joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423749
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
movsx ax, byte [0x43ac78]
or ax, word [0x43ac84]
push esi
push edi
mov word [0x43ac8c], ax
movsx eax, word [0x43ac92]
imul eax, eax, 0xdd09ffff
mov dword [0x43acb0], eax
movsx eax, byte [0x43ac7e]
push eax
push dword [0x43aca8]
call fcn.0040b0ac
movzx esi, word [esp + 0x1a]
mov word [0x43ac84], ax
movsx eax, byte [0x43ac7f]
push eax
push 0x2447ffff
call fcn.0040b0f0
add dword [0x43acb4], eax
add esp, 0x10
movzx eax, word [esp + 0xe]
add eax, 0xfffffffe
cmp eax, 0xa
ja case.default.0x4237bf
push 0x1f
pop edi
jmp dword [eax*4 + 0x423a03]
push 0xc4a9ffff
push dword [0x43aca0]
call fcn.0040b0ac
add byte [0x43ac7f], al
pop ecx
pop ecx
add esi, 0x1e
mov al, byte [0x43ac8c]
dec word [0x43ac94]
add byte [0x43ac7d], al
mov ax, word [0x43ac88]
dec ax
add word [0x43ac86], ax
add esi, edi
movsx ax, byte [0x43ac7b]
dec eax
push 0xc779ffff
add word [0x43ac90], ax
push 0x2d51ffff
call fcn.0040af32
pop ecx
mov word [0x43ac8e], ax
pop ecx
add esi, 0x1e
movsx ax, byte [0x43ac81]
and eax, dword [0x43acb8]
mov ecx, dword [0x43aca0]
add esi, edi
add word [0x43ac88], ax
mov al, byte [0x43ac7e]
dec al
add byte [0x43ac7f], al
dec word [0x43ac84]
movsx eax, byte [0x43ac80]
lea eax, [ecx + eax - 0x510c0001]
mov dword [0x43aca0], eax
movsx eax, byte [0x43ac7c]
push eax
add esi, edi
push dword [0x43acb4]
call fcn.0040af32
push 0xc81ffff
mov dword [0x43aca0], eax
push dword [0x43aca4]
call fcn.0040aeeb
add esp, 0x10
add dword [0x43acb8], eax
add esi, 0x1e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add byte [0x43ac81], al
add esi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x43aca0], eax
xor eax, eax
cmp byte [0x43ac79], al
je 0x4238d7
cmp word [0x43ac82], ax
je 0x4238d7
push 1
pop eax
add word [0x43ac92], ax
movsx eax, word [0x43ac94]
movsx ecx, word [0x43ac84]
sub ecx, eax
add esi, 0x1e
add dword [0x43acb0], ecx
movsx eax, word [0x43ac94]
push eax
add esi, edi
movsx eax, byte [0x43ac7b]
inc byte [0x43ac7f]
push eax
call fcn.0040b0ac
add dword [0x43acb4], eax
push 0x892dffff
push 0xe809ffff
call fcn.0040b002
add esp, 0x10
add word [0x43ac8e], ax
mov al, byte [esp + 0xc]
push 0x8c21ffff
not al
and eax, 4
or al, 0x70
shr eax, 2
add esi, eax
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af94
add word [0x43ac94], ax
pop ecx
pop ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
add byte [0x43ac79], al
call dword [sym.imp.USER32.dll_GetInputState]
mov byte [0x43ac7a], al
push dword [0x43ac98]
add esi, edi
inc word [0x43ac88]
push 0x9e07ffff
call fcn.0040b037
add dword [0x43aca8], eax
movsx eax, byte [0x43ac7d]
push eax
push dword [0x43acac]
call fcn.0040b002
add esp, 0x10
add word [0x43ac82], ax
movsx eax, word [0x43ac8a]
push 0xe0ebffff
push eax
call fcn.0040af32
pop ecx
mov word [0x43ac88], ax
neg ax
pop ecx
mov word [0x43ac82], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, word [esp + 0xc]
mov word [0x43ac8a], ax
push 4
lea eax, [ecx - 0x7b1]
pop edi
cdq
imul ecx, ecx, 0x16d
idiv edi
pop edi
add esi, eax
lea eax, [ecx + esi - 0xaf8ca]
pop esi
ret
Function at 0x42513a
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
mov eax, 0x4326c4
call fcn.00430710
sub esp, 0x10
movsx eax, word [0x43ac8a]
push esi
push edi
push eax
mov esi, ecx
push 0x1fb3ffff
call fcn.0040b087
add dword [0x43ac9c], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add byte [0x43ac7e], al
push 0x2e01ffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040af32
add dword [0x43acac], eax
pop ecx
pop ecx
lea eax, [esi + 0x20]
push eax
push 0x40
mov dword [ebp - 0x18], eax
call fcn.0040f588
pop ecx
call eax
and dword [ebp - 4], 0
or byte [0x43ac7e], 0xff
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00425c3b
movsx eax, word [0x43ac94]
and word [0x43ac88], 0
push eax
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af6d
