joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ada
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x458554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x230
xor edi, edi
push edi
push esi
call fcn.00428540
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.0042f9fc
push eax
call fcn.00401b8e
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x445800]
je 0x420c44
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x420c58
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x420c58
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
jne 0x420b73
mov eax, edi
jmp 0x420ba2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x420b90
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.004208d5
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x28]
jmp 0x420b99
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00420d9b
test eax, eax
je 0x420bc7
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.00420761
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x420bcb
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00420d9b
test eax, eax
je 0x420bf2
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.00420761
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x420bf6
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00420d9b
test eax, eax
je 0x420c1e
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.00420761
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x420c20
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x420c32
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x420c44
mov eax, edi
mov dword [esi + 0x10], eax
mov eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425e86
leave
ret 4
xor eax, eax
jmp 0x420c47
Function at 0x420fea
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x42103d
push esi
push dword [ebp + 8]
call fcn.004211d9
mov edi, eax
test edi, edi
je 0x421038
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x421038
mov eax, dword [ebp - 8]
jmp 0x42104f
mov eax, dword [ebp + 0x10]
jmp 0x42104f
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x421055
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fbb9
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.00426ac0
mov eax, dword [0x458554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x58], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
je 0x42118c
push 0
push edx
call fcn.004211d9
mov ebx, eax
test ebx, ebx
jne 0x4210bd
push esi
jmp 0x4211b4
call fcn.0040ecdb
push eax
lea ecx, [ebp - 0x2014]
call fcn.00402015
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x42114b
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.00401dc7
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.00408441
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x421179
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.00401977
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00402052
jmp 0x4211bb
push esi
mov ecx, edi
call fcn.00401fad
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x421172
test esi, esi
jne 0x421195
mov esi, 0x44fdc4
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.00401fad
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425e86
leave
ret 0x10

Function at 0x434684
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004344fa
Function at 0x4e39b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6a000]
push edi
or ebp, 0xffffffff
jmp 0x4e39d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e39d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e39c8
mov eax, 1
add ebx, ebx
jne 0x4e39eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e39fc
jne 0x4e3a0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3a0c
dec eax
add ebx, ebx
jne 0x4e3a08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e39e0
xor ecx, ecx
sub eax, 3
jb 0x4e3a24
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e3a96
sar eax, 1
mov ebp, eax
jmp 0x4e3a2f
add ebx, ebx
jne 0x4e3a2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e3a3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e3a60
inc ecx
add ebx, ebx
jne 0x4e3a4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e3a41
jne 0x4e3a5d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e3a41
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e3a80
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e3a71
jmp 0x4e39ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e3a80
add edi, ecx
jmp 0x4e39ce
pop esi
mov edi, esi
mov ecx, 0x1b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e3a9e
cmp byte [edi], 6
jne 0x4e3a9e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4e3aa3
lea edi, [esi + 0xe1000]
mov eax, dword [edi]
or eax, eax
je 0x4e3b12
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe4f84]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe4fe8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e3ad0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe4fec]
or eax, eax
je 0x4e3b0c
mov dword [ebx], eax
add ebx, 4
jmp 0x4e3aed
call dword [esi + 0xe4ff0]
popal
jmp 0x401f20
Function at 0x401026
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x878
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [eax]
push edi
xor edi, edi
cmp dword [0x2155fe4], 0x134
jne 0x40105f
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov eax, dword [0x43b4c8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43b4cc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
call fcn.0040101c
add dword [ebp - 0xc], 0x54
cmp dword [0x2155fe4], 0xb54
jne 0x4010d4
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
lea eax, [ebp - 0x74]
push eax
push str.satavopofomedudoxe_wozewukuzedicobir_gav_guf_vanarizijavegagerusuxo
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionGuid]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push edi
lea eax, [ebp - 0x874]
push eax
push str.yenaxivaxecesolajizefiyutov
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov eax, dword [0x43b4d0]
mov dword [ebp - 0x20], eax
mov eax, dword [0x43b4d4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.0040100c
mov eax, dword [ebp - 0x20]
mov edx, dword [0x2155fe4]
add dword [ebp - 0x10], eax
cmp edx, 0xfa9
jne 0x40111e
mov dword [0x20ee354], 0xedeb2e40
mov ecx, dword [ebp - 0x14]
mov eax, esi
shr eax, cl
mov ecx, dword [ebp - 0x28]
mov dword [0x20ee350], 0x9150ce2e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
call fcn.00401023
cmp edx, 0x3eb
jne 0x40115e
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x20eb14c], edi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add eax, esi
xor ecx, eax
xor dword [ebp - 8], ecx
cmp dword [0x2155fe4], 0x18f
jne 0x401187
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub ebx, dword [ebp - 8]
mov dword [ebp - 0x18], edi
and eax, 0x5dc052bb
sub dword [ebp - 0x18], 0x5396dd36
add dword [ebp - 0x18], 0x5396dd3a
mov ecx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 5
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
call fcn.00401023
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
add eax, ebx
push eax
mov eax, ebx
shl eax, cl
add eax, dword [ebp - 0x2c]
call fcn.00401015
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
call fcn.00401012
sub esi, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov dword [0x458208], edi
call fcn.00401005
dec dword [ebp - 0x1c]
jne 0x4010eb
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 4
Function at 0x4011ff
Capabilities:
Query environment variable
Set console window title

