joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403540
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push edi
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
cmp dword [ebp - 0x90], 5
jne 0x403595
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
jo 0x4035b9
push dx
mov dx, 0x7a78
pop dx
jno 0x4035b9
insb byte es:[edi], dx
mov bl, 0xbc
ja 0x403624
fdiv qword [eax - 0x7f6a6a73]
push 0x56
mov bh, byte [ecx]
mov eax, 0xff70bd83
invalid
cmp dword [ebp - 0x90], 6
jne 0x4035d6
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x4035d6
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
jmp 0x40365e
jb 0x403649
push di
mov di, 0x4fff
pop di
jae 0x403649
fdiv dword [esi + 0x6f]
cmp esp, dword [eax]
inc eax
push 0xb7f8c08b
ja 0x4035f6
inc ecx
invalid
push 0x4110e8
call fcn.00404650
add esp, 4
cmp eax, 0xffffffff
je 0x403664
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00403ce0
mov dword [0x422544], 1
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
call fcn.00402640
test eax, eax
je 0x403691
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
xor dl, dl
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x80], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x7f]
mov byte [ebp - 0x60], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x5f]
mov byte [ebp - 0x40], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x3f]
lea edx, [ebp - 0x60]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x20]
push eax
push ecx
lea eax, [ebp - 0x80]
push edx
push eax
call fcn.004018d0
add esp, 0x10
test eax, eax
jne 0x403716
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.004011c0
add esp, 4
test eax, eax
jne 0x403748
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x40375a
xchg bh, bh
mov ch, ch
xchg cl, cl
ja 0x40375a
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x60]
push eax
lea edx, [ebp - 0x80]
push ecx
push edx
call fcn.00401540
add esp, 0x10
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x4043f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov dword [ebp - 4], 0
push edx
push bx
mov dl, 0xc
test dx, 0x40ef
test bh, bh
pop bx
pop edx
lea eax, [ebp - 4]
push eax
call fcn.00402cd0
add esp, 4
test eax, eax
jne 0x404422
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
mov eax, dword [ebp - 4]
test eax, eax
jne 0x404446
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x404457
xchg ecx, ecx
xchg dl, dl
ja 0x404457
pop eax
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0x41128c
push 0x41124c
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404560
Capabilities:
Packed with generic packer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x404594
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push 0
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4045cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
and bl, ah
inc dl
sub ch, ah
test ax, 0x1e59
popal
mov eax, dword [0x422540]
mov esi, dword [ebp - 4]
test eax, eax
je 0x4045fa
push esi
call fcn.00404490
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x422540], eax
je 0x404618
push edi
mov di, 0x9ce2
pop edi
jne 0x404618
insd dword es:[edi], dx
dec esp
jl 0x404682
xor eax, 0xdee0ed6d
aad 0xcf
xor byte [esi + 0x6a], dl
add al, ch
xor byte [eax + eax], al
add byte [ebx + 0x3a5008c4], al
ret
push esi
push 0
call fcn.00404a50
add esp, 8
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
mov eax, dword [0x422540]
test eax, eax
jne 0x40463e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
lea edi, [ebp - 0x128]
mov dword [ebp - 0x12c], 0x128
rep stosd dword es:[edi], eax
push bx
push edx
push edi
or dh, dh
xor bx, cx
pop edi
pop edx
pop bx
lea eax, [ebp - 0x12c]
push eax
push esi
call dword [0x422538]
test eax, eax
je 0x40472c
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
lea ecx, [ebp - 0x108]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x4046ff
lea edx, [ebp - 0x12c]
push edx
push esi
call dword [0x42253c]
test eax, eax
je 0x40472c
jmp 0x4046be
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
mov edi, dword [ebp - 0x124]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
jle 0x40485c
push si
pop si
jg 0x40485c
jp 0x404868
push ecx
mov ecx, 0x54689436
pop ecx
jnp 0x404868
or dword [ebx + 0x4d8b1c45], 0x18
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push 7
push 0x4110c8
push eax
push ecx
call fcn.00401000
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
jne 0x40488d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jo 0x4048a4
mov dx, dx
nop
xchg cx, cx
jno 0x4048a4
mov al, 0x98
and ecx, dword [ecx - 0x7834e8a9]
mov ecx, 0x7b95d21
add byte [eax], al
add byte [ebx], dh
ror byte [ebp + 0x45c6dd7d], 0xdc
add bl, dh
stosd dword es:[edi], eax
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x23]
mov byte [ebp - 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_rand]
xor esi, esi
push ebx
cmp ebx, esi
sub ebx, 0x6895
sub ebx, 0x50e0
mov bx, 0x26ca
xor bl, al
pop ebx
call edi
and eax, 0x800000ff
jns 0x4048e5
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, 0x20
jb 0x4048bf
js 0x404900
push eax
mov eax, 0xc7766751
pop eax
jns 0x404900
cmpsd dword [esi], dword es:[edi]
fstp qword [edi + 0x18]
pop ds
cmpsb byte [esi], byte es:[edi]
mov eax, dword [ebp - 4]
mov ecx, 8
lea esi, [ebp - 0x24]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jb 0x404928
mov di, di
nop
nop
nop
jae 0x404928
loope 0x4048fe
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x8bb8ec44
dec ebp
adc byte [eax - 0x75], dl
inc ebp
adc al, 0x8d
push ebp
fsubr qword [edx + 0x20]
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x24]
push 0x20
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.00403100
add esp, 0x1c
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ecx
push edx
call fcn.00402c40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4049d0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x404a0f
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
push eax
push edx
push edi
add dl, dh
pop edi
pop edx
pop eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x404a50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x230]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push cx
push dx
push eax
cmp dx, cx
inc eax
or cx, cx
inc al
inc cx
test al, 0x3b
and ch, al
mov eax, edx
and cx, 0x7bc9
pop eax
pop dx
pop cx
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
mov edi, 0x4110bc
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
and bx, cx
pop ebx
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x12c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x404b64
mov edx, dword [ebp + 8]
push edx
call fcn.004026c0
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x404b67
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
je 0x404b70
mov ch, ch
xchg esi, esi
jne 0x404b70
inc esp
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp edi, 0xffffffff
jne 0x404b8f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404f00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x422548
push 0x407010
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, eax
test ecx, ecx
jne 0x404f3c
pop esi
pop ebp
ret
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
ret
Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409238
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c80
xor eax, eax
push ebp
push 0x409343
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, edi
xor edx, edx
call fcn.00404c98
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetThreadLocale_1
mov ecx, 0x409360
mov edx, 0x1009
call fcn.00408dd0
mov eax, dword [ebp - 0xc]
mov edx, 1
call fcn.00407e2c
add eax, 0xfffffffd
sub eax, 3
jb 0x40930b
mov eax, dword [0x415c30]
sub eax, 4
je 0x40918e
add eax, 0xfffffff3
sub eax, 2
jb 0x40918e
xor eax, eax
jmp 0x409190
mov al, 1
test al, al
je 0x4091d7
jmp 0x4091c1
mov eax, dword [ebp - 4]
movzx esi, word [eax + ebx*2 - 2]
mov eax, esi
sub ax, 0x47
je 0x4091c0
sub ax, 0x20
je 0x4091c0
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404e04
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404f98
inc ebx
lea eax, [ebp - 4]
call fcn.00404830
call fcn.00404ef4
cmp ebx, eax
jle 0x409196
jmp 0x409320
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
jmp 0x409320
mov esi, dword [ebp - 4]
test esi, esi
je 0x409205
mov eax, esi
sub eax, 0xa
cmp word [eax], 2
je 0x409205
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00404820
mov esi, eax
cmp word [esi + ebx*2 - 2], 0xd800
jb 0x40924e
cmp word [esi + ebx*2 - 2], 0xdfff
ja 0x40924e
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040a314
sar eax, 1
jns 0x409228
adc eax, 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call 0xdbf9ea97
out 0xef, eax
mov al, byte [0x835ac133]
in al, dx
add al, 0x8b
int3
cmp al, 0xa0
pop esp
add eax, ecx
jmp 0x409259
jne 0x40925b
mov edi, 0
xor edi, dword [ebx]
xor edi, eax
mov dword [edx], edi
add ebx, 4
add edx, 4
mov ecx, 0x5f1738f2
shr ecx, 4
mov esi, 0x5b109db
xor esi, ecx
xor esi, ebx
mov ecx, 0x587dface
shr ecx, 7
add ecx, 0xff4f040b
or ecx, esi
jne 0x40925b
ret
lea eax, [ebp - 4]
call fcn.00404830
call fcn.00404ef4
cmp ebx, eax
jle 0x4091e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40934a
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404c90
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x4095c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4096ed
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004093dc
mov esi, eax
mov eax, dword [0x412c2c]
cmp byte [eax], 0
je 0x409695
mov eax, dword [0x412b68]
call fcn.0040317c
call fcn.00402f6c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4095a4]
call fcn.00405ad8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x409708
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4096d1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x412b48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415b48]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4096f4
lea eax, [ebp - 4]
mov edx, dword [0x4095a4]
call fcn.00405ae4
ret

Function at 0x40a91f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40a942
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40a944
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40a97d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40a967
mov eax, esp
cmp esi, eax
je 0x40a98a
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40a9c4
cmp bl, 0
je 0x40a9c0
cmp bl, 0x41
jl 0x40a9bb
cmp bl, 0x5a
jg 0x40a9bb
or bl, 0x20
xor al, bl
inc esi
jmp 0x40a99f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a904
Function at 0x40b5b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b5fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b548
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b601
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b818
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b8af
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b863
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b899
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b87c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b88f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b6d8
mov ebx, eax
test esi, esi
je 0x40b88f
dec esi
jmp 0x40b86a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8b6
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b8c0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408134
add esp, 0x208
pop ebx
ret
Function at 0x9b4ae2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xbba2f1
jmp 0xbba347
push ebp
mov dword [esp], esi
push esp
pop esi
add esi, 4
sub esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], ebp
jmp 0xbba424
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], esp
push ebp
mov ebp, 4
add dword [esp + 4], ebp
mov ebp, dword [esp]
add esp, 4
pop ebp
jmp 0xbba562
push edx
mov dword [esp], esi
mov esi, esp
add esi, 4
push ebp
mov ebp, 0x14
sub esi, ebp
mov ebp, dword [esp]
jmp 0xbba57e
add esp, 4
xchg dword [esp], esi
mov esp, dword [esp]
jmp 0xbba68d
jmp 0xbba6f2
push esi
push esp
pop esi
add esi, 4
push edi
mov edi, 4
sub esi, edi
pop edi
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
mov dword [esp], ebx
jmp 0xbba7c8
jmp fcn.00bba82c
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x69ec286e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x56e711c7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x496f63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x496f63
lcall 0x5de5, 0x8b10c483
jmp loc.00919670