joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ad45
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ade2
push ebx
push esi
call fcn.0041ad0e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041997a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41ad8f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ade1
push edi
push eax
call fcn.004152da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41adaf
call fcn.00414896
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ade0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041997a
add esp, 0x20
test eax, eax
jne 0x41adce
push edi
call fcn.00414896
jmp 0x41add6
push ebx
call fcn.00414896
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4216d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4216fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4216fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1018650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x1018672
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1018679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1018668
mov eax, 1
add ebx, ebx
jne 0x101868b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1018680
jne 0x101869c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1018680
xor ecx, ecx
sub eax, 3
jb 0x10186b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1018722
mov ebp, eax
add ebx, ebx
jne 0x10186bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10186c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10186ec
inc ecx
add ebx, ebx
jne 0x10186d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10186cd
jne 0x10186e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10186cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x101870c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10186fd
jmp 0x101866e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x101870c
add edi, ecx
jmp 0x101866e
pop esi
mov edi, esi
mov ecx, 0x341
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x101872a
cmp byte [edi], 1
jne 0x101872a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x101872f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x10187a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ebac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ec74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101875c
mov ecx, edi
jns 0x101878b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ec78]
or eax, eax
je 0x10187a1
mov dword [ebx], eax
add ebx, 4
jmp 0x1018779
call dword [esi + 0x1ec88]
mov ebp, dword [esi + 0x1ec7c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10187db
sub esp, 0xffffff80
jmp 0x1003d09
Function at 0x401020
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [eax]
movzx eax, word [esi]
test ax, ax
je 0x4011df
mov dword [ebp - 0x1c], edx
xor ecx, ecx
xor ebx, ebx
xor edi, edi
jmp 0x40105f
cmp ax, 0x5c
jne 0x4010c0
add ebx, 1
lea edx, [ecx + 1]
movzx eax, word [esi + edx*2]
test ax, ax
je 0x40107d
mov ecx, edx
cmp ax, 9
je 0x40106b
cmp ax, 0x20
jne 0x401048
test edi, edi
je 0x4010d0
lea edx, [ecx + 1]
xor ebx, ebx
movzx eax, word [esi + edx*2]
test ax, ax
jne 0x40105d
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx + ecx + 4]
mov dword [ebp - 0x20], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x4010e0
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0x22
jne 0x40106f
and ebx, 1
jne 0x40106f
xor edi, 1
jmp 0x401051
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx + ecx + 2]
jmp 0x401084
mov ecx, dword [edx]
movzx eax, word [ecx]
test ax, ax
je 0x4011e9
mov esi, dword [ebp - 0x1c]
lea ebx, [ecx + 2]
xor edi, edi
xor edx, edx
jmp 0x401126
mov ecx, ebx
cmp ax, 0x5c
jne 0x401190
mov eax, 0x5c
add edi, 1
add esi, 2
mov word [esi - 2], ax
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x40114f
cmp ax, 9
je 0x401132
cmp ax, 0x20
jne 0x401100
test edx, edx
je 0x4011d4
mov word [esi], ax
movzx eax, word [ebx]
mov ecx, ebx
add esi, 2
xor edi, edi
add ebx, 2
test ax, ax
jne 0x401126
mov edx, dword [ebp - 0x20]
xor eax, eax
mov word [esi], ax
mov dword [edx], ecx
movzx eax, word [ecx]
cmp ax, 0x20
je 0x40116c
cmp ax, 9
jne 0x4010b5
add ecx, 2
nop
mov dword [edx], ecx
movzx eax, word [ecx]
add ecx, 2
cmp ax, 9
je 0x401170
cmp ax, 0x20
je 0x401170
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0x22
jne 0x40113a
mov eax, edi
shr eax, 0x1f
add eax, edi
sar eax, 1
and edi, 1
jne 0x4011b8
add eax, eax
xor edx, 1
xor edi, edi
sub esi, eax
jmp 0x40111b
mov edi, 0x7fffffff
sub edi, eax
lea eax, [esi + edi*2]
mov edi, 0x22
mov word [eax], di
lea esi, [eax + 2]
xor edi, edi
jmp 0x40111b
mov edx, dword [ebp - 0x20]
lea ecx, [ebx - 2]
jmp 0x401152
mov ecx, 2
jmp 0x401084
mov esi, dword [ebp - 0x1c]
jmp 0x401152
Function at 0x402ea0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402f10
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402f77
xor ecx, ecx
xor edx, edx
jmp 0x402f59
cmp ax, 0x5c
jne 0x402fe8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402f77
cmp ax, 9
je 0x402f65
cmp ax, 0x20
jne 0x402f40
test ecx, ecx
je 0x402fd3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402f59
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403008
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401520
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x402fd0
cmp ax, 0x20
je 0x402fd0
jmp 0x402f77
cmp ax, 0x22
jne 0x402f69
and edx, 1
jne 0x402f69
xor ecx, 1
jmp 0x402f4d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x402f90
Function at 0x402f10
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402f10
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402f77
xor ecx, ecx
xor edx, edx
jmp 0x402f59
cmp ax, 0x5c
jne 0x402fe8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402f77
cmp ax, 9
je 0x402f65
cmp ax, 0x20
jne 0x402f40
test ecx, ecx
je 0x402fd3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402f59
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403008
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401520
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x402fd0
cmp ax, 0x20
je 0x402fd0
jmp 0x402f77
cmp ax, 0x22
jne 0x402f69
and edx, 1
jne 0x402f69
xor ecx, 1
jmp 0x402f4d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x402f90
Function at 0x100033f9
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10011040]
xor eax, ebp
mov dword [ebp - 4], eax
dec ecx
cmp ecx, 7
ja case.default.0x10003412
jmp dword [ecx*4 + 0x1000355d]
xor byte [0x52c9ee], 1
jmp case.default.0x10003412
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
jmp case.default.0x10003412
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp case.default.0x10003412
mov byte [0x53e94c], 1
mov byte [0xbab318], 0
jmp case.default.0x10003412
mov eax, 0x15f90
mov dword [0x5b8e55], eax
mov dword [0x5b8eb0], eax
jmp case.default.0x10003412
mov dword [0x53e170], 0x90909090
mov byte [0x53e174], 0x90
jmp case.default.0x10003412
and dword [0x736f88], 0
mov edx, 0x90909090
push edi
mov dword [0x555854], edx
mov edi, 0x5557cf
mov byte [0x555858], 0x90
mov eax, edx
mov dword [0xc2b9cc], 0x3eb3b675
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
jmp case.default.0x10003412
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10011f40]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10011ffc]
cmp eax, dword [ecx + 4]
jle 0x10003500
mov esi, 0x10011ffc
push esi
call fcn.10008224
cmp dword [0x10011ffc], 0xffffffff
pop ecx
jne 0x10003500
xor ecx, ecx
call fcn.10006c42
push esi
mov dword [0x10011ff8], eax
call fcn.100081d3
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
mov eax, dword [0x10011ff8]
push 0x40
push 0x14
add eax, 0x5cf2c
push eax
call esi
mov eax, dword [0x10011ff8]
mov edx, 0x90909090
lea ecx, [eax + 0x5cf2c]
mov dword [ecx], edx
mov byte [eax + 0x5cf30], 0x90
mov dword [eax + 0x5cf39], edx
mov byte [eax + 0x5cf3d], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x14
push ecx
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008187
leave
ret
Function at 0x10003b21
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xc
mov eax, 0x10009702
call fcn.100091be
xor ecx, ecx
call fcn.10006c42
test eax, eax
je 0x10003bea
push 0x28
mov dword [ebp - 0x10], 0x747eb0
call fcn.10008195
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.100055ab
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
lea ecx, [eax + 0xc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
call fcn.10003d34
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10003b7e
call fcn.10001246
push 0x28
call fcn.10008195
mov ebx, eax
mov dword [ebp - 0x14], ebx
xor ecx, ecx
lea esi, [ebx + 0xc]
inc ecx
mov edi, ebx
mov dword [ebp - 4], ecx
xor eax, eax
push 0x53bee0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov ecx, esi
mov dword [ebx], vtable.std::_Ref_count_obj2_class_hook_void____cdecl___void___void____cdecl___void___.0
call fcn.10005e58
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.10003d67
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10003bd1
call fcn.10001246
push 0
push 0x40
push 0x4f3000
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.100035a9
mov eax, 0x10011f8a
call fcn.1000919b
ret

Function at 0x100045e7
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edi + edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x100045f4
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
ret 4

Function at 0x10004799
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x100047a5
pop esi
mov eax, edx
ret 4

Function at 0x100052a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10011040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 5
pop edx
mov esi, ecx
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 8]
push ecx
push 0x40
mov eax, dword [esi]
push edx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 8]
call fcn.10004893
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
push eax
push dword [esi + 8]
push dword [esi]
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.10005573
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10008187
leave
ret
Function at 0x10005308
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10011040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 5
pop edi
mov esi, ecx
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x10]
push ecx
push 0x40
mov eax, dword [esi]
push edi
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x10]
call fcn.10004893
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x14]
mov byte [ebp - 0xc], 0xe9
push edi
mov eax, dword [eax + 0x1c]
sub eax, dword [esi]
sub eax, edi
mov dword [ebp - 0xb], eax
lea eax, [ebp - 0xc]
push eax
push dword [esi]
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [esi + 0xc]
add esp, 0xc
sub edx, dword [esi + 8]
cmp edx, edi
jbe 0x10005382
mov eax, dword [esi]
lea ecx, [eax + 5]
sub eax, ecx
add eax, edx
push eax
push 0x90
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.10005573
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10008187
leave
ret
Function at 0x404b14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
and dword [esp + 4], 0
push ebx
push esi
push edi
pushal
xor eax, eax
dec eax
xor ebx, eax
mov dword [esp + 0x30], ebx
popal
push str.V3.5_n
call dword [sym.imp.MSVCR90.dll_printf]
cmp dword [0x4093a8], 0
pop ecx
jne 0x404b4d
call fcn.0040435c
cmp dword [0x4093a4], 0
jne 0x404b5b
call fcn.0040429c
call fcn.0040459d
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi]
call fcn.00404144
lea eax, [esp + 0x14]
push eax
call fcn.00403faf
mov dword [0x4093ac], eax
lea eax, [esp + 0x38]
push eax
call fcn.00403f65
push dword [esp + 0xc]
push dword [esi]
call fcn.00404033
push eax
mov dword [0x4093b0], eax
call dword [sym.imp.MSVCR90.dll__msize]
pop ecx
mov esi, eax
push esi
call fcn.00403fe4
mov eax, esi
imul eax, eax, 3
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0040327f
test edi, edi
je 0x404bf3
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x10]
push edi
call fcn.004043b2
lea eax, [esp + 0x38]
push eax
call dword [0x409398]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404267
int3

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x3c9156a4
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x3e0e274a
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4028c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x11
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x4028d8
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x4028e6
xor eax, eax
jmp 0x4028ff
call fcn.004027c0
test eax, eax
je 0x4028e2
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.004027e0
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 1
and ecx, eax
test ecx, 0x8000000
je 0x4028d2
xor ecx, ecx
xgetbv
mov eax, ecx
shr eax, 2
shr ecx, 1
and eax, ecx
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402a6f
push str.SetDefaultDllDirectories
push 0x9d66b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a6f
push 0xc00
call eax
test eax, eax
jne 0x402b07
push 0x106
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402b07
cmp eax, 0x104
ja 0x402b07
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x402aa9
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d0], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402b06
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ebx, [ebp + eax*2 - 0x2d0]
mov cl, byte [esi]
inc esi
mov eax, ebx
test cl, cl
je 0x402ae0
movzx edx, cl
mov cl, byte [esi]
mov word [eax], dx
add eax, 2
inc esi
test cl, cl
jne 0x402ad0
xor ecx, ecx
push 8
push ecx
lea edx, [ebp - 0x2d0]
push edx
mov dword [eax], 0x64002e
mov dword [eax + 4], 0x6c006c
mov word [eax + 8], cx
call edi
cmp byte [esi], 0
jne 0x402ac7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407410
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x98
xor ebx, ebx
lea eax, [esi + 0x110]
push ebx
push eax
call fcn.0096d0c0
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
lea edi, [ecx + eax]
mov dword [esi + 0x40], eax
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 0x18]
shr edx, 3
imul edx, edx, 0x54
mov ecx, edi
sub ecx, edx
add esp, 0xc
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xc], eax
mov edx, eax
cmp eax, 0xc
jb 0x407470
mov edx, 0xc
or eax, 0xffffffff
sub eax, edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea eax, [edi - 0xc]
lea edx, [ecx + 0x600]
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ecx
mov edx, 0x100
mov word [eax], dx
mov edx, 0x101
mov word [eax + 2], dx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
xor edx, edx
lea eax, [ecx + 2]
xor ecx, ecx
mov byte [eax - 2], dl
mov byte [eax - 1], 1
mov word [eax], cx
mov word [eax + 2], cx
inc edx
add eax, 6
cmp edx, 0x100
jb 0x4074b1
lea edx, [esi + 0x9fc]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
jmp 0x4074e2
xor ebx, ebx
mov edi, dword [ebp - 8]
jmp 0x4074f0
movzx eax, word [ebx + 0x9d6700]
mov ecx, dword [ebp - 4]
xor edx, edx
add ecx, 2
div ecx
mov edx, 0x4000
sub edx, eax
movzx ecx, dx
xor eax, eax
lea ecx, [ecx]
mov word [edi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x407510
add ebx, 2
add edi, 2
cmp ebx, 0x10
jb 0x4074f0
mov eax, dword [ebp - 4]
sub dword [ebp - 8], 0xffffff80
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x80
jb 0x4074e0
mov ecx, 0x50
lea edi, [esi + 0x3bc]
lea ebx, [ecx - 0x4c]
jmp 0x407550
mov eax, edi
mov edx, 0x10
jmp 0x407560
mov word [eax], cx
mov word [eax + 2], 0x403
add eax, ebx
dec edx
jne 0x407560
add ecx, 0x28
add edi, 0x40
cmp ecx, 0x438
jb 0x407550
pop edi
mov dword [esi + 0x3b8], 0x40070000
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408450
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [section..data]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x20], 0x6a09e667
mov dword [eax + 0x24], 0xbb67ae85
mov dword [eax + 0x28], 0x3c6ef372
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0x510e527f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
pop ebp
ret 4