joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x466131
push esi
call fcn.00469145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00458080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x466131
push 0
push ebp
call fcn.004583a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00458260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x46608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.004582f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x466121
push 0x47e918
push edi
call fcn.004673f0
push eax
push ebx
push esi
call fcn.00465f60
push 0x47e8f8
push edi
call fcn.004673f0
push eax
push ebx
push esi
call fcn.00465f60
push 0x47e8d8
push edi
call fcn.004673f0
push eax
push ebx
push esi
call fcn.00465f60
push 0x47e8c0
push edi
call fcn.004673f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00465f60
push 0x47e8a0
push edi
call fcn.004673f0
push eax
push ebx
push esi
call fcn.00465f60
push 0x47e888
push edi
call fcn.004673f0
push eax
push ebx
push esi
call fcn.00465f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4671b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00467140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00467140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00467140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00467140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x467bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x467c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x47987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x467c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x467c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x405f41
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42bdd4], 0
push esi
jne 0x405f78
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f52
mov dword [ecx*4 + 0x42bdd0], eax
inc ecx
cmp ecx, 0x100
jl 0x405f4d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fa9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42bdd0]
xor eax, esi
inc ecx
dec edx
jne 0x405f8b
pop edi
not eax
pop esi
ret 0xc

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40608a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a74], 0
push esi
jne 0x4060c1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40609b
mov dword [ecx*4 + 0x422a70], eax
inc ecx
cmp ecx, 0x100
jl 0x406096
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4060f2
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a70]
xor eax, esi
inc ecx
dec edx
jne 0x4060d4
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x1e370fe3
nop
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x210f20f2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x40f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x40f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x40f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x40f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x40f1d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x40f1c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x40f1f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x40f285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x402830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cwde
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
invalid

Function at 0x4051d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405209
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040324c
jmp 0x405212
mov eax, ebx
mov edx, esi
call fcn.00403200
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406c00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c8e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c4b
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.0040324c
jmp 0x406c78
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c5f
lea eax, [ebp - 4]
call fcn.0040316c
jmp 0x406c6e
lea edx, [ebp - 4]
call fcn.00406ac4
test ebx, ebx
je 0x406c6e
dec ebx
jmp 0x406c50
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c95
lea eax, [ebp - 4]
call fcn.0040316c
ret
Function at 0x406de4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f1c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f06
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e41
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f06
cmp dword [ebp - 0x10], 0
jne 0x406e56
mov eax, dword [ebp - 8]
call fcn.0040316c
mov bl, 1
jmp 0x406f06
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e64
call fcn.00405848
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.0040324c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.004033f4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e0a
test eax, eax
jne 0x406f06
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406eb4
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f06
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406ebf
dec esi
test esi, esi
je 0x406ecd
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406ebe
cmp dword [ebp - 0xc], 7
jne 0x406ed8
test esi, esi
je 0x406ed8
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034c4
cmp dword [ebp - 0xc], 7
jne 0x406ef9
test esi, esi
je 0x406ef9
lea eax, [ebp - 0x14]
call fcn.004033f4
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031bc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f23
lea eax, [ebp - 0x14]
call fcn.0040316c
ret

Function at 0x407864
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407880
shr eax, 1
xor eax, 0xedb88320
jmp 0x407882
shr eax, 1
dec edx
jne 0x407873
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40786c
pop esi
ret

Function at 0x4078af
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bb
call fcn.00407864
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4078e6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4094ac
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409506
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094d2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4094e0
cmp edi, 1
jle 0x4094e0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408f90
test eax, eax
jne 0x409506
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409506
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409506
inc edi
dec esi
jne 0x4094c2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409510
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x40955d
xor ebx, ebx
jmp 0x409552
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c04
test eax, eax
jne 0x409551
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409533
mov al, byte [ebp - 1]
sub al, 1
jb 0x409568
je 0x409571
jmp 0x40957a
call fcn.00406ff8
mov edi, eax
jmp 0x40957c
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x40957c
xor edi, edi
test di, di
je 0x40960d
xor ebx, ebx
jmp 0x4095b8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095b7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095ac
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095b7
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409589
xor ebx, ebx
jmp 0x409602
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409601
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095f6
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409601
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095c7
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4068d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068fc
xor eax, eax
test eax, eax
je 0x40690f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40690f
xor ecx, ecx
jmp 0x406912
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a35
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5dec], 0
push esi
jne 0x406a6c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a46
mov dword [ecx*4 + 0x7a5de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a41
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a9d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5de8]
xor eax, esi
inc ecx
dec edx
jne 0x406a7f
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6bfc7208
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xa4961f3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x43b37a15
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42f314
nop
nop
mov ecx, 0x76712f87
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4124a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
jne 0x4124c0
mov dword [ebp + 0x14], 1
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00446b90
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ebx, dword [ebp + 0x1c]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41251a
push 6
call fcn.004463c5
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41252d
push ebx
call fcn.004463bf
add esp, 4
cmp dword [ebp - 0xc], 0x20
mov eax, 0
setg al
jmp 0x41253e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x41427d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4142bf
push 6
call fcn.004463c5
add esp, 4
push 0x80000301
push 0
push 0x8000
push 1
mov ebx, 0x184
call fcn.00448510
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4142f4
push ebx
call fcn.004463bf
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDList]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41431d
push 6
call fcn.004463c5
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x414339
push eax
mov ebx, eax
call fcn.00401077
inc eax
push eax
call fcn.004463b9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41433e
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41434f
push ebx
call fcn.004463bf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41b2f5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x41b32d
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x41b31b
mov al, 1
jmp 0x41b399
cmp dword [ebx + 0x54], ecx
jne 0x41b324
mov al, 2
jmp 0x41b399
cmp dword [ebx + 0x7c], ecx
jne 0x41b399
mov al, 3
jmp 0x41b399
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x41b342
mov al, 4
jmp 0x41b399
cmp ecx, 5
jne 0x41b362
cmp ebx, 0
jne 0x41b350
mov al, 5
jmp 0x41b399
cmp ebx, 1
jne 0x41b359
mov al, 6
jmp 0x41b399
cmp ebx, 2
jne 0x41b362
mov al, 7
jmp 0x41b399
cmp ecx, 0xa
jne 0x41b369
jmp 0x41b397
cmp ecx, 6
jne 0x41b399
cmp ebx, 0
jne 0x41b377
mov al, 8
jmp 0x41b399
cmp ebx, 1
jne 0x41b380
mov al, 9
jmp 0x41b399
cmp ebx, 2
jne 0x41b389
mov al, 0xa
jmp 0x41b399
cmp ebx, 3
jne 0x41b392
mov al, 0xb
jmp 0x41b399
cmp ebx, 4
jne 0x41b399
mov al, 0xc
pop ebx
leave
ret
Function at 0x41f15a
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x40
call fcn.004463b9
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41f1b1
push 6
call fcn.004463c5
add esp, 4
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild qword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fdiv qword [0x57f263]
fstp qword [ebp - 0x18]
push 0
push 0
push 0
push 0x80000601
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
mov ebx, 0x68
call fcn.0044aaa0
add esp, 0x1c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fld qword [ebp - 0x28]
call fcn.00401232
jmp 0x41f204
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004463bf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4296dd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebx], 0
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x429736
push 6
call fcn.004463c5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x42976a
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x429765
push 6
call fcn.004463c5
add esp, 4
jmp 0x429772
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x429783
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43f4e4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x43f514
push 6
call fcn.004463c5
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x43f528
mov esp, ebp
pop ebp
ret 4