joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64b13290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64b1332f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.64b1b897
lea ecx, [0x64b13340]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.64b1a1b0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.64b1a2c0
jmp fcn.64b13290
Function at 0x64b1b580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x64c09420]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x64b19d6b
je 0x64b19dbe
cmp ebx, 0x20
jbe 0x64b19dc4
cmp ebx, 0x40
jbe 0x64b19e0a
jmp 0x64b19eab
test ebx, ebx
je 0x64b19db4
add eax, 0x10
test ax, 0xff0
je 0x64b19da0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x64b85e20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x64b85f20]
jmp 0x64b19d88
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x64b19d88
pxor xmm1, xmmword [0x64c09430]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x64c09430]
pxor xmm2, xmmword [0x64c09440]
pxor xmm3, xmmword [0x64c09450]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x64c09430]
pxor xmm2, xmmword [0x64c09440]
pxor xmm3, xmmword [0x64c09450]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x64b19f0a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x64c0914b], 0
je 0x64b1b59a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x64b19d30
jmp fcn.64ac7c80
Function at 0x64b2a260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64b2a38a
sub esp, 0xc
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x64b2a2e3
mov edx, dword [esp + 0x1c]
cmp ecx, edx
ja 0x64b2a384
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
cmp edx, ebx
je 0x64b2a2ba
nop
mov ebp, ebx
lea esi, [edx + ecx - 1]
cmp esi, ebx
jb 0x64b2a2b8
mov ebx, edx
lea esi, [ebp + ecx - 1]
cmp esi, edx
jae 0x64b2a36c
mov edx, ebx
mov ebx, ebp
jmp 0x64b2a2ba
mov ebx, ebp
mov ebp, dword [esp + 0x10]
movzx esi, byte [ebp + 0x400]
movzx edi, byte [ebp + 0x401]
lea eax, [ecx - 1]
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jbe 0x64b2a365
mov ebx, dword [esp + 0x14]
xor eax, eax
jmp 0x64b2a303
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
mov byte [edx + eax], bl
inc eax
mov ebx, dword [esp + 0x20]
movzx esi, byte [esp + 0xb]
movzx edi, byte [esp + 0xa]
mov edx, ebx
mov ebx, dword [esp + 0x14]
cmp ecx, eax
jle 0x64b2a34c
movzx edx, byte [edx + eax]
mov byte [esp + 9], dl
inc esi
xchg esi, eax
mov byte [esp + 0xb], al
xchg esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
mov ebx, dword [ebp + esi*4]
add edi, ebx
xchg edi, eax
mov byte [esp + 0xa], al
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov edx, dword [ebp + edi*4]
mov dword [ebp + esi*4], edx
mov dword [ebp + edi*4], ebx
add edx, ebx
movzx edx, dl
movzx ebx, byte [esp + 9]
xor ebx, dword [ebp + edx*4]
cmp ecx, eax
ja 0x64b2a2e7
jmp 0x64b2a360
xchg esi, eax
mov byte [ebp + 0x400], al
xchg esi, eax
xchg edi, eax
mov byte [ebp + 0x401], al
xchg edi, eax
add esp, 0xc
ret
call fcn.64b1b760
mov ecx, ebx
call fcn.64b1b760
lea eax, [0x64b5e700]
mov dword [esp], eax
lea eax, [0x64b85ae4]
mov dword [esp + 4], eax
call fcn.64af2a80
call fcn.64b1b7a0
nop
call fcn.64b1a2c0
jmp fcn.64b2a260
Function at 0x64b45270
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x64c0cf30], eax
test eax, eax
je 0x64b452b8
mov dword [esp], 0x64c0cf34
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x64b56fbc]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x64b459e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x64c0d2b8]
test esi, esi
jle 0x64b45af0
mov edi, dword [0x64c0d2bc]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x64b45a14
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x64b45a95
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x64b45a00
mov dword [esp], eax
mov ebx, eax
call fcn.64b46130
test eax, eax
mov edi, eax
je 0x64b45b17
mov eax, dword [0x64c0d2bc]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.64b46230
add eax, dword [edi + 0xc]
mov edx, dword [0x64c0d2bc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x64b45af7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x64b45a8e
sub eax, 4
and eax, 0xfffffffb
jne 0x64b45aa0
add dword [0x64c0d2b8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x64c0d2bc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x64b45a8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.64b466f8
lea esi, [esi]
xor esi, esi
jmp 0x64b45a1e
mov eax, dword [0x64c0d2bc]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.64b466f8
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.64b466f8
mov esi, esi
lea edi, [edi]
Function at 0x64b45db0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x64c0d2c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x64c0d2c0]
sub esp, 4
test ebx, ebx
je 0x64b45e05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x64b45dfe
test esi, esi
je 0x64b45dfe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x64b45de0
mov dword [esp], 0x64c0d2c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x64b466f8
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.64b466d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.64b466d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x402658
Capabilities:
Terminate process

Disassembly:
xor edi, edi
xor esi, esi
mov edx, eax
mov eax, 5
add eax, 5
inc eax
test eax, 0xb
jne 0x40267a
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401036], eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x407467
pop dword [ebp - 0x34]
mov eax, 0x407467
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe0d0cac4
sub dword [ebp - 0x44], 0x927e8579
mov dword [ebp - 0x40], 0x82d4efa5
add dword [ebp - 0x40], 0xaf5e5ca0
mov dword [ebp - 0x3c], 0x6c79d357
sub dword [ebp - 0x3c], 0x202d8f29
mov dword [ebp - 0x38], 0x6bb1a5ef
sub dword [ebp - 0x38], 0x6bb1a5ef
lea eax, [ebp - 0x44]
push eax
mov eax, 0x8ce7f43a
sub eax, 0x8ca773c2
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x35cfdc95
sub dword [ebp - 0x44], 0xc15d733f
mov dword [ebp - 0x40], 0xdad40be7
add dword [ebp - 0x40], 0x6698558e
mov dword [ebp - 0x3c], 0xe7694a3b
sub dword [ebp - 0x3c], 0x83f9ddcf
mov dword [ebp - 0x38], 0xdbb0e64a
sub dword [ebp - 0x38], 0xdbb0e64a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x834fdf6f
sub eax, 0x830f5ef3
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a510
push 0
call eax
mov ecx, 0x12db5c90
sub ecx, 0x12db07b4
xor edi, edi
add edi, eax
mov esi, 0xef87815a
sub esi, 0xef426d5a
add esi, dword [ebp - 0x34]
mov ebx, 0x64c598cb
sub ebx, 0x6f965b46
xor dword [ebp - 0x10], 0x865b777e
mov edx, dword [esi]
add dword [ebp - 0x28], ebx
xor edx, ebx
xor dword [ebp - 0x20], ebx
mov dword [edi], edx
sub dword [ebp - 0x20], esi
add edi, 4
add esi, 4
loop 0x407586
add eax, 0x33e8d14
sub eax, 0x33d46d1
mov ebx, eax
add eax, 5
mov ecx, 0x72826f06
sub ecx, 0x72426f06
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40611c
pop dword [ebp - 0x2c]
mov eax, 0xef1b3abf
add eax, 0x1125265d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe28c0b12
sub dword [ebp - 0x3c], 0x9439c5c7
mov dword [ebp - 0x38], 0xaae45755
add dword [ebp - 0x38], 0x874ef4f0
mov dword [ebp - 0x34], 0xc1babc81
add dword [ebp - 0x34], 0x8a9187ad
mov dword [ebp - 0x30], 0x38c88d67
add dword [ebp - 0x30], 0xc7377299
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x1bd9474f
add dword [ebp - 0x3c], 0x58992207
mov dword [ebp - 0x38], 0x92edeeef
add dword [ebp - 0x38], 0xae7e7286
mov dword [ebp - 0x34], 0xe9866354
sub dword [ebp - 0x34], 0x8616f6e8
mov dword [ebp - 0x30], 0x429da506
sub dword [ebp - 0x30], 0x429da506
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfc39085c
sub eax, 0xfbf8975c
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39183
push 0
call eax
mov ecx, 0xa7caf9ab
sub ecx, 0xa7caa7b9
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x2c]
mov edx, 0x36fe9080
sub edx, 0x876bf45a
add dword [ebp - 4], 0x77f61011
mov esi, dword [ebx]
add dword [ebp - 0x20], ecx
xor esi, edx
sub dword [ebp - 0x20], ebx
mov dword [edi], esi
add dword [ebp - 0x18], 0xf99c6b8b
add edi, 0x6d1c1b45
sub edi, 0x6d1c1b41
add ebx, 0xa832b860
sub ebx, 0xa832b85c
loop 0x406233
add eax, 0x13a9b
xor ebx, ebx
add ebx, eax
add eax, 0xa479a090
add eax, 0x5b865f75
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x41a9c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41a9d7
pop dword [ebp - 8]
mov eax, 0xc7058c4d
sub eax, 0xc6c3e276
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3d96b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xe14fe900
add ecx, 0x1eb063be
mov esi, eax
mov edx, 0x28396bb
add edx, 0xfdbf9745
add edx, dword [ebp - 8]
mov edi, 0xfa9adf5d
add edi, 0x878a2354
add dword [ebp - 4], eax
mov ebx, dword [edx]
xor dword [ebp - 4], ecx
sub ebx, edi
add dword [ebp - 4], ecx
mov dword [esi], ebx
add dword [ebp - 4], 0xf6ac4c38
add esi, 4
add edx, 4
loop 0x41aa31
add eax, 0x125cb
mov ebx, eax
add eax, 0x73b952ed
add eax, 0x8c46ad18
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Power down monitor

Disassembly:
push 2
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
ret

Function at 0x401841
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401880
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401880
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401880
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401880
cmp dword [ecx + 0x74], 0xe
jbe 0x401880
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x7709648d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x244b7bb2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403180
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4031bc
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4031dc
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405448
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403474
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004051d8
test esi, esi
jne 0x4034aa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004052c8
jmp 0x4034c8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403318
mov edi, eax
test esi, esi
je 0x4034c8
cmp dword [ebx], 0
je 0x4034c8
dec esi
jmp 0x4034b1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403500
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x617008], 0x8088405
inc edx
mov dword [ebx + 0x617008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4040b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x617024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40414c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40412c
xor eax, eax
push ebp
push 0x404125
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404168
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40412c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x617024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x617024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404f84
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x65e04c], 0
je 0x404fe5
cmp word [0x65e220], 0xd7b2
jne 0x404fad
cmp dword [0x65e228], 0
jbe 0x404fad
mov eax, 0x65e21c
call dword [0x65e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40500c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x617034], 0
jne 0x405001
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40515c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x617038], 0
je 0x405182
mov edx, esi
mov eax, ebx
call dword [0x617038]
jmp 0x405191
mov eax, 8
call fcn.00402fb0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x65e04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405124
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x406b38
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406d68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406bbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406d68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406bbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406d84
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406c44
xor eax, eax
push ebp
push 0x406c3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406974
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406c22
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406da4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406c22
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406d5e
cmp byte [ebp - 0xd], 0
jne 0x406c8b
cmp byte [ebp - 0x12], 0
je 0x406d5e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406ca4
dec ebx
cmp byte [ebx], 0x2e
je 0x406cb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406ca3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406d5e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406cf0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406d5e
cmp byte [ebp - 0xd], 0
je 0x406d5e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406d5e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret