joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401780
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
lea eax, [ebp - 4]
push eax
call fcn.004044b0
add esp, 4
test eax, eax
jne 0x4017af
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4017cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x4017e4
push eax
pop eax
ja 0x4017e4
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0x4252c8
push 0x425288
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401820
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jbe 0x401840
xchg bh, bh
xchg edi, edi
ja 0x401840
cmp eax, eax
xchg esp, eax
movsd dword es:[edi], dword [esi]
mov bh, 0xdf
mov ebp, 0x8be181d0
inc ebp
or al, 0x8b
dec ebp
or byte [eax - 1], ch
add dword [edi], ecx
add byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40185e
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
push edx
push bx
mov dl, 0xc
test dx, 0x40ef
test bh, bh
pop bx
pop edx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4018a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x425554
push 0x41b010
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x4018d8
pop ebp
ret
jl 0x4018e3
push ebx
mov bh, 0x4c
pop ebx
jge 0x4018e3
xchg edx, eax
cmp eax, 0xff50006a
adc eax, sym.imp.USER32.dll_ShowWindow
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret
Function at 0x402b90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x230]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
cmp ebx, esi
sub ebx, 0x6895
sub ebx, 0x50e0
mov bx, 0x26ca
xor bl, al
pop ebx
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
mov edi, 0x4250f8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
js 0x402c77
jns 0x402c77
add eax, 0x8dd8458d
invalid
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x12c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jne 0x402cad
mov edx, dword [ebp + 8]
push edx
call fcn.00403070
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x402cb0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push ax
push cx
push edi
and al, dl
or ch, 0x3a
dec edi
inc edi
cmp ah, bl
xor ax, ax
cmp cl, dl
dec cl
pop edi
pop cx
pop ax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp ebx, 0xffffffff
jne 0x402ce9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
mov dword [ebp - 4], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10c]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push 0x425538
push 0x425510
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x403298
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test cx, ax
inc ax
popal
lea eax, [ebp - 0x10c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x4032bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x4032cc
mov dx, dx
mov esi, esi
ja 0x4032cc
sub ch, byte [ebx]
cmp byte [edx - 0xb], dl
sub dword [edi - 0x73], esp
invalid
lea ecx, [ebp - 0x10c]
mov byte [eax], 0
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 6
jne 0x4032f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp eax, 7
sete dl
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403fa0
Capabilities:
Query or enumerate registry value

Disassembly:
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 1
jbe 0x403fd2
push si
mov si, 0x5c11
pop si
ja 0x403fd2
jo 0x403f80
push cs
invalid
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403ff8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404036
mov dword [ebp - 8], 0
pushal
sub dl, 0x33
and dh, 0x12
popal
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4043a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
je 0x4043b0
mov ch, ch
xchg esi, esi
jne 0x4043b0
inc esp
call fcn.00402fe0
mov dword [0x425578], eax
je 0x4043d2
mov si, si
xchg bx, bx
jne 0x4043d2
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
mov eax, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4043fe
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404439
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
test bl, 0x4d
pop ebx
mov eax, dword [0x425578]
test eax, eax
je 0x40445a
push esi
call fcn.004042e0
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x425578], eax
je 0x404466
push ecx
mov cx, 0xec17
pop ecx
jne 0x404466
pushfd
popfd
push esi
push 0
call fcn.00402b90
add esp, 8
je 0x404489
mov si, si
xchg bx, bx
jne 0x404489
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
mov eax, dword [0x425578]
test eax, eax
jne 0x404499
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4044b0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
mov esi, 0x104
push edi
mov dword [ebp - 0xc], esi
js 0x4044d9
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x4044d9
adc eax, 0xf4458d2f
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4044f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jb 0x404514
push edx
mov dx, 0xecd6
pop edx
jae 0x404514
cmc
adc eax, 0x7c8ecb0d
xor dword [esi + 0x43d1773a], 0x8d27e95e
push ebp
invalid
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x404548
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x404570
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404760
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x42557c]
sub esp, 0x82c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40477c
xor eax, eax
pop ebx
add esp, 0x82c
ret
xor eax, eax
push ebp
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 0x40
mov word [esp + 0x1d], ax
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.00404b90
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x425394
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x42540c
mov dword [esp + 0x24], 0x425410
mov dword [esp + 0x28], 0x42541c
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x40485a
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x425434
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x425390
push ecx
call fcn.00401000
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
jne 0x40494c
pop ebx
add esp, 0x82c
ret
lea edx, [esp + 0x228]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop ebx
add esp, 0x82c
ret
Function at 0x404bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x10b]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jo 0x404c2e
mov dx, dx
nop
xchg cx, cx
jno 0x404c2e
mov al, 0x98
and ecx, dword [ecx - 0x7834e8a9]
mov ecx, 0x6de85d21
in al, 0xff
call dword [ebx + 0x66]
xor ebx, 0xd82b70c5
call fcn.004030a0
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], 0
call fcn.00401100
mov edi, eax
call fcn.00401100
mov ebx, eax
call fcn.00401100
push edi
mov edi, dword [ebp + 0x10]
push edi
mov esi, eax
call fcn.00404b90
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00404b90
mov ecx, dword [ebp + 0xc]
push esi
push ecx
call fcn.00404b90
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x314]
push edi
push edx
push 0x4250d4
push eax
call esi
lea ecx, [ebp - 0x314]
push ecx
call fcn.00404590
add esp, 0x14
test eax, eax
je 0x404d1b
lea edx, [ebp - 0x10c]
push ebx
push edx
lea eax, [ebp - 0x210]
push 0x4250e0
push eax
call esi
lea ecx, [ebp - 0x210]
push ecx
call fcn.00404590
add esp, 0x14
test eax, eax
je 0x404d1b
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push edx
push eax
lea ecx, [ebp - 0x210]
push 0x4250e0
push ecx
call esi
lea edx, [ebp - 0x210]
push edx
call fcn.00404590
add esp, 0x14
test eax, eax
jne 0x404d30
mov eax, dword [ebp - 4]
inc eax
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x404c61
mov esi, dword [ebp - 8]
jmp 0x404d35
mov esi, 1
mov eax, dword [ebp + 0x14]
push 4
push eax
call fcn.00404b90
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0xc36e84
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36e84
ret
Function at 0x405cc2
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x4080b0
call fcn.00405f10
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp dword [0x40a5bc], ebx
jne 0x405a5d
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x40a5b8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x405a97
cmp eax, esi
jne 0x405a8a
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x405a9a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405a71
xor esi, esi
inc esi
mov eax, dword [0x40a5b4]
cmp eax, esi
jne 0x405aad
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x405ae8
mov eax, dword [0x40a5b4]
test eax, eax
jne 0x405ae2
mov dword [0x40a5b4], esi
push 0x407264
push 0x407258
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x405ae8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x405c02
mov dword [0x40a278], esi
mov eax, dword [0x40a5b4]
cmp eax, esi
jne 0x405b0c
push 0x407254
push 0x40723c
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x40a5b4], 2
cmp dword [ebp - 0x24], ebx
jne 0x405b19
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40a5c0], ebx
je 0x405b3a
push 0x40a5c0
call fcn.004060b0
pop ecx
test eax, eax
je 0x405b3a
push ebx
push 2
push ebx
call dword [0x40a5c0]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x405b93
cmp al, bl
je 0x405b53
cmp dword [ebp - 0x1c], ebx
jne 0x405b93
mov al, byte [esi]
cmp al, bl
je 0x405b63
cmp al, 0x20
ja 0x405b63
inc esi
mov dword [ebp - 0x20], esi
jmp 0x405b53
test byte [ebp - 0x40], 1
je 0x405b6f
movzx eax, word [ebp - 0x3c]
jmp 0x405b72
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x40a274], eax
cmp dword [0x40a268], ebx
jne 0x405be8
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x405ba2
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x405bb5
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x405b41
cmp dword [0x40a278], ebx
jne 0x405bf6
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40a274]
call fcn.00405f55
ret
call 0x499000
jmp 0x405a2f
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7e35484f
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x40d845f3
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1000b7e2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000b861
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000b859
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000b83a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1000b857
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1002246c
mov dword [eax], 1
jmp 0x1000b82f
jmp 0x1000b85f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1000b887
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push 1
push 0x4bdb
push 0x6b7f
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.1000b5f3
add esp, 0x14
mov esp, ebp
pop ebp
ret