joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044f1a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044f220
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044f220
lea ecx, [esi + 0xc]
call fcn.00463ef1
lea ecx, [esi + 0x10]
call fcn.00463ef1
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00451a50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00451a50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00451a50
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00463f66
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00463f66
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x450298
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4727a8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4502a8
call fcn.004507c0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x45038b
cmp byte [edi], 0
je 0x45038b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4502cd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0044efc0
test eax, eax
jne 0x4502ed
push 0x59e4b8
lea ecx, [esi + 0x38]
call fcn.004640a3
jmp 0x45038b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0044f010
test eax, eax
jne 0x45031c
mov ecx, esi
call fcn.0044f110
push edi
add esi, 0x38
push 0x59e494
push esi
call fcn.00461d6a
add esp, 0xc
jmp 0x45038b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00451040
test eax, eax
je 0x450384
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00450460
test eax, eax
jne 0x4503a0
push edi
lea eax, [esi + 0x38]
push 0x59e470
push eax
call fcn.00461d6a
add esp, 0xc
mov ecx, esi
call fcn.004507c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x450448
mov ecx, dword [0x59e7b8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00461d6a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0044f0c0
test eax, eax
jne 0x45040a
push 0x59e454
lea ecx, [esi + 0x38]
call fcn.004640a3
jmp 0x45041a
push 0xfa
mov ecx, esi
call fcn.00451040
test eax, eax
jne 0x450437
mov ecx, esi
call fcn.004507c0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00463f66
jmp 0x45038b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00463f66
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x46630a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x466342
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004643c1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464399
jmp 0x46634e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4679fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x467a3e
call fcn.0046d574
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x467a3e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x467a35
xor eax, eax
jmp 0x467a46
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00467a4c
pop edi
pop esi
pop ebx
ret 4

Function at 0x46daa4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46dad2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46daf0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046da0a
jmp 0x46daf0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46daf0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046da0a
test edi, edi
mov eax, edi
jne 0x46dada
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4017c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Extractor.txt
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040e280
add esp, 8
push 0x43e0d8
lea edx, [ebp - 0x104]
push edx
call fcn.0040e251
add esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.0040e1e4
add esp, 8
mov edx, dword [ebp - 0x108]
push edx
call fcn.0040e167
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40184a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401870
xor al, al
jmp 0x401872
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x401876
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4305ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
call fcn.004218db
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040184a
add esp, 4
and eax, 0xff
test eax, eax
je 0x4018e3
mov byte [ebp - 0x214], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x214]
jmp 0x401b14
push 4
push 0
lea edx, [ebp - 0x204]
push edx
call fcn.0040e060
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0040e6a0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.0040e360
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0040e6a0
add esp, 4
mov byte [ebp + eax - 0x204], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x208], 0xffffffff
je 0x40196c
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x208]
add edx, 1
push edx
push 0x5c
lea ecx, [ebp - 0x20c]
call fcn.00421d9c
mov dword [ebp - 0x208], eax
jmp 0x40193b
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401996
mov byte [ebp - 0x218], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x218]
jmp 0x401b14
cmp dword [ebp - 0x10], 2
je 0x4019ac
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x204], 0
jmp 0x401a3d
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401a19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x50
jne 0x4019f5
mov byte [ebp - 0x21c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x21c]
jmp 0x401b14
mov byte [ebp - 0x220], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x220]
jmp 0x401b14
mov byte [ebp - 0x224], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x224]
jmp 0x401b14
lea edx, [ebp - 0x204]
push edx
call fcn.0040184a
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401ac4
lea eax, [ebp - 0x204]
push eax
call fcn.00401876
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401a91
mov byte [ebp - 0x228], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x228]
jmp 0x401b14
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401ac2
mov byte [ebp - 0x22c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x22c]
jmp 0x401b14
jmp 0x401af5
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401af5
mov byte [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x230]
jmp 0x401b14
mov byte [ebp - 0x234], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.0042186d
mov al, byte [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40300e
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 5
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40308a
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
call sub.ADVAPI32.dll_CheckTokenMembership
test eax, eax
jne 0x403080
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x407ebf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x448
push edi
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x220], 0
push 0x20019
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x454]
call fcn.004081e6
test eax, eax
jne 0x407f18
xor eax, eax
jmp 0x408078
mov byte [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x427]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x430], 0x208
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x10], 0
jmp 0x407f80
mov eax, dword [ebp - 0x42c]
add eax, 1
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x10], 0
jne 0x408061
cmp dword [ebp - 0x10], 0x103
je 0x408061
mov dword [ebp - 0x430], 0x208
mov dword [ebp - 0x21c], 0x208
push 0
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x428]
push edx
push 0
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40805c
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x440]
call fcn.00404130
mov dword [ebp - 4], 0
lea edx, [ebp - 0x440]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.004096e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.004033a0
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x450]
call fcn.00404130
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x450]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.004096e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.004033a0
jmp 0x407f71
lea edx, [ebp - 0x220]
push edx
mov ecx, dword [ebp - 0x454]
call fcn.0040823c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x408388
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret 8
Function at 0x40bb0d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x26], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 2
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esp, ebp
pop ebp
ret

Function at 0x40bb39
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x26], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 3
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esp, ebp
pop ebp
ret

Function at 0x40bb65
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x26], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 1
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esp, ebp
pop ebp
ret

Function at 0x417450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4417e0
cmp edx, dword [eax]
je 0x417472
add eax, 8
inc ecx
cmp eax, 0x441870
jl 0x417463
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4417e0]
jne 0x4175a0
mov eax, dword [0x4448a4]
cmp eax, 1
je 0x41757a
test eax, eax
jne 0x4174a3
cmp dword [0x43f068], 1
je 0x41757a
cmp edx, 0xfc
je 0x4175a0
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4174da
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040e270
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e6a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41751d
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e6a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x435a8c
push edi
call fcn.0040e960
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040e270
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e280
lea eax, [ebp - 0xa0]
push 0x435a6c
push eax
call fcn.0040e280
push dword [esi + 0x4417e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e280
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00419d52
add esp, 0x2c
pop edi
jmp 0x4175a0
lea eax, [ebp + 8]
lea esi, [esi + 0x4417e4]
push 0
push eax
push dword [esi]
call fcn.0040e6a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x423a01
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x423a39
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00421d14
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00421cec
jmp 0x423a45
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x425803
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x425845
call fcn.0042e96a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x425845
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42583c
xor eax, eax
jmp 0x42584d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00425853
pop edi
pop esi
pop ebx
ret 4
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x67f66a9a
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6f275590
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4011bb
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3f8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s__s
lea eax, [ebp - 0x400]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebp + 8]
call sub.KERNEL32.dll_SetCurrentDirectoryA
or eax, eax
jne 0x401227
call fcn.00401069
mov ecx, eax
push dword [ebp + 8]
push ecx
push str.Error_changing_directory._r_n_s_r_nDirectory:_r_n__s_
lea eax, [ebp - 0xc00]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x30
push 0x4033cf
lea eax, [ebp - 0xc00]
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0
leave
ret 0xc
mov edi, 0x4034c4
mov ecx, 0x44
xor eax, eax
rep stosb byte es:[edi], al
mov dword [0x4034c4], 0x44
lea eax, [ebp - 0x400]
push eax
pop dword [0x4034d0]
mov dword [0x4034f0], 1
mov word [0x4034f4], 0
push 0x4034b4
push 0x4034c4
push 0
push 0
push 0x230
push 1
push 0
push 0
lea eax, [ebp - 0x400]
push eax
push 0
call sub.KERNEL32.dll_CreateProcessA
or eax, eax
jne 0x4012ce
call fcn.00401069
mov ecx, eax
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
push ecx
push str._s_r_nCommand_line:_r_n__s__r_n_r_nworking_directory:_r_n__s_
lea eax, [ebp - 0xc00]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0x30
push 0x4033cf
lea eax, [ebp - 0xc00]
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0
leave
ret 0xc
mov eax, 1
leave
ret 0xc
Function at 0x4013c8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffeffc
push 0x400
lea eax, [ebp - 0xc00]
push eax
call fcn.00401380
push 0x10b
push 0x403193
call fcn.0040131d
push 0x3d
push 0x40313b
call fcn.0040131d
push 0x3d
push 0x4032b9
call fcn.0040131d
mov dword [0x403508], 0
push 0x400
lea eax, [ebp - 0x400]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x400
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.dll_lstrcpynA
cmp byte [0x403343], 0x20
je 0x401469
cmp byte [0x403343], 0
je 0x401469
push 0
lea eax, [ebp - 0x1000]
push eax
call sub.USER32.dll_FindWindowA
or eax, eax
je 0x401469
mov eax, 0xa
leave
ret
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x800]
push eax
push 0x400
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.dll_GetFullPathNameA
mov eax, dword [ebp - 0x1004]
mov byte [eax - 1], 0
lea eax, [ebp - 0x800]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
push 0x10
push 0x10
push 0x10
push 1
push 0x4032b9
push dword [0x4034a0]
call sub.USER32.dll_LoadImageA
or eax, eax
jne 0x4014c6
push 0x7f05
push 0
call sub.USER32.dll_LoadIconA
mov dword [0x4034a8], eax
call sub.USER32.dll_CreatePopupMenu
mov dword [0x4034b0], eax
push str.About
push 0x1770
push 0x400
push 0
push dword [0x4034b0]
call sub.USER32.dll_InsertMenuA
push 0
push 0
push 0xc00
push 1
push dword [0x4034b0]
call sub.USER32.dll_InsertMenuA
push str.Show_Hide
push 0x177a
push 0x400
push 2
push dword [0x4034b0]
call sub.USER32.dll_InsertMenuA
mov edx, 0x400
cmp byte [0x40335f], 0x20
je 0x40153d
cmp byte [0x40335f], 0
je 0x40153d
or edx, 1
push str.Terminate
push 0x1a0a
push edx
push 3
push dword [0x4034b0]
call sub.USER32.dll_InsertMenuA
push 0x10
push 0
push dword [0x4034a8]
lea eax, [ebp - 0x1000]
push eax
push 0x401757
call fcn.004016c1
push 0
push dword [0x4034a0]
push 0
push 0
push 0x14
push 0x32
push 0
push 0
push 0xcf0000
push str.Starter
lea eax, [ebp - 0x1000]
push eax
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x4034ac], eax
lea eax, [ebp - 0xc00]
push eax
push 0x403193
push 0x40313b
call fcn.004011bb
or eax, eax
jne 0x4015c2
mov eax, 1
leave
ret
push 0
push 0x64
push 0x64
push dword [0x4034ac]
call sub.USER32.dll_SetTimer
push 0
push 0x3e8
push 0x3e8
push dword [0x4034ac]
call sub.USER32.dll_SetTimer
push 0x403193
push dword [0x4034a8]
push 0
push dword [0x4034ac]
nop
nop
nop
nop
nop
call fcn.00401724
call fcn.004012d7
push 0x403193
push dword [0x4034a8]
push 2
push dword [0x4034ac]
nop
nop
nop
nop
nop
mov eax, 0
leave
ret