joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40d0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043b7
and dword [ebp - 0x14], 0
cmp dword [0x40e840], 0
mov dword [ebp - 0x18], eax
jne 0x40576e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405816
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405816
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40e840], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40e844], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40e848], eax
call edi
push eax
call esi
mov dword [0x40e850], eax
test eax, eax
je 0x40576e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40e84c], eax
mov eax, dword [0x40e84c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4057c7
cmp dword [0x40e850], ecx
je 0x4057c7
push eax
call esi
push dword [0x40e850]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4057c7
test ebx, ebx
je 0x4057c7
call edi
test eax, eax
je 0x4057be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4057be
test byte [ebp - 8], 1
jne 0x4057c7
or dword [ebp + 0x10], 0x200000
jmp 0x4057fa
mov eax, dword [0x40e844]
cmp eax, dword [ebp - 0x18]
je 0x4057fa
push eax
call esi
test eax, eax
je 0x4057fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4057fa
mov eax, dword [0x40e848]
cmp eax, dword [ebp - 0x18]
je 0x4057fa
push eax
call esi
test eax, eax
je 0x4057fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40e840]
call esi
test eax, eax
je 0x405816
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405818
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a26
leave
ret

Function at 0x405a26
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d0f0]
jne 0x405a30
repz ret
jmp fcn.00406d63
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x2c123303
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
mov ecx, 0x2328386f
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4028a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4028b1
pop dword [ebp - 0x2c]
mov eax, 0x3495c6a4
sub eax, 0x34559df3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa981d689
add dword [ebp - 0x3c], 0xa4d06ec2
mov dword [ebp - 0x38], 0x429b167b
sub dword [ebp - 0x38], 0x1067ca36
mov dword [ebp - 0x34], 0x3fa14fb
sub dword [ebp - 0x34], 0xb7add0cd
mov dword [ebp - 0x30], 0xf96a9482
add dword [ebp - 0x30], 0x6956b7e
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe08fb900
sub dword [ebp - 0x3c], 0x6c1d4faa
mov dword [ebp - 0x38], 0xcfd8679b
add dword [ebp - 0x38], 0x7193f9da
mov dword [ebp - 0x34], 0x6c7f028b
sub dword [ebp - 0x34], 0x90f961f
mov dword [ebp - 0x30], 0x6bb614f
add dword [ebp - 0x30], 0xf9449eb1
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xd3f25922
add eax, 0x2c4e16fe
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x36ec0
push 0
call eax
mov ecx, 0x8cb9d1a7
add ecx, 0x7346732c
xor ebx, ebx
add ebx, eax
mov esi, 0x40c800
add esi, dword [ebp - 0x2c]
mov edx, 0x3a59f475
sub dword [ebp - 8], edx
mov edi, dword [esi]
sub edi, edx
xor dword [ebp - 0x18], 0x30919b8f
mov dword [ebx], edi
xor dword [ebp - 0x14], edx
add ebx, 0x8d169686
add ebx, 0x72e9697e
add esi, 0x1a967f2
add esi, 0xfe569812
loop 0x4029c4
add eax, 0x12a6e8af
sub eax, 0x12a5e290
xor ebx, ebx
add ebx, eax
add eax, 0x1ea7826
sub eax, 0x1ea7821
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004028a2
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004028a2
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x40539b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c5b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404095
and dword [ebp - 0x14], 0
cmp dword [0x40dfc8], 0
mov dword [ebp - 0x18], eax
jne 0x40544e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4054f6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4054f6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40dfc8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40dfcc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40dfd0], eax
call edi
push eax
call esi
mov dword [0x40dfd8], eax
test eax, eax
je 0x40544e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40dfd4], eax
mov eax, dword [0x40dfd4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4054a7
cmp dword [0x40dfd8], ecx
je 0x4054a7
push eax
call esi
push dword [0x40dfd8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4054a7
test ebx, ebx
je 0x4054a7
call edi
test eax, eax
invalid
je 0x40549e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40549e
test byte [ebp - 8], 1
jne 0x4054a7
or dword [ebp + 0x10], 0x200000
jmp 0x4054da
mov eax, dword [0x40dfcc]
cmp eax, dword [ebp - 0x18]
je 0x4054da
push eax
call esi
test eax, eax
je 0x4054da
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4054da
mov eax, dword [0x40dfd0]
cmp eax, dword [ebp - 0x18]
je 0x4054da
push eax
call esi
test eax, eax
je 0x4054da
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40dfc8]
call esi
test eax, eax
je 0x4054f6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4054f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405706
leave
ret

Function at 0x405706
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c5b0]
jne 0x405710
repz ret
jmp fcn.00406a43
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x423f3d54
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xda875cc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40cb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40cb4f
pop dword [ebp - 0x38]
mov eax, 0xa88a1fb9
sub eax, 0xa849546a
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3bd31
push 0
mov eax, 0x8efbd277
add eax, 0x71450ea9
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xc076754
add ecx, 0xf3f8eaa3
mov ebx, eax
mov esi, 0xfacc2d49
sub esi, 0xfa8ab549
add esi, dword [ebp - 0x38]
mov edi, 0xd9cd1695
mov dword [ebp - 8], 0x76085cd1
mov edx, dword [esi]
add edx, edi
mov dword [ebp - 0x10], 0x5e87ebb3
mov dword [ebx], edx
xor dword [ebp - 8], edx
add ebx, 0x5dbfe8a3
add ebx, 0xa2401761
add esi, 4
loop 0x40cba8
add eax, 0x954766f6
sub eax, 0x95462c47
mov ebx, eax
add eax, 5
mov ecx, 0x8fce2109
add ecx, 0x7071def7
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e85
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
sub byte [esi + edi], 0x71
call ebx
add byte [esi + edi], 0x52
call ebx
xor byte [esi + edi], 0xfe
call ebx
add byte [esi + edi], 0xc8
call ebx
add byte [esi + edi], 0x9d
call ebx
add byte [esi + edi], 0xa4
call ebx
add byte [esi + edi], 0xbd
call ebx
xor byte [esi + edi], 0x3d
call ebx
add byte [esi + edi], 0xc4
call ebx
add byte [esi + edi], 0x87
call ebx
xor byte [esi + edi], 0xe1
call ebx
add byte [esi + edi], 0x6f
call ebx
add byte [esi + edi], 0x6c
call ebx
add byte [esi + edi], 0xb9
call ebx
add byte [esi + edi], 0xb9
call ebx
add byte [esi + edi], 0xa4
call ebx
xor byte [esi + edi], 0x3f
call ebx
add byte [esi + edi], 0x6b
call ebx
add byte [esi + edi], 0xb9
call ebx
add byte [esi + edi], 0xdd
call ebx
add byte [esi + edi], 0xd2
call ebx
add byte [esi + edi], 0x36
call ebx
add byte [esi + edi], 0x31
call ebx
add byte [esi + edi], 0x27
call ebx
add byte [esi + edi], 0x53
call ebx
xor byte [esi + edi], 0xf9
call ebx
add byte [esi + edi], 0x17
call ebx
add byte [esi + edi], 0x43
call ebx
add byte [esi + edi], 0x44
call ebx
add byte [esi + edi], 0xee
call ebx
add byte [esi + edi], 0xeb
call ebx
xor byte [esi + edi], 0xc8
call ebx
xor byte [esi + edi], 0x70
call ebx
xor byte [esi + edi], 0x92
call ebx
add byte [esi + edi], 0xfb
call ebx
add byte [esi + edi], 0x67
call ebx
xor byte [esi + edi], 0x76
call ebx
add byte [esi + edi], 0x25
call ebx
add byte [esi + edi], 0x88
call ebx
xor byte [esi + edi], 0xb8
call ebx
add byte [esi + edi], 0x12
call ebx
xor byte [esi + edi], 0x99
call ebx
add byte [esi + edi], 0x15
call ebx
xor byte [esi + edi], 0x87
call ebx
add byte [esi + edi], 0xc2
call ebx
xor byte [esi + edi], 0x6d
call ebx
add byte [esi + edi], 0xbb
call ebx
add byte [esi + edi], 0x7b
call ebx
add byte [esi + edi], 0x7f
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x4460ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f78
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e6
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f90
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f40
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f4c
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f7a
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4239a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.TGOqOPny
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x4239c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4239c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4239b8
