joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c31e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xd7], 0
lea ecx, [ebp - 0x84]
push ecx
push 1
push str.CITY
mov edx, dword [ebp + 8]
push edx
call fcn.004558a2
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42c470
lea eax, [ebp - 0x84]
push eax
call fcn.0040539b
add esp, 4
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x42c433
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x91], 8
jne 0x42c3a6
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406ed2
add esp, 8
mov eax, 1
jmp 0x42c472
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x91], 0x2000
jne 0x42c3c4
mov edx, dword [ebp + 0xc]
mov dword [edx + 0xd7], 0
jmp 0x42c431
mov eax, dword [ebp - 0x88]
cmp dword [eax + 0x10], 0
jne 0x42c405
mov ecx, dword [ebp + 0xc]
push ecx
push 0x48c3ec
call fcn.004504c0
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x91], 8
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406ed2
add esp, 8
xor eax, eax
jmp 0x42c472
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406d93
add esp, 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xcb]
mov dword [ecx + 0xcf], eax
mov eax, 1
jmp 0x42c472
jmp 0x42c470
movsx ecx, byte [ebp - 0x84]
test ecx, ecx
je 0x42c456
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x48c3fc
call fcn.004504c0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x91], 0x2000
mov edx, dword [ebp + 0xc]
mov dword [edx + 0xd7], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42d9f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov dword [ebp - 0xb0], 0
jmp 0x42da14
mov eax, dword [ebp - 0xb0]
add eax, 1
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
cmp ecx, dword [0x4bd298]
jg 0x42dc42
mov edx, dword [ebp - 0xb0]
push edx
push str.CITY_02d
lea eax, [ebp - 0x24]
push eax
call fcn.0046e643
add esp, 0xc
lea ecx, [ebp - 0x24]
push ecx
push 0x48c680
lea edx, [ebp - 0xd0]
push edx
call fcn.0046e643
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
push 0
lea ecx, [ebp - 0xd0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00455753
add esp, 0x10
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x42dc3d
lea eax, [ebp - 0xac]
push eax
call fcn.0046e880
add esp, 4
cmp eax, 0xc
jae 0x42dc3d
call fcn.004051eb
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xb0]
mov dword [ecx + 0x14], edx
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.0046e790
add esp, 8
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042d689
add esp, 0xc
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00405432
add esp, 8
push 0
push str.MONEY
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042c1d0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x92], eax
push 0
push 0x48c690
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c1d0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x8e], eax
push 0
push str.POPULATION
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c1d0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x8a], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x8a]
cdq
mov ecx, 0x9c4
idiv ecx
add eax, 0x6e
mov edx, dword [ebp - 4]
mov dword [edx + 0x82], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x82], 0x258
jge 0x42db85
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x82]
mov dword [ebp - 0xd4], edx
jmp 0x42db8f
mov dword [ebp - 0xd4], 0x258
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xd4]
mov dword [eax + 0x82], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x86], 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042d70e
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042d8b3
add esp, 0xc
push 0
push str.FLAGS
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c1d0
add esp, 0x10
mov edx, dword [ebp - 4]
mov dword [edx + 0x9e], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00406056
add esp, 4
push 3
push 0x48c6ac
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042c1d0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6c], ax
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x6c]
cmp eax, 5
jg 0x42dc34
mov ecx, dword [ebp - 4]
movsx edx, word [ecx + 0x6c]
test edx, edx
jg 0x42dc3d
mov eax, dword [ebp - 4]
mov word [eax + 0x6c], 3
jmp 0x42da05
mov esp, ebp
pop ebp
ret
Function at 0x42dc46
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
call fcn.0040546f
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x42de7b
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x8c], ecx
mov edx, dword [ebp - 0x8c]
push edx
push str.CITY_02dMAJOR
lea eax, [ebp - 0xb0]
push eax
call fcn.0046e643
add esp, 0xc
lea ecx, [ebp - 0x84]
push ecx
push 0
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00455753
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42dd49
lea ecx, [ebp - 0x84]
push ecx
call fcn.00406a0b
add esp, 4
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x42dce9
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x88]
mov dword [edx + 0x14], eax
jmp 0x42dd47
