joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test ebx, ebx
je 0x10001d50
mov edi, dword [ebx + 0x1c]
test edi, edi
je 0x10001d50
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10001d50
cmp dword [edi + 0x18], 2
je 0x10001d50
cmp dword [edi + 0x18], 1
jne 0x10001ca7
cmp dword [edi + 4], 0x2a
jne 0x10001d50
cmp dword [edi + 0x18], 0
je 0x10001cc0
push esi
push eax
push dword [ebx + 0x30]
call sym.zlib.dll_adler32
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp esi, 3
jae 0x10001ccc
xor eax, eax
jmp 0x10001d53
mov ebx, dword [edi + 0x2c]
cmp esi, ebx
jbe 0x10001cd9
sub esi, ebx
add eax, esi
jmp 0x10001cdb
mov ebx, esi
push ebx
push eax
push dword [edi + 0x38]
call fcn.10010a30
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x5c], ebx
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
add esp, 0xc
xor edx, eax
and edx, dword [edi + 0x54]
lea eax, [ebx - 3]
mov dword [edi + 0x48], edx
mov dword [ebp + 0x10], eax
xor ebx, ebx
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [eax + ebx + 2]
mov eax, dword [edi + 0x48]
mov edx, dword [edi + 0x34]
shl eax, cl
mov ecx, dword [edi + 0x40]
and edx, ebx
xor esi, eax
and esi, dword [edi + 0x54]
mov eax, dword [edi + 0x44]
mov dword [edi + 0x48], esi
mov ax, word [eax + esi*2]
mov word [ecx + edx*2], ax
mov ecx, dword [edi + 0x48]
mov eax, dword [edi + 0x44]
mov word [eax + ecx*2], bx
inc ebx
cmp ebx, dword [ebp + 0x10]
jbe 0x10001d10
jmp 0x10001cc5
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10002c9e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
sub esi, dword [edi + 0x6c]
add eax, 0xfffffefa
add eax, ebx
mov dword [ebp - 0xc], esi
cmp dword [edi + 0x6c], eax
jb 0x10002d39
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.10010a30
mov ecx, dword [edi + 0x4c]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
mov eax, dword [edi + 0x44]
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 8], ecx
lea edi, [eax + ecx*2]
mov esi, ecx
lea edi, [edi - 2]
xor ecx, ecx
movzx edx, word [edi]
mov eax, edx
sub eax, ebx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [edi], cx
dec esi
jne 0x10002cf2
mov edi, dword [ebp - 4]
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ebx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx edx, word [edi]
mov eax, edx
sub eax, ebx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [edi], cx
dec esi
jne 0x10002d17
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add esi, ebx
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x10002e01
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
push esi
add edx, dword [edi + 0x38]
call fcn.10002a56
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
pop ecx
jb 0x10002d7d
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x10002d92
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10002caf
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x10002e01
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x10002dd1
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.1000fb70
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x10002e01
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x10002e01
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
push esi
add eax, ecx
push 0
push eax
call fcn.1000fb70
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100080b4
Capabilities:
Terminate process

Disassembly:
push ecx
push dword [0x1002ed20]
push str._s:__s_n
call fcn.1000aaeb
add eax, 0x40
push eax
call fcn.1000afd6
add esp, 0x10
push 1
call fcn.1000ba46
int3
Function at 0x100080d9
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.10016060
mov eax, dword [0x1002c3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jmp 0x10008112
test esi, esi
je 0x10008137
push esi
lea eax, [ebp - 0x4004]
push eax
push ebx
call sym.zlib.dll_gzwrite
add esp, 0xc
cmp eax, esi
jne 0x10008171
push edi
push 0x4000
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.1000aec3
push edi
mov esi, eax
call fcn.1000b127
add esp, 0x14
test eax, eax
je 0x100080f9
jmp 0x1000815f
push edi
call fcn.1000b4d3
push ebx
call sym.zlib.dll_gzclose
pop ecx
pop ecx
test eax, eax
je 0x10008150
mov ecx, str.failed_gzclose
jmp 0x10008182
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a067
leave
ret
push str.fread
call fcn.1000a9c2
pop ecx
push 1
call fcn.1000ba46
lea eax, [ebp - 0x4008]
push eax
push ebx
call sym.zlib.dll_gzerror
pop ecx
pop ecx
mov ecx, eax
call fcn.100080b4
int3

Function at 0x10008188
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.10016060
mov eax, dword [0x1002c3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jmp 0x100081c3
push ebx
test esi, esi
je 0x100081f1
push esi
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.1000b2a4
add esp, 0x10
cmp eax, esi
jne 0x10008223
push 0x4000
lea eax, [ebp - 0x4004]
push eax
push edi
call sym.zlib.dll_gzread
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x100081a8
lea eax, [ebp - 0x4008]
push eax
push edi
call sym.zlib.dll_gzerror
pop ecx
pop ecx
mov ecx, eax
jmp 0x10008228
call fcn.1000b4d3
pop ecx
test eax, eax
je 0x10008202
mov ecx, str.failed_fclose
jmp 0x10008228
push edi
call sym.zlib.dll_gzclose
pop ecx
test eax, eax
je 0x10008214
mov ecx, str.failed_gzclose
jmp 0x10008228
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a067
leave
ret
mov ecx, str.failed_fwrite
call fcn.100080b4
int3
Function at 0x1000822e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x1002c3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000824b
sub ecx, edi
lea eax, [ecx + 3]
cmp eax, 0x400
jae 0x10008300
lea edx, [ebp - 0x404]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1000826c
lea edi, [ebp - 0x404]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000827d
mov eax, dword [0x1002a1a0]
push 0x1002a1a4
push esi
mov dword [edi], eax
call fcn.1000ac8b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x100082a8
push esi
call fcn.1000a9c2
pop ecx
jmp 0x1000831c
push ebx
or edx, 0xffffffff
lea ecx, [ebp - 0x404]
call fcn.10003943
pop ecx
test eax, eax
jne 0x100082e1
lea eax, [ebp - 0x404]
push eax
push dword [0x1002ed20]
push str._s:_cant_gzopen__s_n
call fcn.1000aaeb
add eax, 0x40
push eax
call fcn.1000afd6
add esp, 0x10
jmp 0x1000831c
mov edx, eax
mov ecx, edi
call fcn.100080d9
push esi
call fcn.100209d8
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a067
leave
ret
push dword [0x1002ed20]
push str._s:_filename_too_long_n
call fcn.1000aaeb
add eax, 0x40
push eax
call fcn.1000afd6
add esp, 0xc
push 1
call fcn.1000ba46
int3

Function at 0x10008324
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1002c3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10008340
sub esi, ecx
lea eax, [esi + 3]
cmp eax, 0x400
jae 0x1000842b
lea edx, [ebp - 0x404]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x10008361
push edi
cmp esi, 3
jbe 0x1000839b
push 4
lea eax, [ebx - 3]
add eax, esi
push 0x1002a1a0
push eax
call fcn.1001b6f9
add esp, 0xc
test eax, eax
jne 0x1000839b
mov byte [ebp + esi - 0x407], al
lea edi, [ebp - 0x404]
mov esi, ebx
jmp 0x100083b5
lea esi, [ebp - 0x404]
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100083a4
mov eax, dword [0x1002a1a0]
mov dword [edi], eax
mov edi, ebx
push 0x1002a1a4
or edx, 0xffffffff
mov ecx, esi
call fcn.10003943
pop ecx
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x100083ee
push esi
push dword [0x1002ed20]
push str._s:_cant_gzopen__s_n
call fcn.1000aaeb
add eax, 0x40
push eax
call fcn.1000afd6
add esp, 0x10
jmp 0x10008447
push 0x1002a1c0
push edi
call fcn.1000ac8b
pop ecx
pop ecx
pop edi
test eax, eax
jne 0x10008409
push ebx
call fcn.1000a9c2
pop ecx
jmp 0x10008447
mov ecx, dword [ebp - 0x408]
mov edx, eax
call fcn.10008188
push esi
call fcn.100209d8
pop ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a067
leave
ret
push dword [0x1002ed20]
push str._s:_filename_too_long_n
call fcn.1000aaeb
add eax, 0x40
push eax
call fcn.1000afd6
add esp, 0xc
push 1
call fcn.1000ba46
int3
Function at 0x10015b31
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1002c3f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1000dcaf
mov dword [ebp - 0x14], eax
cmp dword [0x1002dc38], edi
jne 0x10015c22
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10015baf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10015d02
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10015d02
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d02
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1002dc38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x1002dc3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1002dc40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1002dc48], eax
test eax, eax
je 0x10015c1f
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1002dc44], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10015c47
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10015c3a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10015c5c
push 4
pop eax
jmp 0x10015d04
cmp dword [ebp - 0x14], edi
je 0x10015c5c
push dword [0x1002dc38]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10015c41
mov eax, dword [0x1002dc44]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10015cba
cmp dword [0x1002dc48], esi
je 0x10015cba
push eax
call ebx
push dword [0x1002dc48]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10015cba
test eax, eax
je 0x10015cba
call ecx
test eax, eax
je 0x10015caf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10015caf
test byte [ebp - 8], 1
jne 0x10015cba
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x10015cea
mov eax, dword [0x1002dc3c]
cmp eax, esi
je 0x10015ce7
push eax
call ebx
test eax, eax
je 0x10015ce7
call eax
mov edi, eax
test edi, edi
je 0x10015ce7
mov eax, dword [0x1002dc40]
cmp eax, esi
je 0x10015ce7
push eax
call ebx
test eax, eax
je 0x10015ce7
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1002dc38]
call ebx
test eax, eax
je 0x10015d02
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10015d04
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a067
leave
ret
Function at 0x10019a20
Capabilities:
Inspect section memory permissions

Disassembly:
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10019a47

Function at 0x10019a98
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10019a29
mov edx, dword [ebp - 0xb4]
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10019aa5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10019a8c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10019a95
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10019a9f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10019a81
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10019a0b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10019af2
dec eax
je 0x10019ae9
sub eax, 3
je 0x10019ae0
mov dword [ebp - 4], 0x40
jmp 0x10019b0f
mov dword [ebp - 4], 4
jmp 0x10019af5
mov dword [ebp - 4], 0x20
jmp 0x10019af5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10019b41
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10019ac1
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10019352
dec eax
outsd dx, dword [esi]
cmp bl, ch
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x10019b4d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10019bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
invalid
invalid
Function at 0x10019c3a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x4fffff9], edx
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10019362
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10019317
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
invalid
invalid
invalid
cld
invalid

Function at 0x1001f462
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1000d758
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1001f49a
xor eax, eax
jmp 0x1001f4c6
cmp esi, dword [ebp - 4]
je 0x1001f4c3
cmp dword [ebp + 0xc], 0
je 0x1001f4c3
push dword [edi + 0x9c]
call fcn.1001f070
push dword [edi + 0x9c]
mov esi, eax
call fcn.10015a0d
pop ecx
pop ecx
cmp esi, eax
je 0x1001f496
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x43a07677
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x31167416
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4087f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448f3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
call fcn.00401620
mov ecx, eax
test ecx, ecx
je 0x4089a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push str.OXhWORhwPkJRoTsVnw
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004038c0
test al, al
jne 0x40885c
push 0x13
push str.OXhWORhwPkJRoTsVnw
mov ecx, esi
call fcn.00403de0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004023d0
add esp, 4
push dword [eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40889a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408970
lea esp, [esp]
lea eax, [ebp - 0x440]
push eax
push dword [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
call fcn.00401620
test eax, eax
je 0x4089a0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi], eax
push str.SklSoZ28ZITtvEPiE
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004038c0
test al, al
jne 0x40890b
push 0x13
push str.SklSoZ28ZITtvEPiE
mov ecx, esi
call fcn.00403de0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004023d0
add esp, 4
push dword [eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x14]
add esp, 0x10
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408946
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x46c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4088c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40898f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004013f0
int3