mov eax, 1
add ebx, ebx
jne 0x4239db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4239d0
jne 0x4239ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4239d0
xor ecx, ecx
sub eax, 3
jb 0x423a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423a72
mov ebp, eax
add ebx, ebx
jne 0x423a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423a3c
inc ecx
add ebx, ebx
jne 0x423a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423a1d
jne 0x423a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423a4d
jmp 0x4239be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423a5c
add edi, ecx
jmp 0x4239be
pop esi
mov edi, esi
mov ecx, 0x138
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423a7a
cmp byte [edi], 6
jne 0x423a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423a7f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23030]
or eax, eax
je 0x423ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x423ac9
call dword [esi + 0x2302c]
mov ebp, dword [esi + 0x23034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423b22
sub esp, 0xffffff80
jmp 0x4038fc
Function at 0x414dda
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], edi
sub eax, 0x872d207a
sub eax, 1
sub eax, 0xd5afd88e
add ebx, 4
inc ecx
cmp ebx, esi
jne fcn.00414dda
dec edx
add ecx, ecx
or edx, eax
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510b42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
lea ecx, [ebp - 0x78]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
call fcn.00401d93
add esp, 4
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x90]
push edx
lea ecx, [ebp - 0x78]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c]
call sub.MFC42.DLL_CString::CString
push 0x51a140
lea ecx, [ebp - 0x78]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x4013b8
mov dword [ebp - 0x80], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x80]
jmp 0x401479
mov eax, dword [ebp - 0x74]
push eax
push 1
push 0x64
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov edx, dword [ebp - 0x56]
and edx, 0xff
cmp edx, 0x4b
jne 0x40141f
mov eax, dword [ebp - 0x55]
and eax, 0xff
cmp eax, 0x41
jne 0x40141f
mov ecx, dword [ebp - 0x54]
and ecx, 0xff
cmp ecx, 0x69
jne 0x40141f
mov edx, dword [ebp - 0x53]
and edx, 0xff
cmp edx, 0x53
jne 0x40141f
mov eax, dword [ebp - 0x52]
and eax, 0xff
cmp eax, 0x45
jne 0x40141f
mov ecx, dword [ebp - 0x51]
and ecx, 0xff
cmp ecx, 0x52
je 0x40144d
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x84], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x84]
jmp 0x401479
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x88], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401bae
Capabilities:
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510bb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push 0x100
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.Bin.dat
lea ecx, [ebp - 0x314]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x51a214
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x401c20
mov eax, 2
jmp 0x401d85
mov dword [ebp - 0x110], 0x100
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
lea edx, [ebp - 0x418]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x318], 0
jmp 0x401c87
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x318]
add ecx, 1
mov dword [ebp - 0x318], ecx
mov edx, dword [ebp - 0x318]
cmp edx, dword [ebp - 0x41c]
jne 0x401c9f
mov dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x420]
push eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov ecx, dword [ebp - 0x318]
movsx edx, byte [ebp + ecx - 0x418]
xor eax, edx
mov ecx, dword [ebp - 0x214]
mov byte [ebp + ecx - 0x10c], al
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
je 0x401cde
jmp 0x401ce0
jmp 0x401c69
mov ecx, dword [ebp - 0x214]
mov byte [ebp + ecx - 0x10c], 0
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0x51a218
push str.SoftwareSatinfoSatUpdater
push 0x80000002
lea eax, [ebp - 0x424]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x428]
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x42c]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x210]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x401d83
mov eax, 1
jmp 0x401d85
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret