joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a641
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.00432b69
test eax, eax
pop ecx
je 0x43a676
push edi
push edi
push edi
push edi
push edi
call fcn.00430c94
add esp, 0x14
push 4
pop eax
call fcn.0042de90
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x43a784
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x43a6fd
push str.kernel32.dll
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x43a6fd
push str.SetThreadStackGuarantee
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x43a6fd
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x43a6fd
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x43a6fd
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.00436388
add esp, 0xc
test eax, eax
jl 0x43a784
not edi
and dword [ebp - 8], edi
je 0x43a72f
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.00436388
add esp, 0xc
test eax, eax
jl 0x43a784
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x43a73a
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x43a74e
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x43a784
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x43a784
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43a784
xor eax, eax
inc eax
jmp 0x43a786
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d845
leave
ret
Function at 0x43c888
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00437e0c
mov dword [ebp - 0x18], eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x14], edx
je 0x43c910
push 2
push ebx
push ebx
push dword [ebp + 8]
call fcn.00437e0c
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
je 0x43c910
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
js 0x43c9a5
jg 0x43c8e9
cmp esi, ebx
jbe 0x43c9a5
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x43c91c
call fcn.0042eb5e
mov dword [eax], 0xc
call fcn.0042eb5e
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.0043ca3e
pop ecx
pop ecx
mov dword [ebp - 8], eax
test edi, edi
jl 0x43c93c
jg 0x43c938
cmp esi, ebx
jb 0x43c93c
mov eax, ebx
jmp 0x43c93e
mov eax, esi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00437faa
add esp, 0xc
cmp eax, 0xffffffff
je 0x43c988
cdq
sub esi, eax
sbb edi, edx
js 0x43c95f
jg 0x43c92e
test esi, esi
ja 0x43c92e
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0043ca3e
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x43ca0e
call fcn.0042eb71
cmp dword [eax], 5
jne 0x43c99d
call fcn.0042eb5e
mov dword [eax], 0xd
or esi, 0xffffffff
mov dword [ebp - 0xc], esi
jmp 0x43c962
cmp edi, ebx
jg 0x43ca1a
jl 0x43c9af
cmp esi, ebx
jae 0x43ca1a
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00437e0c
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x43c910
push dword [ebp + 8]
call fcn.0043a8f5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x43ca1a
call fcn.0042eb5e
mov dword [eax], 0xd
call fcn.0042eb71
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x43c910
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00437e0c
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x43c910
xor eax, eax
jmp 0x43c917
Function at 0x51120e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0056a160
pop ecx
test eax, eax
jne 0x511250
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00417b4d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x511216
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x571cef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00571b65

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748
Function at 0x45d6c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x34000]
push edi
jmp 0x45d6da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45d6e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d6d0
mov eax, 1
add ebx, ebx
jne 0x45d6f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45d6e8
jne 0x45d704
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d6e8
xor ecx, ecx
sub eax, 3
jb 0x45d718
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45d78a
mov ebp, eax
add ebx, ebx
jne 0x45d723
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45d730
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45d754
inc ecx
add ebx, ebx
jne 0x45d740
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45d735
jne 0x45d751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d735
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45d774
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45d765
jmp 0x45d6d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45d774
add edi, ecx
jmp 0x45d6d6
pop esi
mov edi, esi
mov ecx, 0x25816
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x45d7af
cmp byte [edi], 0x11
jne 0x45d794
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x45d792