mov ecx, dword [ebp - 0x90]
cmp dword [ecx + 0x24], 0
jne 0x42dd0d
cmp dword [ebp - 0x88], 0
je 0x42dd3a
mov edx, dword [ebp - 0x88]
cmp dword [edx + 0x91], 1
je 0x42dd3a
mov eax, dword [ebp - 0x90]
add eax, 4
push eax
lea ecx, [ebp - 0x84]
push ecx
push 0x48c6c4
call fcn.004504c0
add esp, 0xc
mov edx, dword [ebp - 0x90]
mov dword [edx + 0x14], 0
jmp 0x42dd47
mov eax, dword [ebp - 0x90]
mov dword [eax + 0x14], 0
jmp 0x42dd73
mov ecx, dword [ebp - 0x90]
cmp dword [ecx + 0x24], 0
je 0x42dd73
mov edx, dword [ebp - 0x90]
add edx, 4
push edx
lea eax, [ebp - 0x84]
push eax
push 0x48c6e0
call fcn.004504c0
add esp, 0xc
mov ecx, dword [ebp - 0x8c]
push ecx
push str.CITY_02dWISE
lea edx, [ebp - 0xb0]
push edx
call fcn.0046e643
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
push 0
lea ecx, [ebp - 0xb0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00455753
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x42de46
lea eax, [ebp - 0x84]
push eax
call fcn.00406a0b
add esp, 4
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x42dde6
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0xb4]
mov dword [ecx + 0x18], edx
jmp 0x42de44
mov eax, dword [ebp - 0x90]
cmp dword [eax + 0x24], 0
jne 0x42de0a
cmp dword [ebp - 0xb4], 0
je 0x42de37
mov ecx, dword [ebp - 0xb4]
cmp dword [ecx + 0x91], 1
je 0x42de37
mov edx, dword [ebp - 0x90]
add edx, 4
push edx
lea eax, [ebp - 0x84]
push eax
push 0x48c708
call fcn.004504c0
add esp, 0xc
mov ecx, dword [ebp - 0x90]
mov dword [ecx + 0x18], 0
jmp 0x42de44
mov edx, dword [ebp - 0x90]
mov dword [edx + 0x18], 0
jmp 0x42de64
mov eax, dword [ebp - 0x90]
add eax, 4
push eax
lea ecx, [ebp - 0x84]
push ecx
push 0x48c724
call fcn.004504c0
add esp, 0xc
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0xa6]
mov dword [ebp - 0x90], eax
jmp 0x42dc5a
mov esp, ebp
pop ebp
ret
Function at 0x4504c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1fc], eax
mov ecx, dword [ebp - 0x1fc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x1f8]
push eax
call fcn.0046ee9e
add esp, 0xc
mov dword [ebp - 0x1fc], 0
lea ecx, [ebp - 0x1f8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x29c], 0x94
lea edx, [ebp - 0x29c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x28c], 1
je 0x450528
jmp 0x450667
push str.DBWIN_BUFFER_READY
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jne 0x45054b
jmp 0x450667
push str.DBWIN_DATA_READY
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x45057b
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x450667
push str.DBWIN_BUFFER
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4505bb
mov ecx, dword [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x450667
push 0x200
push 0
push 0
push 2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jne 0x4505fb
mov ecx, dword [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x450667
push 0xffffffffffffffff
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, dword [ebp - 0x200]
mov dword [ecx], eax
lea edx, [ebp - 0x1f8]
push edx
push 0x4923b4
mov eax, dword [ebp - 0x200]
add eax, 4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x450bc2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
push str._nGroup
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 4], 0
je 0x450bfc
mov edx, dword [ebp - 4]
push edx
push str.___08X
call fcn.004504c0
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp 0x450bda
mov esp, ebp
pop ebp
ret
Function at 0x4522de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4522f4
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x452347
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x14
mov dword [ecx + 0x4c8340], 0
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
mov dword [edx + 0x4c8344], 0
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
mov dword [eax + 0x4c8348], 0
mov ecx, dword [ebp - 4]
add ecx, 1
imul ecx, ecx, 0x14
add ecx, 0x4c8340
mov edx, dword [ebp - 4]
imul edx, edx, 0x14
mov dword [edx + 0x4c8350], ecx
jmp 0x4522eb
mov dword [0x4c83e0], 0
mov dword [0x4c83dc], 0
mov dword [0x4c8324], 0x4c8340
mov dword [0x4c7df0], 0
mov eax, dword [0x4c7df0]
mov dword [0x4c83e4], eax
mov dword [ebp - 4], 0
jmp 0x45238b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x20
jge 0x4523f2
mov edx, dword [ebp - 4]
imul edx, edx, 0x24
mov eax, dword [ebp - 4]
mov dword [edx + 0x4c7ea0], eax
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x24
mov dword [ecx + 0x4c7ea4], 0
mov edx, dword [ebp - 4]
imul edx, edx, 0x24
mov dword [edx + 0x4c7ea8], 0
mov eax, dword [ebp - 4]
imul eax, eax, 0x24
mov dword [eax + 0x4c7eac], 0
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x24
mov dword [ecx + 0x4c7eb0], 0
mov edx, dword [ebp - 4]
imul edx, edx, 0x24
mov dword [edx + 0x4c7eb4], 0
jmp 0x452382
mov dword [0x4c7dec], 0
push 0x4923f8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x4923f8
call fcn.00452290
add esp, 4
mov dword [0x4923f0], 1
mov dword [0x4923f4], 1
mov esp, ebp
pop ebp
ret

Function at 0x454022
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x492524]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
jmp 0x454046
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1a
jge 0x454074
mov ecx, dword [ebp - 4]
add ecx, 0x41
mov byte [ebp - 0x10], cl
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jne 0x454072
mov eax, dword [ebp - 4]
mov dword [0x492520], eax
jmp 0x454074
jmp 0x45403d
mov eax, dword [0x492520]
mov esp, ebp
pop ebp
ret

Function at 0x45407d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x492528]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
jmp 0x4540a2
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x1a
jge 0x4540d1
mov eax, dword [ebp - 4]
add eax, 0x41
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jne 0x4540cf
mov edx, dword [ebp - 4]
mov dword [0x492520], edx
jmp 0x4540d1
jmp 0x454099
mov esp, ebp
pop ebp
ret
Function at 0x457e91
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
enter 0x10, 0
push eax
push ebx
push ecx
push edx
push esi
push edi
mov eax, 0xff
imul eax, dword [ebp + 8]
xor edx, edx
idiv dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 0x10]
mov ebx, 0xff
mov edi, 0xff
mov eax, edi
shr eax, 3
and eax, 0x1c
imul eax, dword [ebp - 8]
xor edx, edx
idiv ebx
and eax, 0xff
shr eax, 2
shl eax, 5
mov dword [ebp - 0x10], eax
mov eax, edi
shl eax, 3
and eax, 0xf8
imul eax, dword [ebp - 0xc]
xor edx, edx
idiv ebx
and eax, 0xff
shr eax, 3
or eax, dword [ebp - 0x10]
mov word [esi + edi*2], ax
mov eax, edi
shl eax, 5
and eax, 0xe0
imul eax, dword [ebp - 8]
xor edx, edx
idiv ebx
and eax, 0xff
shr eax, 2
shl eax, 5
mov dword [ebp - 0x10], eax
mov eax, edi
and eax, 0xf8
imul eax, dword [ebp - 4]
xor edx, edx
idiv ebx
and eax, 0xff
shr eax, 3
shl eax, 0xb
or eax, dword [ebp - 0x10]
mov word [esi + edi*2 + 0x200], ax
dec edi
jns 0x457ebf
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
ret

Function at 0x47a20a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x214], 0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
mov ecx, dword [0x4a5eb0]
push ecx
push DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47a2bf
mov dword [ebp - 0x210], 0x100
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4a80ac
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47a2b2
mov byte [ebp - 4], 1
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x314]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x4a5eb8
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x6d696776
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x204d420f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3f9814f5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x7e562a56
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x7a8a361f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x26af3c32
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40c9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c57a8
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x40ca5e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40ca5e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40ca40
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c57a8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret

Function at 0x40ca80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c57e0
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x40caee
movzx ecx, word [esi + eax]
test cx, cx
je 0x40caee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40cad0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c57e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret

Function at 0x40cb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c57c4
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x40cb7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40cb7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40cb60
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c57c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret
Function at 0x424ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c5840
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x42505e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42505e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x425040
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c5840
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret

Function at 0x425080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c585c
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4250ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4250ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4250d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c585c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret
Function at 0x448370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c59a4
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4483de
movzx ecx, word [esi + eax]
test cx, cx
je 0x4483de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4483c0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c59a4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret
Function at 0x44f000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c5a20
mov dword [ebp - 0x1c], 0x680053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], str.a7xc
mov dword [ebp - 0x14], 0x33006c
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0032
sub esi, eax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x44f06e
movzx ecx, word [esi + eax]
test cx, cx
je 0x44f06e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44f050
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c5a20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c10d
mov esp, ebp
pop ebp
ret