joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a47d7e7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x2a47d810
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x2a47d823
and eax, 0xffff
or eax, 0x80070000
jmp 0x2a47d823
or eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x2a47d7fa
xor eax, eax
pop ebp
ret 8

Function at 0x2a47d82c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x2a47d855
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x2a47d86c
and eax, 0xffff
or eax, 0x80070000
jmp 0x2a47d86c
mov ecx, dword [ebp + 0xc]
not ecx
and ecx, eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x2a47d83f
xor eax, eax
pop ebp
ret 8

Function at 0x2a47e259
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x214
mov eax, 0x2a49fde8
call fcn.2a40924e
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
mov esi, 0x104
push esi
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x220], eax
test eax, eax
je 0x2a47e34a
cmp eax, esi
ja 0x2a47e34a
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call edi
cmp eax, 0xffffffff
je 0x2a47e2b4
test al, 0x10
je 0x2a47e2b4
mov eax, dword [ebp - 0x220]
jmp 0x2a47e34c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.2a402035
add esp, 0xc
push 0x2a47e56c
lea ecx, [ebp - 0x220]
call fcn.2a40bedd
and dword [ebp - 4], 0
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.2a40caf9
push dword [ebp - 0x220]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x218]
push eax
call edi
cmp eax, 0xffffffff
jne 0x2a47e354
cmp dword [ebp - 0x21c], 0
je 0x2a47e34a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2a47e518
mov ecx, dword [ebp - 0x21c]
call fcn.2a48900e
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call fcn.2a4194f9
xor eax, eax
call fcn.2a40cba9
ret 8
test al, 0x10
jne 0x2a47e369
cmp dword [ebp - 0x21c], 0
je 0x2a47e34a
push eax
push 0x2a47e4a8
jmp 0x2a47e32d
lea eax, [ebp - 0x218]
push eax
push esi
push ebx
call fcn.2a40a595
xor edi, edi
cmp eax, edi
jge 0x2a47e38d
cmp dword [ebp - 0x21c], edi
je 0x2a47e34a
push eax
push 0x2a47e438
jmp 0x2a47e32d
lea eax, [ebp - 0x220]
push eax
push esi
push ebx
mov dword [ebp - 0x220], edi
call fcn.2a47dcbe
cmp eax, edi
jge 0x2a47e2a9
cmp dword [ebp - 0x21c], edi
je 0x2a47e34a
push eax
push 0x2a47e3c0
jmp 0x2a47e32d
Function at 0x2a47ea5e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
and ebx, 0x8000
neg ebx
sbb ebx, ebx
push 4
inc ebx
pop eax
inc ebx
call fcn.2a4095c0
mov dword [ebp - 0x10], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x2a47ebb0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
and dword [ebp - 8], 0
mov edi, dword [ebp - 0x58]
mov esi, ebx
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
mov dword [ebp - 0x14], edi
cmp ebx, 2
jne 0x2a47eb21
and dword [ebp - 0xc], 0
push 0x2a47ebf8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x2a47eaf8
push 0x2a47ebdc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x2a47eb21
push 0x2a47ebc4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x2a47eb21
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
call eax
cmp eax, 1
jne 0x2a47eb21
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x2a47eb21
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
lea eax, [edi - 1]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.2a47ea32
add esp, 0xc
test eax, eax
jl 0x2a47ebb0
mov eax, dword [ebp - 0xc]
not eax
and dword [ebp - 8], eax
je 0x2a47eb59
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 8]
call fcn.2a47ea32
add esp, 0xc
test eax, eax
jl 0x2a47ebb0
lea eax, [edi + edi]
cmp dword [ebp - 8], eax
jae 0x2a47eb64
mov dword [ebp - 8], eax
dec edi
not edi
and edi, dword [ebp - 0x10]
sub edi, dword [ebp - 8]
cmp ebx, 1
jne 0x2a47eb77
push 0x11
pop eax
jmp 0x2a47eb7a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add eax, ecx
cmp edi, eax
jb 0x2a47ebb0
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x2a47ebb0
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x2a47ebb0
xor eax, eax
inc eax
jmp 0x2a47ebb2
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2a401bd9
leave
ret
Function at 0x2a482a05
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x2a482a46
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x2a482a1f
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x2a482a64
dec esi
je 0x2a482a5b
dec esi
jne 0x2a482a69
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x2a486da5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x2a486df9
push 3
lea eax, [ebp - 0x44]
push 0x2a486e0c
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.2a401bd9
leave
ret

Function at 0x2a486e17
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x2a55c45c]
jne 0x2a486eb2
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x2a486fa8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2a486eb1
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x2a487060
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x2a486eb1
push 3
push dword [esi*8 + 0x2a486ec8]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x2a486ea3
inc esi
cmp esi, 0x1c
jae 0x2a486eb1
jmp 0x2a486e82
mov ax, word [esi*8 + 0x2a486ecc]
mov word [0x2a55c45c], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x2a55c45c]
xor ecx, ebp
call fcn.2a401bd9
leave
ret

Function at 0x2a4884fa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x2a488538
cmp byte [edx], 0
je 0x2a488538
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x2a488511
sub eax, esi
pop esi
cmp eax, 0x104
jae 0x2a488538
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x2a488538
test al, 0x10
jne 0x2a488538
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4
Function at 0x2a488543
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x2a488588
cmp word [edx], 0
je 0x2a488588
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x2a48855b
sub eax, esi
sar eax, 1
pop esi
cmp eax, 0x104
jae 0x2a488588
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x2a488588
test al, 0x10
jne 0x2a488588
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x2a488615
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.msvcrt.dll_iswalpha]
test eax, eax
setne byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
pop ecx
je 0x2a48868d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x5c3a63
push eax
mov byte [ebp + 8], bl
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
setne byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
je 0x2a48868d
mov eax, dword [ebp - 4]
mul dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push edx
push eax
call fcn.2a42f315
test edx, edx
ja 0x2a488680
cmp eax, 0xffffffff
jbe 0x2a488688
mov eax, dword [ebp + 0xc]
or dword [eax], 0xffffffff
jmp 0x2a48868d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov al, byte [ebp + 0xb]
pop ebx
leave
ret 8

Function at 0x2a489a91
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2a55c6b0]
test esi, esi
jne 0x2a489b33
push ebx
lea eax, [ebp - 8]
push eax
call fcn.2a4284ce
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ebp - 8]
inc bl
call fcn.2a40567c
test bl, bl
pop ebx
mov esi, 0x2a55c670
je 0x2a489b20
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2a489b48
push dword [ebp - 4]
mov dword [ebp - 8], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2a489b08
cmp dword [ebp - 0xc], 1
je 0x2a489b15
push 0x2a489b38
push 0x20
push esi
call fcn.2a40a595
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2a489b2d
push 0x2a489b38
push 0x20
push esi
call fcn.2a40a595
mov dword [0x2a55c6b0], esi
mov eax, esi
pop esi
leave
ret
Function at 0x2a48cf2b
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x118]
push eax
mov esi, ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x2a48cfbe
cmp dword [ebp - 0x114], 5
jb 0x2a48cfbe
cmp dword [esi + 0x10], 0
jne 0x2a48cfab
push 0x2a48cfd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x18], eax
test eax, eax
je 0x2a48cfbe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2a48cfe0
push eax
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x2a48cfbe
push 0x2a48cffc
push dword [esi + 0x18]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x2a48cfbe
call dword [esi + 0x10]
movzx edi, ax
call dword [esi + 0x14]
cmp di, ax
je 0x2a48cfbe
mov ax, di
jmp 0x2a48cfc0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2a401bd9
leave
ret
Function at 0x12b4aec
Capabilities:
Encode data using xor

Disassembly:
jmp 0x12b4af6
pushal
call 0x12b4afc
pop ebp
sub ebp, 0x10
sub ebp, 0xeb4aec
jmp 0x12b4b12
mov eax, 0xeb4aec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x10ba6843
xor byte [eax], dl
inc eax
dec ecx
jne 0x12b4b29
jmp 0x12b4b3c
enter 0xffffffffffffc88e, 0xffffffffffffffca
jg 0x12b4b85
inc ebx
inc ebx
ret 0xbb82
cmp al, 0xc4
cmc
stosd dword es:[edi], eax
inc esi
inc ebx
inc ebx
inc ebx
stosb byte es:[edi], al
insd dword es:[edi], dx
inc ebx
inc ebx
inc ebx
push ss
enter 0xffffffffffffc8af, 0xffffffffffffffc6
dec ebx
inc ebx
inc ebx
inc ebx
enter 0x4fd6, 0x43
inc ebx
inc ebx
enter 0x53ce, 0x43
inc ebx
inc ebx
sub byte [edx - 0x3fbe8dbf], 0x81
inc edi
or cl, byte [esi + eax*8 - 0x49]
mov esp, 0x6fc8bcbc
into
daa
inc edi
or dword [edi + 0x43], 0x4767cfc8
inc ebx
inc ebx
inc ebx
sub ebp, dword [ebx + 0x77]
arpl word [ebx + 0x2b], ax
xchg dword [ebp - 0x78], edx
inc ebx
inc edx
outsd dx, dword [esi]
into
daa
mov edi, 0xab674fca
inc esi
inc ebx
inc ebx
inc ebx
stosb byte es:[edi], al
jl 0x12b4c12
inc ebx
inc ebx
push ss
enter 0xffffffffffffbcaf, 0x36
dec edi
mov esp, 0x31ab4b36
inc ebx
inc ebx
inc ebx
enter 0x4bfe, 0x43
inc ebx
inc ebx
jo 0x12b4b73
ret 0x99b1
inc ebx
inc ebx
ret

Function at 0x430007
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x697434ac
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x588a11d2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x415100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40e015
lea edi, [esi - 0xd015]
push edi
or ebp, 0xffffffff
jmp 0x415122
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415129
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415118
mov eax, 1
add ebx, ebx
jne 0x41513b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415130
jne 0x41514c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415130
xor ecx, ecx
sub eax, 3
jb 0x415160
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4151d2
mov ebp, eax
add ebx, ebx
jne 0x41516b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41519c
inc ecx
add ebx, ebx
jne 0x415188
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41517d
jne 0x415199
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41517d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4151bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4151ad
jmp 0x41511e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4151bc
add edi, ecx
jmp 0x41511e
pop esi
mov edi, esi
mov ecx, 0x266
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4151da
cmp byte [edi], 2
jne 0x4151da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4151df
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41524e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41520c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15068]
or eax, eax
je 0x415248
mov dword [ebx], eax
add ebx, 4
jmp 0x415229
call dword [esi + 0x1506c]
popal
jmp 0x4033eb

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4018e8
Capabilities:
Terminate process

Disassembly:
push 0x90
call fcn.00401707
push eax
push 0x4012d0
call fcn.00401647
pop ecx
pop ecx
push 0x91
call fcn.00401707
push eax
push 0x4012c4
call fcn.00401647
pop ecx
pop ecx
push 0x92
call fcn.00401707
push eax
push 0x4012a0
call fcn.00401647
pop ecx
pop ecx
push 0x93
call fcn.00401707
push eax
push 0x40127c
call fcn.00401647
pop ecx
pop ecx
push 0x94
call fcn.00401707
push eax
push 0x401258
call fcn.00401647
pop ecx
pop ecx
push 3
call dword [sym.imp.msvcrt.dll_exit]
int3
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4030c8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
lea eax, [ebp - 0x88]
push 0x40131c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x88]
push eax
push 2
call dword [sym.imp.msvcrt.dll__wsetlocale]
add esp, 0x14
test eax, eax
jne 0x401942
push 0x401300
mov dword [0x4032dc], 1
call fcn.00401610
xor eax, eax
pop ecx
inc eax
jmp 0x4019a4
push 0
call sub.KERNEL32.dll_SetThreadUILanguage
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401747
test eax, eax
jne 0x40195d
jmp 0x40180a
push 0
call sub.MTXCLU.DLL_MtxCluIsClusterPresentExW
mov eax, dword [0x4032d8]
sub eax, 0
je 0x401994
dec eax
je 0x4019a2
dec eax
je 0x40198d
push 0x88
call fcn.00401707
push eax
push 0x4012c4
call fcn.00401647
pop ecx
pop ecx
jmp 0x4019a2
push 0x87
jmp 0x401979
test byte [0x403020], 1
je 0x4019a2
call fcn.00401d6d
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.00401ebf
leave
ret