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45d7f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5d25c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5d2e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45d7b5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5d2ec]
or eax, eax
je 0x45d7f1
mov dword [ebx], eax
add ebx, 4
jmp 0x45d7d2
call dword [esi + 0x5d2e8]
mov ebp, dword [esi + 0x5d2f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45d82b
sub esp, 0xffffff80
jmp 0x401e60
Function at 0x40d21d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a511
mov dword [ebp - 0x14], eax
cmp dword [0x44bf64], esi
jne 0x40d310
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d3f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d3f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x44bf64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44bf68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x44bf6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44bf74], eax
test eax, eax
je 0x40d30d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44bf70], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d335
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d328
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d34a
push 4
pop eax
jmp 0x40d3f2
cmp dword [ebp - 0x14], esi
je 0x40d34a
push dword [0x44bf64]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d32f
mov eax, dword [0x44bf70]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d3a8
cmp dword [0x44bf74], edi
je 0x40d3a8
push eax
call ebx
push dword [0x44bf74]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d3a8
test eax, eax
je 0x40d3a8
call ecx
test eax, eax
je 0x40d39d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d39d
test byte [ebp - 8], 1
jne 0x40d3a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d3d8
mov eax, dword [0x44bf68]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
call eax
mov esi, eax
test esi, esi
je 0x40d3d5
mov eax, dword [0x44bf6c]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44bf64]
call ebx
test eax, eax
je 0x40d3f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d3f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045d8
mov esp, ebp
pop ebp
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10007c2e
pop dword [ebp - 0x40]
mov eax, 0x4fd6a22f
sub eax, 0x3fd62601
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x3c59de5
sub dword [ebp - 0x50], 0xb573589a
mov dword [ebp - 0x4c], 0x6ec1a6c5
sub dword [ebp - 0x4c], 0x3c8e5a80
mov dword [ebp - 0x48], 0x86320d3c
add dword [ebp - 0x48], 0xc61a36f2
mov dword [ebp - 0x44], 0x53e31e24
sub dword [ebp - 0x44], 0x53e31e24
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xade966f9
add dword [ebp - 0x50], 0xc689025d
mov dword [ebp - 0x4c], 0xca8e2130
sub dword [ebp - 0x4c], 0x8921bfbb
mov dword [ebp - 0x48], 0xfecacafd
add dword [ebp - 0x48], 0x64a4a16f
mov dword [ebp - 0x44], 0x14843ae3
sub dword [ebp - 0x44], 0x14843ae3
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x32736
push 0
call eax
mov ecx, 0x3722
xor esi, esi
add esi, eax
mov edx, 0x1000fa00
add edx, dword [ebp - 0x40]
mov edi, 0xf5aa8048
add edi, 0x3d9f69a9
add dword [ebp - 0x20], ecx
mov ebx, dword [edx]
xor dword [ebp - 0x3c], esi
sub ebx, edi
add dword [ebp - 0x18], esi
mov dword [esi], ebx
add dword [ebp - 0x20], 0x24527f3f
add esi, 4
add edx, 0x5f344c13
sub edx, 0x5f344c0f
loop 0x10007d3c
add eax, 0x105ef0ed
sub eax, 0x105e2192
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xde9809f7
sub ecx, 0xce9809f7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1000ecef
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000ecfb
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000ed23
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000ed09
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x6e045ecb
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2ef65fb7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x402b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402b27
pop dword [ebp - 0x40]
mov eax, 0xe57fd862
sub eax, 0xe53fad3b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xbf0ca0b8
add dword [ebp - 0x50], 0x8f45a493
mov dword [ebp - 0x4c], 0xe08af27b
add dword [ebp - 0x4c], 0x51a859ca
mov dword [ebp - 0x48], 0xff007484
sub dword [ebp - 0x48], 0xb2b43056
mov dword [ebp - 0x44], 0xa519e2c
add dword [ebp - 0x44], 0xf5ae61d4
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xaf953230
add dword [ebp - 0x50], 0xc4dd3726
mov dword [ebp - 0x4c], 0xe80e3e00
sub dword [ebp - 0x4c], 0xa6a1dc8b
mov dword [ebp - 0x48], 0x43c6f32
add dword [ebp - 0x48], 0x5f32fd3a
mov dword [ebp - 0x44], 0xbc04c439
