
xor edi, edi
pop ecx
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
movzx eax, bx
mov dword [esp], 0x703cf745
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x703c7dd9
mov eax, 0x703cf734
jmp 0x703c7dd9
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_FreeResource]
sub esp, 4
jmp 0x703c7d87
Function at 0x703c8180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov edx, dword [ecx + 4]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
mov edi, dword [ecx + 0x10]
test byte [0x703cd028], 8
jne 0x703c8250
mov dword [esp + 8], 5
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x703c8240
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x703c8240
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockResource]
sub esp, 4
call sym._AX_ConvertDialogTemplate
mov edx, eax
test eax, eax
je 0x703c8240
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_DialogBoxIndirectParamW]
mov edx, dword [ebp - 0x20]
sub esp, 0x14
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
test edx, edx
je 0x703c82f8
mov eax, edx
shr eax, 0x10
je 0x703c82d8
mov dword [esp], edx
mov dword [ebp - 0x20], edx
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x20]
mov ecx, eax
sub esp, 8
mov eax, 0x703cf73b
test ecx, ecx
jne 0x703c828e
mov eax, edx
call sym._wine_dbgstr_wn.part.0.constprop.0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.instance__p__name__s__owner__p__proc__p__param__Ix_n
mov dword [esp + 8], str.AtlAxDialogBoxW
mov dword [esp + 4], 0x703cd028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
mov edx, dword [ebp - 0x20]
jmp 0x703c81b2
movzx eax, dx
mov dword [esp], 0x703cf745
mov dword [esp + 4], eax
mov dword [ebp - 0x20], edx
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp - 0x20]
jmp 0x703c828e
mov eax, 0x703cf734
jmp 0x703c828e
Function at 0x703ca2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
sub esp, 0xc
test eax, eax
je 0x703ca450
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
je 0x703ca410
mov dword [esp + 4], eax
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov edi, eax
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
test edi, edi
je 0x703ca480
mov dword [ebp - 0x28], eax
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], edi
mov dword [ebp - 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x18
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [ebp - 0x24], ecx
mov dword [esp + 4], 2
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [esp + 8], edi
mov dword [ebp - 0x24], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov ecx, dword [ebp + 0xc]
sub esp, 0x18
mov word [edi + edx*2], ax
mov edx, edi
mov eax, esi
call sym._string_register
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x703ca433
test byte [0x703cd038], 4
jne 0x703ca4b8
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x703cd038], 4
jne 0x703ca4e8
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovg esi, eax
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
test byte [0x703cd038], 4
je 0x703ca41d
mov dword [esp + 0xc], str.could_not_load_resource_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x703cd038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703ca41d
mov dword [esp + 0xc], str.Could_not_find_source_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x703cd038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703ca41d
mov dword [esp + 0xc], str.Could_not_load_resource_file_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x703cd038
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_2
jmp 0x703ca45d
Function at 0x703cba10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x703cba6b
cmp byte [esi + ebx - 1], 0xa
je 0x703cba3f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x703dd0c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x703cc4c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x703dd0e0]
test eax, eax
je 0x703cc578
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x703cc500
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x703cc4ec
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x703cc5ad
mov dword [esp + 4], 0x703d78fc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x703dd0e0], eax
sub esp, 8
test eax, eax
jne 0x703cc4dd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x703cc4ee
Function at 0x703cc5c0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x703cc758
mov eax, dword [esi]
test eax, eax
je 0x703cc740
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x703cc768
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x703cc730
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x703cc6f6
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x703cc630
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x703cc75a
Function at 0x4036e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
lea ecx, [esp]
call fcn.00402ac0
push 0
push 0
push str.jklhjkluktyuity
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
test eax, eax
je 0x40371c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401360
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x10
jb 0x403753
mov edx, dword [esp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403749
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403766
push ecx
push edx
call fcn.004039f7
add esp, 8
mov ecx, dword [esp + 0x44]
xor eax, eax
xor ecx, esp
call fcn.004039b9
mov esp, ebp
pop ebp
ret 0x10
call fcn.00406a17
int3

Function at 0x404272
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4042b1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4042b1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4042b1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4042b1
cmp dword [ecx + 0x74], 0xe
jbe 0x4042b1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40ee60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ee8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ee8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x27f83218
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2cc822de
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219