Function at 0x401cc2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push eax
push eax
push 8
push eax
push eax
push eax
push dword [ebp + 8]
xor edi, edi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x28], 0x80
mov word [ebp - 0x22], ax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401d1c
push esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop esi
jmp 0x401d21
mov edi, 0x8000ffff
mov eax, edi
pop edi
leave
ret 4
Function at 0x401d6d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4030c8]
and word [ebp - 0x210], 0
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20e]
push eax
rep stosd dword es:[edi], eax
call fcn.00401d28
mov esi, eax
test esi, esi
je 0x401e2b
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x401dd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401dd1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x401e1f
push 0x40150c
lea eax, [ebp - 0x210]
push eax
call fcn.004019ae
push eax
push 0x401500
push 0x30e
mov esi, 0x4034e0
push esi
call dword [sym.imp.msvcrt.dll__snwprintf]
and word [0x403afc], 0
add esp, 0x14
test eax, eax
jge 0x401e13
mov esi, 0x80004005
jmp 0x401e1f
push esi
call fcn.00401cc2
mov esi, eax
test esi, esi
jge 0x401e2b
push 0xb04
push 0x10
call fcn.004019f3
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.00401ebf
leave
ret

Function at 0x401ebf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4030c8]
jne 0x401ec8
ret
jmp 0x401ecd
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4030c8]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x403b38]
test eax, eax
je 0x401ef1
call eax
cmp dword [0x403b3c], 0
je 0x401f38
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x403b3c]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.00401ebf
add ebp, 0x2a8
leave
ret
Function at 0x401f6a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x401580
call fcn.00402150
cmp word [0x400000], 0x5a4d
jne 0x401fa9
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x401fa9
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x401fc2
cmp ecx, 0x20b
je 0x401faf
and dword [ebp - 0x1c], 0
jmp 0x401fd9
cmp dword [eax + 0x400084], 0xe
jbe 0x401fa9
xor ecx, ecx
cmp dword [eax + 0x4000f8], ecx
jmp 0x401fd3
cmp dword [eax + 0x400074], 0xe
jbe 0x401fa9
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x403b40], 0xffffffff
or dword [0x403b44], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x403b10]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x403b0c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403b48], eax
call fcn.0040214c
cmp dword [0x4030d0], 0
jne 0x402036
push fcn.0040214c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040213a
push 0x403010
push 0x40300c
call sub.msvcrt.dll__initterm
mov eax, dword [0x403b08]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x403b04]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x403008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004018e8
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x4020ae
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x4020e3
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040218b
ret
Function at 0x40f4e0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, 0xb3f98720
mov dword [esp + 0xc], eax
mov dx, word [0x4b256e]
movsx eax, dx
and eax, 0xf24e5fd1
and eax, 0xe5413faa
cmp ecx, eax
jle 0x40f531
mov ax, word [0x4b4fde]
mov cx, ax
xor ecx, 0x241
mov ax, word [0x4b4206]
mov dx, ax
sub edx, ecx
mov ax, dx
mov word [0x4b4206], ax
mov eax, dword [0x4b8500]
mov ecx, esp
mov dword [ecx], eax
call fcn.00445d20
mov dx, word [0x4b26da]
movsx ecx, dx
lea ecx, [ecx + ecx - 0x43402588]
and ecx, 0xa1011b30
mov esi, dword [0x4a4774]
mov edi, esi
inc edi
mov dword [0x4a4774], edi
cmp ecx, esi
mov byte [esp + 0xb], al
jl 0x40f5a8
mov eax, dword [0x4a673c]
mov ecx, eax
inc ecx
mov dword [0x4a673c], ecx
mov dx, word [0x4b39bc]
mov cx, dx
lea eax, [eax + ecx + 1]
or eax, 0x4cf5
mov dx, word [0x4af168]
mov cx, dx
and ecx, eax
mov dx, cx
mov word [0x4af168], dx
mov eax, 1
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.004562bc
int3