add dword [ebp - 0x44], 0x43fb3bc7
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x79e1b1bd
add eax, 0x86607f67
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38374
push 0
call eax
mov ecx, 0x992b934b
add ecx, 0x66d49ebf
xor ebx, ebx
add ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x40]
mov edi, 0xb1986959
add dword [ebp - 0x28], 0x93559a2e
mov edx, dword [esi]
add edx, edi
add dword [ebp - 0x14], ebx
mov dword [ebx], edx
xor dword [ebp - 0x34], 0xc73eb437
add ebx, 0xd1ffd821
sub ebx, 0xd1ffd81d
add esi, 4
loop 0x402c3a
add eax, 0x7159e442
sub eax, 0x71592947
mov ebx, eax
add eax, 0x9c53a216
sub eax, 0x9c53a211
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1003c8d0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x44
mov eax, dword [0x100b4368]
push esi
push 0x20
mov dword [esp + 0x48], eax
lea eax, [esp + 0x28]
push eax
push 0xe
push 0x400
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
fld dword [esp + 0x54]
fmul dword [0x100a994c]
mov esi, dword [esp + 0x4c]
push 0xffffffffffffffff
push esi
call fcn.100a4448
push eax
call fcn.10083930
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c915
sub eax, edx
cmp eax, 2
jge 0x1003c959
push 0x100a9948
lea ecx, [esp + 8]
push 0xffffffffffffffff
push ecx
call fcn.100839e0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x14]
push 0xffffffffffffffff
push eax
call fcn.10083990
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push esi
call fcn.10084540
add esp, 0x28
jmp 0x1003c96b
lea edx, [esp + 0x24]
push edx
push 0
dec eax
push eax
push esi
call fcn.10084540
add esp, 0x10
mov eax, esi
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c971
mov ecx, dword [esp + 0x40]
sub eax, edx
call fcn.1009d15f
add esp, 0x44
ret

Function at 0x10040780
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100407c9
xor ecx, ecx
test esi, esi
mov byte [esp + 7], 0x11
jle 0x100407c9
mov edx, dword [esp + 0xc]
lea esp, [esp]
mov al, byte [ecx + edx]
mov byte [esp + 0x10], al
mov ah, byte [esp + 7]
mov al, byte [esp + 0x10]
xor al, ah
push ax
pop ax
mov byte [esp + 0x10], al
mov al, byte [esp + 0x10]
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
mov byte [esp + 7], al
jl 0x100407a0
pop esi
pop ecx
ret
Function at 0x100a00e2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100ab450
call fcn.1009e76c
push 8
call fcn.100a4448
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100b9844], esi
jne 0x100a0116
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x100b9840], esi
mov al, byte [ebp + 0x10]
mov byte [0x100b983c], al
cmp dword [ebp + 0xc], edi
jne 0x100a0160
cmp dword [0x100bc288], edi
je 0x100a0150
mov eax, dword [0x100bc284]
sub eax, 4
mov dword [0x100bc284], eax
cmp eax, dword [0x100bc288]
jb 0x100a0150
mov eax, dword [eax]
cmp eax, edi
je 0x100a0131
call eax
jmp 0x100a0131
push 0x100ad028
mov eax, 0x100ad020
call fcn.100a0060
pop ecx
push 0x100ad030
mov eax, 0x100ad02c
call fcn.100a0060
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100a0191
cmp dword [ebp + 0x10], edi
jne 0x100a019f
mov dword [0x100b9844], esi
push dword [ebp + 8]
call fcn.100a001e
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100a019e
push 8
call fcn.100a4448
pop ecx
ret
call fcn.1009e7a7
ret

Function at 0x100a0bb2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100b4368]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100b49f0]
je 0x100a0be7
inc eax
cmp eax, 0x13
jb 0x100a0bd8
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100b49f0]
jne 0x100a0d0d
mov eax, dword [0x100b9784]
cmp eax, 1
je 0x100a0ce5
cmp eax, edx
jne 0x100a0c17
cmp dword [0x100b9788], 1
je 0x100a0ce5
cmp ecx, 0xfc
je 0x100a0d0d
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100a0c4d
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.100a0e60
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.100a1090
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100a0c81
mov eax, edi
push eax
call fcn.100a1090
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x100a73f8
push edi
call fcn.100a0f60
add esp, 0x10
push edi
call fcn.100a1090
push dword [esi + 0x100b49f4]
mov ebx, eax
call fcn.100a1090
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1009daf0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.100a0e60
push edi
push ebx
call fcn.100a0e70
push 0x100aafc0
push ebx
call fcn.100a0e70
push dword [esi + 0x100b49f4]
push ebx
call fcn.100a0e70
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100a4448
add esp, 0x2c
jmp 0x100a0d0d
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100b49f4]
push dword [esi]
call fcn.100a1090
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1009d15f
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret