joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6394fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x6396e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b464
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00643798
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x6396c2
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00643798
mov eax, dword [ebp - 0x24]
call fcn.0040bffc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x6395da
xor eax, eax
push ebp
push 0x6395ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00406ff4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00643798
mov eax, dword [ebp - 0x28]
call fcn.0040bffc
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6395da
test bl, bl
je 0x6396c2
xor eax, eax
push ebp
push 0x6396ad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x6396f8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00427db4
mov eax, dword [ebp - 8]
push dword [eax]
push 0x639708
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00427db4
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 8]
push dword [eax]
push 0x639708
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00427db4
push dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 8]
push dword [eax]
push 0x639708
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00427db4
push dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6396b7
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00407010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6396ee
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.0040b4c4
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x63970c
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430cf4
cmp eax, 2
je 0x639729
mov byte [ebp - 1], 1
jmp 0x639905
mov byte [ebp - 1], 0
mov eax, 0x67f2bc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x639905
xor eax, eax
push ebp
push 0x6398fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x639792
push 0x639910
push 0x63993c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov ebx, eax
test ebx, ebx
je 0x6397b9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x6398e5
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x6398e5
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x63980a
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x6397eb
call fcn.0040ac14
jmp 0x639905
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x63980a
call fcn.0040ac14
jmp 0x639905
xor eax, eax
push ebp
push 0x6398de
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x63984d
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x63984d
call fcn.0040ac14
call fcn.0040ac14
jmp 0x639905
mov eax, dword [ebp - 0x14]
call fcn.00406ff4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x639882
call fcn.0040ac14
call fcn.0040ac14
jmp 0x639905
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x6398bd
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x6398b9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x6398b9
mov byte [ebp - 1], 1
jmp 0x6398bd
inc ebx
dec esi
jne 0x63988f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6398e5
mov eax, dword [ebp - 0x18]
call fcn.00407010
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639905
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63dea8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x63df1b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x67f2c4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x63df03
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0063de90
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x63d680]
call fcn.0063e650
mov dword [0x67f328], eax
mov eax, dword [ebp - 4]
call fcn.0063de38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63df22
lea eax, [ebp - 8]
call fcn.0040fea4
pop eax
jmp eax

Function at 0x63df4c
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x63df5f
or esi, 2
test dl, dl
je 0x63df68
or esi, 0
jmp 0x63df6b
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret

Function at 0x6435b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x64360f
xor eax, eax
push ebp
push 0x643608
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64360f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
push 0x1f4
call sub.kernel32.dll_Sleep
movzx eax, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x643c88
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x643dfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b464
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.0061111c
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.00429384
mov eax, dword [ebp - 0x414]
call fcn.0040bffc
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x643dd5
xor eax, eax
push ebp
push 0x643d41
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040bffc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x643d5b
cmp dword [ebp - 0xc], 0
jne 0x643d6c
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x643dd5
xor eax, eax
push ebp
push 0x643db9
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b71c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c208
cmp dword [esi], 0
jne 0x643d7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x643dc3
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x643e04
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x6442ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x64433c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b464
mov eax, dword [ebp - 4]
test eax, eax
je 0x6442e7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x644315
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, 2
call fcn.0040c01c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0040c208
inc esi
dec ebx
jne 0x6442f2
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040b854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644343
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c4
pop eax
jmp eax

Function at 0x64482c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b464
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x644866
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [esp + 4]
call fcn.004298e8
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x648114
Capabilities:
Shutdown system

Disassembly:
add byte [ebp - 0x75], dl
in al, dx
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x64826f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x424]
mov edx, dword [eax]
call dword [edx + 0x7c]
test al, al
jne 0x64819b
push 0x30
mov eax, dword [0x688248]
call fcn.0040bffc
push eax
push 0x648288
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x64832c
mov edx, 0x648340
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00646850
mov eax, dword [ebp - 0x1c]
call fcn.0040bffc
push eax
mov eax, dword [0x6881e0]
call fcn.0055b178
push eax
call sub.user32.dll_MessageBoxW
jmp 0x6481ee
push 0x31
mov eax, dword [0x688248]
call fcn.0040bffc
push eax
push 0x648288
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x64832c
mov edx, 0x648340
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00646850
mov eax, dword [ebp - 0x24]
call fcn.0040bffc
push eax
mov eax, dword [0x6881e0]
call fcn.0055b178
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 2
je 0x648252
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x648252
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x648252
lea eax, [ebp - 0x14]
push eax
push 0x64835c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x648252
push 0
push 2
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x648276
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x64fb70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b558
mov eax, dword [ebp - 8]
call fcn.0040b558
xor eax, eax
push ebp
push 0x64fd19
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408154
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], esi
test bl, bl
je 0x64fbd0
mov dword [ebp - 0x48], 0x540
jmp 0x64fbd7
mov dword [ebp - 0x48], 0x500
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x64fbec
mov eax, 0x64fd2c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0040bffc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.0040bffc
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x64fccb
test bl, bl
je 0x64fcc5
cmp byte [0x688222], 0
jne 0x64fc34
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x500]
call fcn.00551b20
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
cmp byte [0x688236], 0
je 0x64fc67
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x64fca0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x64fca0
mov al, 1
call fcn.006439f4
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0x64fca0
mov eax, dword [0x680434]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x64fc67
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00427db4
mov edx, dword [ebp - 0x50]
mov eax, 0x688258
call fcn.0040b854
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x64fcde
test bl, bl
je 0x64fcde
mov eax, 0x688258
mov edx, 0x64fd44
call fcn.0040b854
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x500]
cmp byte [eax + 0x69], 0
je 0x64fcf4
call fcn.00551b18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64fd20
lea eax, [ebp - 0x50]
call fcn.0040b464
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x650be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x650ccd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.00428a3c
test al, al
jne 0x650c62
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x650ce8
call fcn.0040c260
mov eax, dword [ebp - 4]
call fcn.006473bc
cmp byte [0x688222], 0
jne 0x650c59
push 0x10
push 0x650d24
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x650d3c
call fcn.00647414
mov eax, dword [ebp - 8]
call fcn.0040bffc
push eax
mov eax, dword [0x680434]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x688228], 1
jmp 0x650cb0
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x650d74
call fcn.0040c260
mov eax, dword [ebp - 0xc]
call fcn.0040bffc
push eax
push 0x650db0
push 0x650dcc
mov eax, dword [0x680434]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x688221], 0
je 0x650cb0
mov edx, ebx
mov eax, 0x650de4
call fcn.00648794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650cd4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x6563b8
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x656484
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00643798
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040b89c
xor eax, eax
push ebp
push 0x65645a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0042840c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x65641d
mov byte [ebp - 5], 0
jmp 0x656450
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetSystemTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65648b
lea eax, [ebp - 0x24]
call fcn.0040b464
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x65fea8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x65ff48
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b464
mov eax, dword [ebp - 4]
test eax, eax
je 0x65feeb
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x65ff18
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, di
call fcn.0040c01c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040c208
inc esi
dec ebx
jne 0x65fef6
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65ff4f
lea eax, [ebp - 0x10]
call fcn.0040b464
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x66b854
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
mov edx, 0x66b900
call fcn.0040b854
xor edx, edx
push ebp
push 0x66b88e
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x66b89f
cmp bx, 0x409
jne 0x66b8ac
cmp ax, 0x409
je 0x66b8ec
cmp bx, 0x419
je 0x66b8e0
cmp ax, 0x419
je 0x66b8e0
cmp bx, 0x423
je 0x66b8e0
cmp ax, 0x423
je 0x66b8e0
cmp bx, 0x43f
je 0x66b8e0
cmp ax, 0x43f
je 0x66b8e0
cmp bx, 0x443
je 0x66b8e0
cmp ax, 0x443
jne 0x66b8ec
mov eax, esi
mov edx, 0x66b918
call fcn.0040b854
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401393
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x30], 0x9e3779b9
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 0x34], esi
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a308]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41a30c]
mov dword [ebp - 0x2c], eax
call fcn.0040138c
mov eax, dword [0x41a314]
add dword [ebp - 8], 0x23f
mov esi, dword [0x41a310]
push 0x20
mov dword [ebp - 0x20], eax
pop ebx
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, dword [ebp - 0x14]
shl eax, 4
add eax, esi
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x4c1908], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x4c1904]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x4c1908], 0x3eb
mov dword [0x4c1904], eax
mov eax, dword [0x4c1390]
cmove eax, dword [ebp - 0x1c]
mov dword [0x4c1390], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub edi, eax
mov dword [ebp - 0xc], eax
mov eax, edi
mov dword [0x4c1900], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, edi
shr eax, cl
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
cmp dword [0x4c1908], 0xb03
mov dword [ebp - 4], eax
jne 0x4014c0
push str.Poh_petopanoz_fonoso_culowisuvekocamoc
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec ebx
jne 0x4013e4
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret