joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e13
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x408fd9
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x41caa0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x408fd9
test cl, 0x48
je 0x408e79
mov al, byte [eax + 5]
cmp al, 0xa
je 0x408e79
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408ecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x408eb3
call fcn.004079a0
mov dword [eax], 9
call fcn.004079a9
mov dword [eax], esi
jmp 0x408ec3
cmp eax, 0x6d
je 0x408fd9
push eax
call fcn.004079b2
pop ecx
or eax, 0xffffffff
jmp 0x408fdb
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x408fd4
test edx, edx
je 0x408eee
cmp byte [ebx], 0xa
jne 0x408eee
or al, 4
jmp 0x408ef0
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x408fce
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x408fbe
cmp al, 0xd
je 0x408f24
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x408fb0
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x408f3e
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x408f39
add dword [ebp + 0x10], 2
jmp 0x408f92
mov dword [ebp + 0x10], eax
jmp 0x408fac
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408f66
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408fac
cmp dword [ebp - 0xc], 0
je 0x408fac
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x408f87
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x408f92
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x408faf
cmp ebx, dword [ebp + 0xc]
jne 0x408f97
cmp byte [ebp - 1], 0xa
jne 0x408f97
mov byte [ebx], 0xa
jmp 0x408faf
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00409794
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x408fb0
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x408f08
jmp 0x408fce
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x408fce
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x408fdb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a98b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4199e0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x419850]
je 0x40a9b8
inc eax
cmp eax, 0x12
jb 0x40a9a9
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x419850]
jne 0x40aaec
mov eax, dword [0x41c42c]
cmp eax, 1
je 0x40aac7
cmp eax, edx
jne 0x40a9e8
cmp dword [0x419084], 1
je 0x40aac7
cmp ecx, 0xfc
je 0x40aaec
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40aa21
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.0040ce70
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.0040a900
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40aa63
lea eax, [ebp - 0x10c]
push eax
call fcn.0040a900
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x416368
push edi
call fcn.0040cfc0
add esp, 0x10
push edi
call fcn.0040a900
push dword [esi + 0x419854]
mov ebx, eax
call fcn.0040a900
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00405bc0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0040ce70
push edi
push ebx
call fcn.0040ce80
push 0x416348
push ebx
call fcn.0040ce80
push dword [esi + 0x419854]
push ebx
call fcn.0040ce80
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00410d84
add esp, 0x2c
jmp 0x40aaec
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x419854]
push dword [esi]
call fcn.0040a900
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0040db1b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e529
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00405bc0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e5be
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x41c3d8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x40e5be
cmp eax, 1
je 0x40e5d6
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e5be
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x40e593
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40e5ba
xor eax, eax
inc eax
jmp 0x40e5f2
cmp esi, ebx
jae 0x40e5c2
xor eax, eax
jmp 0x40e5f2
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x41c3d8]
jmp 0x40e5d8
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4102ea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4199e0]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x410313
xor eax, eax
jmp 0x410481
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x41caa0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x410346
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.00412948
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x410418
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x410453
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x4103a1
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x410392
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x410375
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4103e1
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x4103ea
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x410366
jmp 0x4103ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x41047c
cmp dword [ebp - 8], edi
je 0x410453
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x410445
call fcn.004079a0
mov dword [eax], 9
call fcn.004079a9
mov dword [eax], esi
jmp 0x41044e
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41043a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x4103ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x4103ec
push dword [ebp - 8]
call fcn.004079b2
pop ecx
or eax, 0xffffffff
jmp 0x41047f
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x410468
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x410468
xor eax, eax
jmp 0x41047f
call fcn.004079a0
mov dword [eax], 0x1c
call fcn.004079a9
mov dword [eax], edi
jmp 0x41044e
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.0040db1b
leave
ret
Function at 0x410d84
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41c730], ebx
push esi
push edi
jne 0x410e04
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x410e3f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x417874
push edi
call esi
test eax, eax
mov dword [0x41c730], eax
je 0x410e3f
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41c734], eax
call esi
cmp dword [0x41c3d8], 2
mov dword [0x41c738], eax
jne 0x410e04
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41c740], eax
je 0x410e04
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41c73c], eax
mov eax, dword [0x41c73c]
test eax, eax
je 0x410e49
call eax
test eax, eax
je 0x410e30
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41c740]
test eax, eax
je 0x410e30
test byte [ebp - 8], 1
jne 0x410e49
cmp dword [0x41c3e4], 4
jb 0x410e43
or byte [ebp + 0x12], 0x20
jmp 0x410e68
xor eax, eax
jmp 0x410e78
or byte [ebp + 0x12], 4
jmp 0x410e68
mov eax, dword [0x41c734]
test eax, eax
je 0x410e68
call eax
mov ebx, eax
test ebx, ebx
je 0x410e68
mov eax, dword [0x41c738]
test eax, eax
je 0x410e68
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41c730]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412a89
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00405bc0
mov eax, dword [0x4199e0]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00409794
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x412bb3
push 2
push esi
push dword [ebp + 8]
call fcn.00409794
add esp, 0xc
cmp eax, ebx
je 0x412bb3
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x412b56
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.0040d0f0
push 0x8000
push dword [ebp + 8]
call fcn.004132b5
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x412b0f
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.004102ea
add esp, 0xc
cmp eax, 0xffffffff
je 0x412b2f
sub edi, eax
test edi, edi
jg 0x412b07
jmp 0x412b47
call fcn.004079a9
cmp dword [eax], 5
jne 0x412b44
call fcn.004079a0
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004132b5
pop ecx
pop ecx
jmp 0x412b9e
jge 0x412b9e
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409794
push dword [ebp + 8]
call fcn.004094c8
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x412b9e
call fcn.004079a0
mov dword [eax], 0xd
call fcn.004079a9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00409794
add esp, 0xc
mov eax, esi
pop edi
jmp 0x412bb5
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0040db1b
leave
ret
Function at 0x412d1b
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x417b08
call fcn.00407954
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x41c824], edi
jne 0x412d5f
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x412d4a
mov dword [0x41c824], ebx
jmp 0x412d5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x412d5f
mov dword [0x41c824], 2
mov eax, dword [0x41c824]
cmp eax, ebx
jne 0x412d7f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x412e42
cmp eax, 2
je 0x412d88
cmp eax, edi
jne 0x412db0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
cmp dword [ebp + 0x18], edi
jne 0x412d9b
mov eax, dword [0x41c6f4]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x24], eax
cmp eax, edi
jne 0x412db7
xor eax, eax
jmp 0x412e42
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00405bc0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x412dea
cmp esi, edi
jne 0x412e00
push dword [ebp - 0x24]
call fcn.0040b1f1
pop ecx
mov esi, eax
cmp esi, edi
je 0x412db0
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x24]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x412e33
cmp dword [ebp + 0x14], edi
jne 0x412e1d
push edi
push edi
jmp 0x412e23
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], edi
je 0x412e3f
push esi
call fcn.004078e2
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0040798f
ret
Function at 0x412e4b
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x417b18
call fcn.00407954
xor esi, esi
cmp dword [0x41c828], esi
jne 0x412e8f
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x412e7a
mov dword [0x41c828], edi
jmp 0x412e8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x412e8f
mov dword [0x41c828], 2
mov eax, dword [0x41c828]
cmp eax, 2
je 0x412f70
cmp eax, esi
je 0x412f70
cmp eax, 1
jne 0x412ed4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x412ebd
mov eax, dword [0x41c6f4]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x412edb
xor eax, eax
jmp 0x412f82
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00405bc0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x412f11
cmp edi, esi
jne 0x412f2c
lea eax, [ebx + ebx]
push eax
call fcn.0040b1f1
pop ecx
mov edi, eax
cmp edi, esi
je 0x412ed4
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x412f5f
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x412f49
push esi
push esi
jmp 0x412f4f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x412f6b
push edi
call fcn.004078e2
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x412f82
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0040798f
ret
Function at 0x4138bb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x413926
push 0x3d
push dword [ebp + 8]
call fcn.00413a9b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x413926
cmp dword [ebp + 8], esi
je 0x413926
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x41c3f8]
cmp eax, dword [0x41c3fc]
jne 0x41390c
mov edi, eax
call fcn.0041385a
mov dword [0x41c3f8], eax
cmp eax, ebx
jne 0x413965
cmp dword [ebp + 0xc], ebx
je 0x41392e
cmp dword [0x41c400], ebx
je 0x41392e
call fcn.004133fc
test eax, eax
je 0x413965
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x413a69
push 4
call fcn.0040b1f1
cmp eax, ebx
pop ecx
mov dword [0x41c3f8], eax
je 0x413926
mov dword [eax], ebx
cmp dword [0x41c400], ebx
jne 0x413965
push 4
call fcn.0040b1f1
cmp eax, ebx
pop ecx
mov dword [0x41c400], eax
je 0x413926
mov dword [eax], ebx
mov ebx, dword [0x41c3f8]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.0041380d
mov edi, eax
test edi, edi
pop ecx
jl 0x4139be
cmp dword [ebx], 0
je 0x4139be
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.004078e2
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x4139a6
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x4139f4
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x41399d
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.0040b203
test eax, eax
pop ecx
pop ecx
je 0x4139f4
jmp 0x4139ef
cmp dword [ebp - 4], 0
jne 0x413a62
test edi, edi
jge 0x4139ce
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.0040b203
test eax, eax
pop ecx
pop ecx
je 0x413926
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x41c3f8], eax
cmp dword [ebp + 0xc], 0
je 0x413a4b
push dword [ebp + 8]
call fcn.0040a900
inc eax
inc eax
push eax
call fcn.0040b1f1
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x413a4b
push dword [ebp + 8]
push esi
call fcn.0040ce70
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x413a44
or dword [ebp - 8], 0xffffffff
push esi
call fcn.004078e2
pop ecx
cmp dword [ebp - 4], 0
je 0x413a5a
push dword [ebp + 8]
call fcn.004078e2
pop ecx
mov eax, dword [ebp - 8]
jmp 0x413929
push esi
call fcn.004078e2
pop ecx
xor eax, eax
jmp 0x413929
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x4d544e05
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x4b8d0643
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1111a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x1111b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x1111b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x1111b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01111b71
test eax, eax
je 0x1111b67
add ebx, 0x14
jmp 0x1111b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x1111b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x1111ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x1111ddd
mov eax, 1
test eax, eax
je 0x1111ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x1111ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x1111dd3
mov ebx, eax
and eax, 0x80000000
jne 0x1111d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x1111ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x1111ddd
mov eax, 1
test eax, eax
je 0x1111ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x1111ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x1111ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x1111ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x1111b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x1111ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x1111ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc