joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a184
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404448
xor eax, eax
push ebp
push 0x40a212
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402c6c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0xa
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404458
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40a1fa
xor ebx, ebx
jmp 0x40a1fc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a219
lea eax, [ebp - 4]
call fcn.00403fcc
ret

Function at 0x40a220
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov eax, ebx
call fcn.00403fcc
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x40a264
mov eax, ebx
mov edx, esp
call fcn.004041bc
mov eax, dword [ebx]
call fcn.00404260
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x40a264
mov eax, ebx
mov edx, 0x40a274
call fcn.00404268
add esp, 0x108
pop ebx
ret

Function at 0x40a3d4
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40a4ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40a4bd
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40a4b3
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40a4ad
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x194]
call fcn.004041bc
mov edx, dword [ebp - 0x194]
mov eax, 0x40a500
call fcn.004044a4
dec eax
je 0x40a4ac
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.004041bc
mov edx, dword [ebp - 0x198]
mov eax, 0x40a50c
call fcn.004044a4
dec eax
je 0x40a4ac
mov eax, dword [esi + ebx*4]
mov al, byte [eax]
mov byte [edi + 4], al
mov eax, dword [esi + ebx*4]
mov al, byte [eax + 1]
mov byte [edi + 5], al
mov eax, dword [esi + ebx*4]
mov al, byte [eax + 2]
mov byte [edi + 6], al
mov eax, dword [esi + ebx*4]
mov al, byte [eax + 3]
mov byte [edi + 7], al
jmp 0x40a4b3
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x40a433
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a4c7
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a4f1
lea eax, [ebp - 0x198]
mov edx, 2
call fcn.00403ff0
ret
Function at 0x40a538
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404458
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a555
and eax, 0x10
cmp eax, 0x10
je 0x40a559
xor eax, eax
jmp 0x40a55b
mov al, 1
neg al
sbb eax, eax
pop ebx
ret
Function at 0x40b4dc
Capabilities:
Act as tcp client
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403fcc
jmp 0x40b4fd
push 0x3e8
call sub.kernel32.dll_Sleep
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x40b4f3
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40b55e
mov eax, dword [ebx + 0x10]
mov edx, 0x40b634
call fcn.004043a4
jne 0x40b52d
lea eax, [ebx + 0x10]
call fcn.00403fcc
jmp 0x40b566
mov eax, dword [ebx + 0x10]
mov edx, 0x40b640
call fcn.004043a4
jne 0x40b549
lea eax, [ebx + 0x10]
mov edx, 0x40b634
call fcn.00404020
cmp dword [ebx + 0x10], 0
jne 0x40b566
lea eax, [ebx + 0x10]
mov edx, 0x40b640
call fcn.00404020
jmp 0x40b566
lea eax, [ebx + 0x10]
call fcn.00403fcc
mov eax, ebx
call fcn.0040b32c
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404458
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40b5b6
or edi, 0xffffffff
jmp 0x40b5f0
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404458
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40b5f0
or edi, 0xffffffff
test edi, edi
je 0x40b613
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40b64c
call fcn.004042ac
mov eax, ebx
call fcn.0040b204
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40b4fd
Function at 0x405f91
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405fa7
test al, 0x10
je 0x405fa7
inc esi
mov eax, esi
pop esi
ret

Function at 0x405fab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405fc1
test al, 0x10
je 0x405fc1
inc esi
mov eax, esi
pop esi
ret
Function at 0x4064dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0x24], 0
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], 0x4010ac
push esi
push edi
test ebx, ebx
jne 0x406507
mov edi, 0x80070057
jmp 0x406676
mov eax, dword [ebx]
lea ecx, [ebp - 0x24]
push ecx
push ebx
mov esi, dword [eax + 0x34]
mov ecx, esi
call dword [0x40e220]
call esi
mov edi, eax
test edi, edi
js 0x406676
and dword [ebp - 0xc], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x4010ac
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov esi, dword [eax]
push 1
push eax
mov ecx, dword [esi + 0xc]
call dword [0x40e220]
call dword [esi + 0xc]
test eax, eax
jne 0x40666e
and dword [ebp - 4], eax
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x40e220]
call esi
mov edi, eax
test edi, edi
js 0x40665e
mov ecx, dword [ebp - 4]
call fcn.004063a4
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x10]
inc edx
mov ecx, eax
mov dword [ebp - 8], edx
mov al, byte [eax]
jmp 0x4065a9
cmp al, 0x2e
jne 0x40659f
and dword [ebp - 8], 0
jmp 0x4065a6
cmp al, 0x5c
jne 0x4065a6
mov dword [ebp - 8], edx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x406595
and dword [ebp - 0x1c], 0
test esi, esi
jne 0x4065bf
mov edi, 0x8007007b
jmp 0x40665e
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov edx, eax
mov ecx, esi
call fcn.00406131
mov edi, eax
test edi, edi
js 0x40664e
cmp dword [ebp + 0xc], 0
je 0x4065f0
push dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
call fcn.00405a96
test eax, eax
je 0x40664e
cmp dword [ebp + 0x1c], 0
jne 0x40661d
cmp dword [ebp + 0x20], 0
jne 0x40661d
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406611
mov ecx, dword [ebp + 8]
test al, 0x10
jne 0x406614
mov ecx, dword [ebp + 0x10]
call fcn.004063a4
mov esi, eax
jmp 0x406626
cmp dword [ebp + 0x24], 0
jne 0x406626
mov esi, dword [ebp - 4]
push ebx
push dword [ebp + 0x14]
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00406469
push dword [ebp - 4]
mov edi, eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x40e220]
call esi
cmp dword [ebp - 0x1c], 0
je 0x40665e
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00406dc0
test edi, edi
jns 0x406534
lea ecx, [ebp - 0x18]
call fcn.00406de4
lea ecx, [ebp - 0x28]
call fcn.00406de4
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x406774
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, ecx
mov esi, 0x80004005
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
push ecx
xor ecx, ecx
mov dword [0x40b00c], esi
push ecx
push eax
push 0x4066c0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x4067e6
mov bl, 1
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4067d3
cmp eax, 0x102
jne 0x4067df
mov ecx, dword [ebp - 4]
call fcn.004066e7
test eax, eax
jns 0x4067db
mov esi, eax
jmp 0x4067d9
mov esi, dword [0x40b00c]
xor bl, bl
test bl, bl
jne 0x4067ac
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40737f
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push ebx
push esi
push edi
push eax
push eax
push 3
push eax
push 1
push 0x80000000
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x4074f5
cmp esi, 0xffffffff
je 0x4074f5
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x4074f8
cmp dword [ebp - 0x18], edi
je 0x4073de
mov ecx, 0x80070057
mov ebx, ecx
jmp 0x407509
push 0
lea eax, [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4074f8
cmp dword [ebp - 0xc], 2
mov al, byte [ebp - 3]
mov cl, byte [ebp - 4]
jb 0x407444
cmp cl, 0xfe
jne 0x407417
cmp al, 0xff
jne 0x407444
mov dword [ebp - 0x10], 3
jmp 0x407427
cmp cl, 0xff
jne 0x407444
cmp al, 0xfe
jne 0x407444
mov dword [ebp - 0x10], 2
push 1
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub ebx, 2
mov dword [ebp - 8], ebx
test ebx, 1
je 0x407477
jmp 0x4073d2
cmp dword [ebp - 0xc], 3
jne 0x407468
cmp cl, 0xef
jne 0x407468
cmp al, 0xbb
jne 0x407468
cmp byte [ebp - 2], 0xbf
jne 0x407468
sub ebx, 3
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], ebx
jmp 0x407477
xor eax, eax
push eax
push eax
push eax
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push 2
pop edx
call fcn.004076a9
mov ebx, eax
test ebx, ebx
js 0x407507
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x4074a3
mov ebx, 0x8007000e
jmp 0x407507
mov ebx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4074f8
cmp ebx, dword [ebp - 0xc]
je 0x4074c8
mov ecx, 0x8000ffff
jmp 0x4073d7
mov eax, dword [ebp - 0x14]
cmp eax, 2
jb 0x4074be
mov word [edi + eax - 2], 0
mov ecx, edi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ebx
test ecx, ecx
je 0x4074f1
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
xor ebx, ebx
jmp 0x40750e
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040717f
mov ebx, eax
mov ecx, ebx
call fcn.00407197
mov ecx, ebx
call fcn.004071af
test edi, edi
je 0x407520
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x407530
cmp esi, 0xffffffff
je 0x407530
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x407539
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xb0], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push 0x90
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x9c]
push esi
push eax
mov dword [ebp - 0xa4], edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4075bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040717f
mov edi, eax
mov ecx, edi
call fcn.00407197
mov ebx, dword [ebp - 0xa8]
jmp 0x4075de
cmp dword [ebp - 0x90], 2
jne 0x4075dc
cmp dword [ebp - 0x9c], 5
ja 0x4075d7
jne 0x4075dc
cmp dword [ebp - 0x98], esi
jbe 0x4075dc
xor ebx, ebx
inc ebx
jmp 0x4075de
xor ebx, ebx
mov ecx, edi
call fcn.004071af
test edi, edi
jns 0x4075f5
mov ecx, edi
call fcn.00407197
jmp 0x407684
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0xa4]
mov eax, ebx
shl eax, 3
push eax
push 0xfde9
mov dword [ebp - 0xac], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
jg 0x40762f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040717f
mov edi, eax
jmp 0x4075e9
lea eax, [ebx + ebx]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x407648
mov edi, 0x8007000e
jmp 0x4075e9
push ebx
push esi
push 0xffffffffffffffff
push dword [ebp - 0xa4]
push dword [ebp - 0xac]
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jle 0x40761e
mov edx, dword [ebp - 0xb0]
mov eax, esi
xor esi, esi
mov dword [edx], eax
mov edx, dword [ebp - 0xa8]
test edx, edx
je 0x407684
lea eax, [ecx + ecx]
mov dword [edx], eax
mov ecx, edi
call fcn.004071af
test esi, esi
je 0x407696
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409740
leave
ret 8