add byte [0x43ac79], al
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 4]
pop ecx
pop ecx
je 0x425246
push 0x6327ffff
mov dword [0x43acbc], 0x1bffff
push dword [0x43aca0]
call fcn.0040b0ac
add dword [0x43acb4], eax
mov eax, dword [ebp - 0x10]
pop ecx
mov edi, dword [eax + 0x10]
pop ecx
test edi, edi
je 0x425221
push 1
lea ecx, [edi + 4]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push edi
call fcn.00430672
pop ecx
push 0x5ccfffff
push 0x12e3ffff
call fcn.0040af94
pop ecx
mov word [0x43ac84], ax
pop ecx
lea eax, [ebp - 0x1c]
push dword [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0042590d
or al, 0xff
sub al, byte [0x43ac7b]
mov byte [0x43ac78], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add word [0x43ac82], ax
or al, 0xff
sub al, byte [0x43ac94]
lea edi, [esi + 0x10]
mov ecx, edi
add byte [0x43ac7d], al
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00425fa3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x43aca4], eax
movsx eax, byte [0x43ac7e]
push eax
push 0xc775ffff
call fcn.0040b0ac
add word [0x43ac86], ax
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x14]
pop ecx
pop ecx
je 0x42531a
mov esi, dword [eax + 0x10]
test esi, esi
je 0x4252c3
mov ecx, esi
call fcn.00424c19
push esi
call fcn.00430672
pop ecx
movsx eax, word [0x43ac90]
or byte [0x43ac79], 0xff
push eax
push dword [0x43acb0]
call fcn.0040aeeb
add byte [0x43ac81], al
mov ax, word [0x43ac8e]
add word [0x43ac84], ax
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push dword [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00425c75
movsx eax, byte [0x43ac78]
push eax
push 0x88b7ffff
call fcn.0040af94
add dword [0x43ac9c], eax
pop ecx
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x427fa4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movsx eax, byte [0x43ac7a]
push esi
push 0x8b97ffff
push eax
call fcn.0040b002
add word [0x43ac8c], ax
push 0x7583ffff
push 0xefe9ffff
call fcn.0040af94
add dword [0x43ac9c], eax
mov al, byte [0x43acbc]
or al, byte [0x43ac7d]
push dword [ebp + 8]
mov byte [0x43ac7c], al
call sub.MSVCRT.dll_strlen
add esp, 0x14
lea ecx, [ebp - 0x6c]
mov esi, eax
call fcn.0042809a
push dword [0x43aca8]
push 0x9199ffff
call fcn.0040b0f0
add byte [0x43ac7c], al
push 0x9989ffff
movsx eax, byte [0x43ac7b]
push eax
call fcn.0040b002
add esp, 0x10
lea ecx, [ebp - 0x6c]
mov dword [0x43acb0], eax
push esi
push dword [ebp + 8]
call fcn.0042813b
movsx eax, byte [0x43ac7e]
push eax
push 0x6c1ffff
call fcn.0040af32
add dword [0x43aca4], eax
mov al, byte [0x43ac92]
sub byte [0x43ac7b], al
pop ecx
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.004283a6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x43aca8]
movzx eax, ax
push 0x7c9ffff
mov dword [0x43ac9c], eax
call fcn.0040b087
mov word [0x43ac8e], ax
lea eax, [ebp - 0x14]
push eax
call fcn.00427dbe
add esp, 0xc
pop esi
leave
ret

Function at 0x42809a
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add dword [0x43acbc], eax
push 8
lea eax, [esi + 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
call dword [sym.imp.USER32.dll_GetActiveWindow]
add word [0x43ac8a], ax
push 0x21e1ffff
push 0xea19ffff
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
call fcn.0040af32
push 0x5c15ffff
push 0xa203ffff
mov byte [0x43ac7b], al
call fcn.0040afcb
push 0x129bffff
mov word [0x43ac90], ax
push dword [0x43acac]
call fcn.0040aeeb
add dword [0x43aca4], eax
mov dword [esi + 0xc], 0x10325476
push dword [0x43acb0]
push 0xb10dffff
call fcn.0040b002
add esp, 0x20
mov word [0x43ac8e], ax
pop esi
ret
Function at 0x4283a6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movsx eax, byte [0x43ac7d]
or eax, 0xe0afffff
push ebx
push esi
mov dword [0x43acb0], eax
movsx eax, word [0x43ac92]
mov esi, ecx
push edi
mov ecx, dword [0x43aca8]
push 0x6a2bffff
lea eax, [ecx + eax - 0x21d40001]
mov dword [0x43aca8], eax
movsx eax, word [0x43ac82]
push eax
call fcn.0040b0ac
mov byte [0x43ac7b], al
push 0x8a5bffff
movsx eax, byte [0x43ac7a]
push eax
call fcn.0040af32
add esp, 0x10
mov word [0x43ac92], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43acb8], eax
movsx eax, word [0x43ac88]
push eax
movsx eax, byte [0x43ac79]
push eax
call fcn.0040b002
pop ecx
mov word [0x43ac86], ax
pop ecx
lea edi, [esi + 0x10]
push 8
lea eax, [ebp - 8]
push edi
push eax
mov ecx, esi
call fcn.00429469
dec word [0x43ac8a]
or ax, 0xffff
sub ax, word [0x43ac88]
push 0x38
pop ebx
mov word [0x43ac94], ax
mov eax, dword [edi]
shr eax, 3
and eax, 0x3f
cmp eax, ebx
jb 0x42846f
push 0x78
pop ebx
sub ebx, eax
push 0xda8bffff
movsx eax, byte [0x43ac81]
push eax
call fcn.0040b0ac
mov byte [0x43ac7e], al
push 0x9a8dffff
movsx eax, word [0x43ac88]
push eax
call fcn.0040aeeb
add dword [0x43ac98], eax
add esp, 0x10
mov ecx, esi
push ebx
push 0x43a35c
call fcn.0042813b
xor ebx, ebx
xor eax, eax
cmp dword [0x43aca0], ebx
push 8
mov ecx, esi
setne al
add byte [0x43ac78], al
lea eax, [ebp - 8]
push eax
call fcn.0042813b
push 0x6d8bffff
push 0xbf07ffff
call fcn.0040b0ac
add word [0x43ac82], ax
movsx eax, word [0x43ac88]
push eax
push 0x66d5ffff
call fcn.0040b087
add byte [0x43ac81], al
add esp, 0x10
lea eax, [esi + 0x58]
mov ecx, esi
push 0x10
push esi
push eax
call fcn.00429469
push 8
push ebx
push edi
call sub.MSVCRT.dll_memset
movsx eax, byte [0x43ac79]
push 0x8975ffff
push eax
call fcn.0040b0ac
mov byte [0x43ac81], al
push 0x6b9dffff
movsx eax, byte [0x43ac7c]
push eax
call fcn.0040b087
add byte [0x43ac79], al
movsx eax, word [0x43ac8c]
push eax
push 0x8ce3ffff
call fcn.0040afcb
push 0x10
push ebx
push esi
mov word [0x43ac92], ax
call sub.MSVCRT.dll_memset
push 0x40
add esi, 0x18
push ebx
push esi
call sub.MSVCRT.dll_memset
mov ax, word [0x43ac94]
add esp, 0x3c
cmp word [0x43ac82], bx
jne 0x42858b
cmp ax, bx
je 0x42858e
push 1
pop ebx
movsx eax, ax
add byte [0x43ac7a], bl
push eax
movsx eax, word [0x43ac88]
push eax
call fcn.0040b0ac
add byte [0x43ac7c], al
movsx eax, word [0x43ac90]
push eax
push 0x662dffff
call fcn.0040b037
add esp, 0x10
add byte [0x43ac7a], al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429abd
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add byte [0x43ac81], al
mov eax, dword [esi]
xor ebp, ebp
cmp eax, ebp
jne 0x429ae0
xor edi, edi
jmp 0x429ae9
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
push dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp byte [0x43ac79], 0
mov dword [0x43aca0], eax
je 0x429b18
cmp word [0x43ac82], bp
je 0x429b18
push 1
pop eax
jmp 0x429b1a
xor eax, eax
mov esi, dword [esp + 0x1c]
add word [0x43ac92], ax
lea eax, [ebx + esi]
cmp edi, eax
jb 0x429c4d
movsx eax, word [0x43ac94]
movsx ecx, word [0x43ac84]
sub ecx, eax
push eax
movsx eax, byte [0x43ac7b]
add dword [0x43acb0], ecx
inc byte [0x43ac7f]
push eax
call fcn.0040b0ac
add dword [0x43acb4], eax
push 0x892dffff
push 0xe809ffff
call fcn.0040b002
add word [0x43ac8e], ax
add esp, 0x10
cmp ebx, ebp
jbe 0x429c13
mov edi, dword [esp + 0x18]
add esi, esi
movsx eax, byte [0x43ac7a]
push 0x8c21ffff
push eax
call fcn.0040af94
add word [0x43ac94], ax
pop ecx
pop ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
add byte [0x43ac79], al
call dword [sym.imp.USER32.dll_GetInputState]
mov byte [0x43ac7a], al
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ax, word [esi + eax]
cmp ax, word [edi]
jne 0x429c4d
push dword [0x43ac98]
inc word [0x43ac88]
push 0x9e07ffff
call fcn.0040b037
add dword [0x43aca8], eax
movsx eax, byte [0x43ac7d]
push eax
push dword [0x43acac]
call fcn.0040b002
add word [0x43ac82], ax
add esp, 0x10
inc ebp
inc esi
inc esi
inc edi
inc edi
cmp ebp, ebx
jb 0x429b87
movsx eax, word [0x43ac8a]
push 0xe0ebffff
push eax
call fcn.0040af32
pop ecx
mov word [0x43ac88], ax
neg ax
pop ecx
mov word [0x43ac82], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 1
mov word [0x43ac8a], ax
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
xor eax, eax
jmp 0x429c45
Function at 0x42c869
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push dword [0x43ac98]
inc word [0x43ac88]
push 0x9e07ffff
call fcn.0040b037
add dword [0x43aca8], eax
movsx eax, byte [0x43ac7d]
push eax
push dword [0x43acac]
call fcn.0040b002
add word [0x43ac82], ax
add esp, 0x10
lea eax, [ebp - 0x190]
push eax
push 0x101
push 0x66
call fcn.0040f588
pop ecx
call eax
movsx eax, word [0x43ac8a]
push 0xe0ebffff
push eax
call fcn.0040af32
pop ecx
mov word [0x43ac88], ax
neg ax
pop ecx
mov word [0x43ac82], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [0x43ac8a], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x42c900
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
push eax
push 0x68
call fcn.0040f588
pop ecx
call eax
dec word [0x43ac86]
push 0x67
mov esi, eax
mov dword [0x43acac], 1
call fcn.0040f588
pop ecx
call eax
mov eax, dword [0x43ac9c]
push dword [0x43acb8]
add eax, 0x31bdffff
push 0xa99dffff
mov dword [0x43acb0], eax
call fcn.0040b0ac
add byte [0x43ac80], al
pop ecx
test esi, esi
pop ecx
je 0x42c9a0
mov eax, dword [esi + 0xc]
cmp dword [eax], 0
je 0x42c9a0
movsx eax, word [0x43ac8a]
imul eax, eax, 0x8d6bffff
mov dword [0x43acbc], eax
movsx eax, byte [0x43ac80]
push eax
movsx eax, byte [0x43ac81]
push eax
call fcn.0040b0f0
mov dword [0x43acb4], eax
mov ax, word [0x43acb8]
sub word [0x43ac88], ax
mov eax, dword [esi + 0xc]
pop ecx
mov eax, dword [eax]
pop ecx
mov eax, dword [eax]
jmp 0x42c9a2
xor eax, eax
pop esi
leave
ret
Function at 0x42d6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [0x43acb0]
push 0xb10dffff
call fcn.0040b002
mov esi, dword [ebp + 8]
mov word [0x43ac8e], ax
movsx eax, ax
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
push 0xdc9ffff
push eax
mov dword [ebp + 8], ecx
call fcn.0040afcb
push dword [0x43aca4]
mov byte [0x43ac7d], al
push 0xe3b1ffff
call fcn.0040aeeb
mov word [0x43ac92], ax
push 0x13b3ffff
movsx eax, word [0x43ac88]
push eax
call fcn.0040b0ac
add byte [0x43ac7a], al
and dword [ebp - 4], 0
add esp, 0x20
cmp dword [ebp + 0x10], 0
jle 0x42d7d6
push edi
inc bl
movzx eax, bl
mov ebx, dword [esi + eax*4 + 8]
mov dword [ebp - 8], eax
lea edi, [esi + eax*4 + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov cx, word [0x43ac8a]
push 0x5171ffff
dec cx
add ax, cx
mov word [0x43ac86], ax
mov al, bl
add al, byte [ebp + 8]
movzx eax, al
mov dword [ebp + 8], eax
lea ecx, [esi + eax*4 + 8]
mov eax, dword [esi + eax*4 + 8]
mov dword [edi], eax
mov edi, dword [ebp - 4]
movsx edx, byte [0x43ac7e]
and edx, dword [0x43acbc]
add al, bl
mov word [0x43ac8a], 1
mov dword [0x43acb4], edx
movsx edx, word [0x43ac90]
or edx, dword [0x43aca0]
movzx eax, al
add dword [0x43aca8], edx
mov dword [ecx], ebx
mov ecx, dword [ebp + 0xc]
mov al, byte [esi + eax*4 + 8]
add ecx, edi
xor byte [ecx], al
push dword [0x43acb8]
call fcn.0040b0f0
add word [0x43ac94], ax
mov ebx, dword [ebp - 8]
inc edi
pop ecx
cmp edi, dword [ebp + 0x10]
pop ecx
mov dword [ebp - 4], edi
jl 0x42d72b
pop edi
movsx eax, byte [0x43ac80]
push eax
push dword [0x43ac9c]
call fcn.0040b037
add word [0x43ac92], ax
pop ecx
pop ecx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add byte [0x43ac7d], al
mov ax, word [0x43aca0]
or ax, word [0x43ac94]
push 0xc151ffff
push dword [0x43ac9c]
add word [0x43ac8e], ax
call fcn.0040b037
mov word [0x43ac8e], ax
mov eax, dword [ebp + 8]
pop ecx
mov dword [esi + 4], eax
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x42dfcc
Capabilities:
Identify system language via api

Disassembly:
movsx eax, byte [0x43ac7e]
push eax
push 0x6c1ffff
call fcn.0040af32
add dword [0x43aca4], eax
mov al, byte [0x43ac92]
sub byte [0x43ac7b], al
pop ecx
pop ecx
push dword [esp + 4]
mov ecx, 0x43b388
call fcn.0042dd9e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x43aca8]
movzx eax, ax
push 0x7c9ffff
mov dword [0x43ac9c], eax
call fcn.0040b087
pop ecx
mov word [0x43ac8e], ax
pop ecx
ret
Function at 0x4302d5
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x432d47
call fcn.00430710
push ecx
push ecx
and dword [ebp - 0x14], 0
push ebx
push esi
push 1
pop ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x43aca8]
movzx eax, ax
push 0x7c9ffff
mov dword [0x43ac9c], eax
call fcn.0040b087
mov esi, dword [ebp + 0x10]
mov word [0x43ac8e], ax
pop ecx
mov al, byte [esi]
pop ecx
add al, 0x76
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.00430730
mov eax, esp
push esi
push eax
call fcn.0042d836
pop ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
call fcn.00409b67
lea eax, [ebp - 0x10]
lea ecx, [ebp + 0xc]
push eax
mov byte [ebp - 4], bl
call fcn.00409d12
mov ecx, eax
call fcn.0040949e
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add dword [0x43acbc], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
test eax, eax
mov dword [esi], eax
je 0x430377
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
test eax, eax
mov byte [ebp - 4], bl
je 0x430387
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
and byte [ebp - 4], 0
test eax, eax
je 0x430398
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x466e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
jmp 0x466e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x466e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466e70
mov eax, 1
add ebx, ebx
jne 0x466e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x466ea4
jne 0x466ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466ec3
dec eax
add ebx, ebx
jne 0x466eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x466e88
add ebx, ebx
jne 0x466ebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x466f15
xor ecx, ecx
sub eax, 3
jb 0x466edb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x466f4a
sar eax, 1
mov ebp, eax
jmp 0x466ee6
add ebx, ebx
jne 0x466ee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466eb4
inc ecx
add ebx, ebx
jne 0x466ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466eb4
add ebx, ebx
jne 0x466f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x466ef6
jne 0x466f12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x466ef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x466f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x466f26
jmp 0x466e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x466f34
add edi, ecx
jmp 0x466e76
pop esi
mov edi, esi
mov ecx, 0x149b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x466f52
cmp byte [edi], 5
jne 0x466f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x466f57
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x466fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x673c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x674dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x466f84
mov ecx, edi
jns 0x466fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x674e0]
or eax, eax
je 0x466fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x466fa1
call dword [esi + 0x674f0]
mov ebp, dword [esi + 0x674e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467003
sub esp, 0xffffff80
jmp 0x420c54

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001480
Capabilities:
Move file

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [sym.imp.MSVCRT.dll_strrchr]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call ebx
mov edx, eax
add esp, 0xc
test edx, edx
je 0x10001508
mov edi, str._version.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x110]
push 0x5c
push ecx
call ebx
mov edx, eax
add esp, 8
test edx, edx
je 0x10001552
mov edi, str.mupdate1.log
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x110]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret