joyce8/EMBER2024-capa huggingface dataset:
Function at 0x506300
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x5063a3
test eax, eax
jbe 0x5063a3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x5063a3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x50634e
xor esi, esi
jmp 0x506354
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x50637f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00511bb0
add esi, eax
push esi
mov ebx, esi
call fcn.00511bb0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x506360
pop ebp
test edi, edi
pop edi
jne 0x5063a3
test ebx, ebx
je 0x5063a3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0052a800
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x5064c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5065dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5065dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0053c6df
mov esi, eax
test esi, esi
je 0x5065dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x5065dd
mov ecx, esi
call fcn.00506450
cmp edi, eax
jge 0x5065dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x506563
mov dword [esp + 0x34], 1
jmp 0x5065be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x5065dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00505a00
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x513c70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.0051a080
mov ebp, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebp
push 0
push 0
push eax
push 0xaa2e88
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
cmp edi, 0x20
ja 0x513d69
lea ecx, [esp + 0x10]
push ecx
push str..htm
push accept
mov ecx, esi
call fcn.004a4470
test eax, eax
jne 0x513d69
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push accept
mov ecx, esi
call fcn.004a4470
test eax, eax
jne 0x513d69
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.0052b010
mov esi, eax
add esp, 8
test esi, esi
jne 0x513d3a
lea eax, [esp + 0x10]
push 0xaa2e60
push eax
call fcn.0052b010
mov esi, eax
add esp, 8
test esi, esi
jne 0x513d3a
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x513d3d
mov byte [esi], 0
push 0xaa2628
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x519fc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x54af18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x51a070
mov eax, dword [0xaa55d0]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0053b05c
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0053b0ab
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0053b008
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x51a057
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x51a057
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0053ac78
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x51d170
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x54b3a0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x51d317
mov ecx, dword [0xaa55d0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x51d26c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0051be90
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0053ad65
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0053ac78
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xaa2628
call fcn.0053ace6
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.0051c250
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0053ad65
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0053ac78
lea ecx, [esp + 0xc]
call fcn.0053b140
mov ecx, dword [esp + 0xc]
push 0xaa3064
push ecx
call fcn.00529ec4
add esp, 8
test eax, eax
je 0x51d294
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x51d1cd
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0053ac78
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0053ac78
jmp 0x51d31b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.0051cf10
test eax, eax
push 0
je 0x51d2ff
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.0051b5b0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x51d2e5
cmp eax, 0x64
jg 0x51d2d3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x51d270
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x51d270
cmp eax, 0x64
jge 0x51d26c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x51d270
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.0051b5b0
mov esi, eax
jmp 0x51d270
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x51d325
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x524ed0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0xa818c0
push 1
push 0
push 0xa818b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x524efe
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0xa81960
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x524f32
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8

Function at 0x53d083
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x53d0bb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0053b0d3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0053b0ab
jmp 0x53d0c7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x53e779
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x53e7bb
call fcn.005445a4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x53e7bb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x53e7b2
xor eax, eax
jmp 0x53e7c3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0053e7c9
pop edi
pop esi
pop ebx
ret 4

Function at 0x544ad4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x544b02
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x544b20
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00544a3a
jmp 0x544b20
mov eax, dword [esi + 0x14]
test eax, eax
je 0x544b20
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00544a3a
test edi, edi
mov eax, edi
jne 0x544b0a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402ee4
pop dword [ebp - 0xc]
mov eax, 0xb1491c91
add eax, 0x4ef71253
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5360c133
sub dword [ebp - 0x1c], 0x50e7be8
mov dword [ebp - 0x18], 0x9fc606bd
add dword [ebp - 0x18], 0x926d4588
mov dword [ebp - 0x14], 0x912f5dd7
sub dword [ebp - 0x14], 0x44e319a9
mov dword [ebp - 0x10], 0x13be3264
sub dword [ebp - 0x10], 0x13be3264
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x6ba61864
sub eax, 0x6b659760
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xcb840ca9
sub dword [ebp - 0x1c], 0x5711a353
mov dword [ebp - 0x18], 0x4d37fe65
sub dword [ebp - 0x18], 0xbcb9cf0
mov dword [ebp - 0x14], 0x68787c64
add dword [ebp - 0x14], 0xfaf6f008
mov dword [ebp - 0x10], 0xb238ba
sub dword [ebp - 0x10], 0xb238ba
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x29ed5982
sub eax, 0x29acd882
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37043
push 0
call eax
mov ecx, 0x47ec
xor edi, edi
add edi, eax
mov esi, 0x955a2fe5
sub esi, 0x95134be5
add esi, dword [ebp - 0xc]
mov ebx, 0x67b8c7f9
sub dword [ebp - 4], ecx
mov edx, dword [esi]
xor dword [ebp - 4], 0xca344278
xor edx, ebx
sub dword [ebp - 8], edi
mov dword [edi], edx
mov dword [ebp - 8], 0x8ce42f4c
add edi, 0xa9e7d622
sub edi, 0xa9e7d61e
add esi, 0x7b8c5007
sub esi, 0x7b8c5003
loop 0x402ffc
add eax, 0xfa98fc5e
sub eax, 0xfa97e9db
mov ebx, eax
add eax, 5
mov ecx, 0x1ca305c4
sub ecx, 0x1c6305c4
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x405f41
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x426dc8
push 0x40a5a4
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.kernel32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405f8f
push 1
push 0
push esi
call fcn.00405de7
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x4060ae
cmp eax, edi
jg 0x4060ae
mov esi, 0x4275c8
push edi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x4060ae
cmp eax, edi
jg 0x4060ae
push esi
push ebx
push str._ls_ls_r_n
push 0x4269c8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42a250]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00402ed5
push 4
push 0xc0000000
push esi
call fcn.00405de7
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x4060ae
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4060a7
push edi
push esi
push ebp
call fcn.00402ed5
test eax, eax
je 0x4060a7
push str._Rename__r_n
push esi
call fcn.00402ed5
test eax, eax
jne 0x406045
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40607a
add eax, 0xa
push 0x40a588
push eax
call fcn.00402ed5
mov ebp, eax
test ebp, ebp
je 0x406076
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406067
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406061
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x40607c
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4269c8
push eax
call fcn.00405da2
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00402ed5
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4060b3
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x4060d6
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405f41
pop ecx
pop ecx
inc dword [0x42a2d0]
ret 8

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x39fb54ca
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x6dd312db
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1b7725d1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x61906db
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x417f85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x417f94
pop dword [ebp - 0x18]
mov eax, 0xad72315d
add eax, 0x52cf4e37
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x3d091d72
add dword [ebp - 0x28], 0x114927d9
mov dword [ebp - 0x24], 0x8e002de3
add dword [ebp - 0x24], 0xa4331e62
mov dword [ebp - 0x20], 0x622475a2
sub dword [ebp - 0x20], 0x15d83174
mov dword [ebp - 0x1c], 0x2af479c6
sub dword [ebp - 0x1c], 0x2af479c6
lea eax, [ebp - 0x28]
push eax
mov eax, 0xa1d1fcbb
sub eax, 0xa18fcc47
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x820e6def
add dword [ebp - 0x28], 0xf263fb67
mov dword [ebp - 0x24], 0x23d8caed
add dword [ebp - 0x24], 0x1d939688
mov dword [ebp - 0x20], 0x5cd29f4b
add dword [ebp - 0x20], 0x69ccd21
mov dword [ebp - 0x1c], 0x27fb21f9
add dword [ebp - 0x1c], 0xd804de07
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xda069ead
sub eax, 0xd9c46d89
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e226
push 0
call eax
mov ecx, 0xfdee3afa
sub ecx, 0xfdedf1aa
xor edx, edx
add edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x18]
mov edi, 0xfc8a2b5b
add edi, 0x33bc75ea
xor dword [ebp - 0x10], 0x857c7b9c
mov esi, dword [ebx]
sub dword [ebp - 8], 0xce2bdda1
sub esi, edi
xor dword [ebp - 4], 0xdb29af24
mov dword [edx], esi
xor dword [ebp - 4], edi
add edx, 4
add ebx, 4
loop 0x4180b2
add eax, 0x11813
mov ebx, eax
add eax, 0x1e3842dd
add eax, 0xe1c7bd28
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40288e
pop dword [ebp - 0x4c]
mov eax, 0x495457fe
sub eax, 0x49142f70
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x725c59a7
add dword [ebp - 0x5c], 0xdbf5eba4
mov dword [ebp - 0x58], 0x9fdf0773
add dword [ebp - 0x58], 0x925444d2
mov dword [ebp - 0x54], 0xf34a2392
add dword [ebp - 0x54], 0x5902209c
mov dword [ebp - 0x50], 0x4cfb84aa
add dword [ebp - 0x50], 0xb3047b56
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x37c028a8
sub eax, 0x377fb844
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xc5ac8a90
sub dword [ebp - 0x5c], 0x513a213a
mov dword [ebp - 0x58], 0xb760ef8a
sub dword [ebp - 0x58], 0x75f48e15
mov dword [ebp - 0x54], 0x318ec9c1
sub dword [ebp - 0x54], 0xce1f5d55
mov dword [ebp - 0x50], 0x113ff671
sub dword [ebp - 0x50], 0x113ff671
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2c2fb3f8
add eax, 0xd410bcb0
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x34dca
push 0
call eax
mov ecx, 0x4110
xor esi, esi
add esi, eax
mov edi, 0xf2684ae1
add edi, 0xdd8b51f
add edi, dword [ebp - 0x4c]
mov edx, 0xa6b87db
add edx, 0x855b85d2
sub dword [ebp - 0x40], 0x6cf474b2
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0x7e36fba9
sub ebx, edx
add dword [ebp - 0x48], 0x3b45783d
mov dword [esi], ebx
add esi, 0x8041cef4
sub esi, 0x8041cef0
add edi, 0xb1a743c9
add edi, 0x4e58bc3b
loop 0x4029ac
add eax, 0xf713
mov ebx, eax
add eax, 0xd2eed3f8
sub eax, 0xd2eed3f3
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x813058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008131a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x81307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81306a
add dl, dl
jne 0x813089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8130dc
xor eax, eax
add dl, dl
jne 0x813096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81317d
add dl, dl
jne 0x8130a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8130b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8130bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8130c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8130d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x813075
mov eax, 1
add dl, dl
jne 0x8130ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8130f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8130e1
sub eax, ebx
mov ebx, 1
jne 0x813128
mov ecx, 1
add dl, dl
jne 0x81310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x813119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x813105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x813075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x81313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x81314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x813136
cmp eax, 0x7d00
jae 0x81316d
cmp eax, 0x500
jb 0x813168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x813075
cmp eax, 0x7f
ja 0x813170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x813075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x81319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x813075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10