Function at 0x4077df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [0x40cbfc]
push edi
mov edi, dword [0x40cc08]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40786d
test ebx, 0x4000
je 0x40786d
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 4]
mov edx, eax
push ecx
mov ecx, esi
call fcn.004061d1
mov esi, dword [ebp - 4]
test eax, eax
js 0x407861
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0xc]
mov edx, eax
push ecx
mov ecx, edi
call fcn.004061d1
mov edi, dword [ebp - 0xc]
test eax, eax
js 0x407855
push 0
push ebx
push 3
push edi
push esi
call dword [sym.imp.ext_ms_win_feclient_encryptedfile_l1_1_0.dll_EfsClientDuplicateEncryptionInfo]
test edi, edi
je 0x407861
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test esi, esi
je 0x40786d
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407c83
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
lea edi, [ebp - 0x18]
mov ebx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi + 0x24]
mov edi, ecx
lea ecx, [ebp - 0x18]
push eax
mov edx, edi
call fcn.00408004
cmp eax, 1
je 0x407cc6
cmp dword [esi + 0x24], 0xe
jge 0x407d5b
lea ecx, [ebp - 0x18]
call fcn.004080b2
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [ebp - 0x1c], ecx
jne 0x407cf8
cmp byte [ebp - 0x10], 0x41
je 0x407ce5
push 0xfffffffffffffff8
jmp 0x407d53
mov eax, dword [ebp - 0xc]
mov edx, ebx
push esi
push ecx
push ecx
dec eax
mov ecx, edi
push eax
call fcn.004080f3
jmp 0x407d02
push esi
mov edx, ebx
mov ecx, edi
call fcn.00407bd1
cmp eax, 1
jne 0x407d5e
push esi
mov edx, ebx
mov cl, 0x46
call fcn.004083e7
cmp eax, 1
jne 0x407d5e
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x407d5b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call sub.KERNEL32.dll_SetFileTime
test eax, eax
je 0x407d5b
cmp dword [ebp - 0x1c], 0
je 0x407d56
mov eax, dword [ebp - 0xc]
cmp dword [esi + 0x28], eax
je 0x407d56
push 0xfffffffffffffffd
pop eax
jmp 0x407d5e
xor eax, eax
inc eax
jmp 0x407d5e
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409740
leave
ret 4

Function at 0x4087c5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
mov esi, 0xc04
push eax
push 8
push 0x404
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x408813
push 3
lea eax, [ebp - 0x44]
push 0x403358
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffff800
add esi, eax
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.00409740
leave
ret
Function at 0x408823
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x40cba0]
jne 0x4088bf
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x403370
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4088be
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x403428
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4088be
push 3
push dword [edi*8 + 0x401190]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4088b0
inc edi
cmp edi, 0x1c
jb 0x40888e
jmp 0x4088be
mov ax, word [edi*8 + 0x401194]
mov word [0x40cba0], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x40cba0]
xor ecx, ebp
call fcn.00409740
leave
ret
Function at 0x409003
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x409027
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x409070
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
mov esi, ebx
neg esi
and esi, edi
lea ecx, [ebx - 1]
mov eax, ecx
and ecx, dword [ebp - 4]
and eax, edi
dec ecx
add eax, ebx
add eax, ecx
div ebx
xor edx, edx
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x40906e
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x409062
pop esi
pop ebx
pop edi
leave
ret

Function at 0x4098a4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x409f58
call fcn.00409b5c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409904
cmp eax, 0xffffffff
je 0x409904
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4098fd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4098fd
cmp edx, 0x10000000
jae 0x4098fd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4098fa
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x409960
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40999e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x409996
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4099a0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x409986
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409a70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x409aa1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x409aa1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x409aa1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5d20445
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0xa83b40
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x55bf52a9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1d00727b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
jmp section..htext