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2155fe4]
mov ecx, dword [0x20eb150]
sub esp, 0xc24
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x401279
mov edi, ecx
mov ebx, eax
cmp dword [0x2155fe4], 0xae9
jne 0x40126d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push str.mumefere_pavegurovi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
lea eax, [ebp - 0xc20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
call fcn.00401026
add edi, 8
dec ebx
jne 0x401223
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401322
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x43416d
call fcn.004331f0
sub esp, 0xd38
push esi
xor esi, esi
cmp dword [0x2155fe4], 0x20a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x401406
push esi
push esi
push esi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push esi
push esi
call sub.KERNEL32.dll_Module32Next
push esi
push esi
call edi
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], esi
mov word [ebp - 0x24], ax
push esi
mov dword [ebp - 4], esi
call fcn.004018ca
pop ecx
push esi
push esi
call fcn.0040183b
push 0x436800
push str.0.txt
call fcn.00401c5b
push esi
call fcn.00402132
add esp, 0x14
push esi
push esi
push esi
call fcn.00402036
add esp, 0xc
push esi
call fcn.00401f3e
pop ecx
push esi
push esi
push esi
call fcn.00402036
fldz
push ecx
fst qword [esp + 8]
fstp qword [esp]
call fcn.004015d0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00401700
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00401c80
fstp st(0)
or dword [ebp - 4], 0xffffffff
add esp, 8
cmp dword [ebp - 0x10], 8
jb 0x401406
push dword [ebp - 0x24]
call fcn.00401c72
pop ecx
call fcn.0040130e
push 0x43ce18
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LocalAlloc
push eax
mov dword [0x20ee34c], eax
call edi
mov dword [0x20eb154], eax
call fcn.004012c4
push str.VirtualProtect
push dword [0x20ee34c]
call edi
mov dword [0x45820c], eax
call fcn.004012e3
xor edi, edi
cmp edi, 0x50a28
jge 0x40145a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x1ee9e75e
jg 0x401474
inc edi
mov eax, edi
cdq
cmp edx, 0x3f
jl 0x401446
jg 0x401474
cmp eax, 0x27e30f11
jb 0x401446
mov eax, dword [0x43bfcc]
mov dword [0x2155fe8], eax
call fcn.00401298
xor edi, edi
cmp dword [0x2155fe4], esi
jbe 0x4014b3
cmp dword [0x2155fe4], 0x170
jne 0x4014aa
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
inc edi
cmp edi, dword [0x2155fe4]
jb 0x40148d
xor edi, edi
mov eax, dword [0x2155fe4]
add eax, edi
cmp eax, 0x5e
jne 0x4014d6
push esi
lea eax, [ebp - 0x544]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
inc edi
cmp edi, 0x3bf93
jl 0x4014b5
call fcn.004011ff
xor ecx, ecx
cmp ecx, 0x3672c
jne 0x4014f3
call fcn.0040127e
inc ecx
cmp ecx, 0x2f5303
jl 0x4014e6
push 0x7b
pop edi
cmp dword [0x2155fe4], 0x54d
jne 0x40152b
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
lea eax, [ebp - 0xd44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthFloatA]
dec edi
jne 0x4014ff
call dword [0x20eb150]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x408cef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a648]
jne 0x408cf9
repz ret
jmp fcn.0040d519
Function at 0x40a29d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403aac
and dword [ebp - 4], 0
cmp dword [0x43ca0c], 0
mov ebx, eax
jne 0x40a34e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a3ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a3ff
push eax
call fcn.00403a3a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ca0c], eax
call esi
push eax
call fcn.00403a3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43ca10], eax
call esi
push eax
call fcn.00403a3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ca14], eax
call esi
push eax
call fcn.00403a3a
pop ecx
mov dword [0x43ca1c], eax
test eax, eax
je 0x40a34e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403a3a
pop ecx
mov dword [0x43ca18], eax
mov eax, dword [0x43ca18]
cmp eax, ebx
je 0x40a3a6
cmp dword [0x43ca1c], ebx
je 0x40a3a6
push eax
call fcn.00403ab5
push dword [0x43ca1c]
mov esi, eax
call fcn.00403ab5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a3a6
test edi, edi
je 0x40a3a6
call esi
test eax, eax
je 0x40a39d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a39d
test byte [ebp - 0xc], 1
jne 0x40a3a6
or dword [ebp + 0x10], 0x200000
jmp 0x40a3df
mov eax, dword [0x43ca10]
cmp eax, ebx
je 0x40a3df
push eax
call fcn.00403ab5
pop ecx
test eax, eax
je 0x40a3df
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a3df
mov eax, dword [0x43ca14]
cmp eax, ebx
je 0x40a3df
push eax
call fcn.00403ab5
pop ecx
test eax, eax
je 0x40a3df
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ca0c]
call fcn.00403ab5
pop ecx
test eax, eax
je 0x40a3ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a401
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401724
Capabilities:
Terminate process

Disassembly:
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
pop esp
or byte [ecx], cl
or cl, byte [ebx]
sbb ecx, dword [ecx + 0x1b0f1bd8]
sbb edx, dword [eax]
cmp byte [ecx], dl
adc ah, byte [esi + 0x1610141b]
pop ss
sbb byte [ebx - 0x6f6f6fe6], ah
nop
sbb ah, 0x90
and edx, dword [edx - 0x68d46f70]
nop

Function at 0x401750
Capabilities:
Terminate process

Disassembly:
mov bp, sp
mov edx, dword [ebx - 0x37f274f8]
rol byte [eax - 0x6a], 0x50
add ecx, 0x40
push 0xfad274
push ecx
call dword [0x40c176]
mov eax, dword [0x4c02ac]
pop esi
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x403b2a
Capabilities:
Allocate or change rwx memory
Read .ini file

Disassembly:
mov eax, 0x447e2b
call fcn.00447d38
sub esp, 0x178
push ebx
push esi
mov eax, 0xb2d3b
add dword [0x487324], eax
xor ebx, ebx
cmp dword [0x487324], 0x20a
jne 0x403bc5
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WindowFromPoint]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x402c38
push ebx
push 0x402c5c
push 0x402c84
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call fcn.004030e0
lea eax, [ebp - 0x3c]
call fcn.00403e34
push 0x929
push 0xea
mov dword [ebp - 4], ebx
call fcn.00404b63
push ebx
push ebx
push ebx
call fcn.0040520b
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea edi, [ebp - 0x3c]
call fcn.00403e59
pop edi
xor eax, eax
cmp eax, 0xf027935
jg 0x403bd6
inc eax
cmp eax, 0x736251e2
jl 0x403bc7
push 0x45ab18
mov byte [0x45ab1d], 0x6c
mov byte [0x45ab1f], 0x32
mov byte [0x45ab20], 0x2e
mov byte [0x45ab1b], 0x6e
mov byte [0x45ab1c], 0x65
mov byte [0x45ab21], 0x64
mov byte [0x45ab1e], 0x33
mov byte [0x45ab22], 0x6c
mov byte [0x45ab23], 0x6c
mov byte [0x45ab24], bl
mov byte [0x45ab18], 0x6b
mov byte [0x45ab19], 0x65
mov byte [0x45ab1a], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x487324]
mov dword [0x487294], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push dword [0x487324]
mov dword [0x487290], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x45502c]
xor esi, esi
mov dword [0x4873fc], eax
cmp dword [0x487324], ebx
jbe 0x403cc7
mov eax, dword [0x4873fc]
mov dword [ebp - 0x14], eax
mov eax, 0xb2d3b
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + esi]
mov ecx, dword [0x487290]
mov byte [ecx + esi], al
cmp dword [0x487324], 0x44
jne 0x403cbe
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFlags]
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
inc esi
cmp esi, dword [0x487324]
jb 0x403c79
call fcn.00403a70
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
cmp esi, 0x770e
jne 0x403ceb
call fcn.00403b04
inc esi
cmp esi, 0x286c535
jl 0x403cce
push 0x7b
pop esi
cmp dword [0x487324], 0xd
jne 0x403d34
push 0x30
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call fcn.00409860
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
push 0x402cc8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetOldestEventLogRecord]
dec esi
jne 0x403cf7
call fcn.00403b1e
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x403d4a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
xor esi, esi
cmp dword [0x487324], 0xc
push edi
jne 0x403dbd
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
push dword [ebp - 4]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
call dword [sym.imp.ole32.dll_CoRevokeMallocSpy]
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push 0x402c27
push 0x45ab18
call fcn.004049c4
push esi
call fcn.00405034
push esi
call fcn.00404e1e
push esi
call fcn.00404e08
push esi
push esi
call fcn.00404ce9
push esi
call fcn.0040501d
add esp, 0x20
mov eax, dword [0x459e4c]
mov dword [0x487324], eax
mov edi, 0x9ae37
cmp dword [0x487324], 0x15
jne 0x403e1f
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0x402d28
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0x402d40
push 0x402d90
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x120]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
dec edi
jne 0x403dcc
call fcn.004031b1
call fcn.00403b2a
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x4059eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454ac0]
jne 0x4059f5
repz ret
jmp fcn.0040bb9c