joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e7c5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x438240
cmp edx, dword [eax]
je 0x40e7e7
add eax, 8
inc ecx
cmp eax, 0x4382d0
jl 0x40e7d8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x438240]
jne 0x40e915
mov eax, dword [0x43c380]
cmp eax, 1
je 0x40e8ef
test eax, eax
jne 0x40e818
cmp dword [0x437b04], 1
je 0x40e8ef
cmp edx, 0xfc
je 0x40e915
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40e84f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040b780
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040b870
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40e892
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040b870
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4301dc
push edi
call fcn.004111c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040b780
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040b790
lea eax, [ebp - 0xa0]
push 0x4301bc
push eax
call fcn.0040b790
push dword [esi + 0x438244]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040b790
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00411137
add esp, 0x2c
pop edi
jmp 0x40e915
lea eax, [ebp + 8]
lea esi, [esi + 0x438244]
push 0
push eax
push dword [esi]
call fcn.0040b870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..retplne
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x28e7470a
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5db40d94
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4014d8
cmp byte [esi + ebx - 1], 0xa
je 0x4014ac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401cf8
mov edi, dword [0x4060a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x401c07
test byte [0x403018], 8
jne 0x401ca0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x401c60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401ba9
cmp esi, 3
jbe 0x401c18
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401bba
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4052e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401ba9
mov dword [esp], 0x403028
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x401b80
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x401b80
mov dword [esp], 0x403018
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x401b6b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x401b73
mov eax, 0xffffffff
jmp 0x401c07

Function at 0x401d80
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x669b0bbe
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x36242016
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401029
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
nop
mov eax, 0x5c
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, str._s_c.
push eax
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x24c]
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x401079
jmp 0x401196
mov eax, dword [ebp - 0x148]
and eax, 0x10
cmp eax, 0
je 0x401109
mov eax, 0x408008
push eax
lea eax, [ebp - 0x11c]
push eax
call sub.msvcrt.dll_strcmp
add esp, 8
cmp eax, 0
je 0x401104
mov eax, 0x40800a
push eax
lea eax, [ebp - 0x11c]
push eax
call sub.msvcrt.dll_strcmp
add esp, 8
cmp eax, 0
je 0x401104
lea eax, [ebp - 0x11c]
push eax
mov eax, 0x5c
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0x40800d
push eax
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00401029
add esp, 0xc
jmp 0x401174
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x134]
push eax
call sub.kernel32.dll_CompareFileTime
cmp eax, 1
jne 0x401174
mov eax, dword [ebp + 0xc]
mov ecx, 8
push ecx
lea ecx, [ebp - 0x134]
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov eax, 0x5c
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, str._s_c_s
push eax
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 0
jne 0x401079
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose
leave
ret
Function at 0x402aaa
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
nop
mov eax, 0
mov byte [ebp - 0x105], al
mov eax, 0x409767
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, 0x40976c
push eax
call sub.msvcrt.dll_printf
add esp, 4
mov eax, 0x409792
push eax
call fcn.00401198
add esp, 4
push eax
lea eax, [ebp - 0x105]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
lea eax, [ebp - 0x105]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0
jbe 0x402b3a
lea eax, [ebp - 0x105]
push eax
mov eax, 0x409797
push eax
call sub.msvcrt.dll_printf
add esp, 8
lea eax, [ebp - 0x105]
push eax
call fcn.0040263f
add esp, 4
jmp 0x402b56
mov eax, 0x4097a9
push eax
call sub.msvcrt.dll_printf
add esp, 4
mov eax, 1
push eax
call sub.msvcrt.dll_exit
add esp, 4
leave
ret
Function at 0x402d14
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
nop
mov eax, 0
mov dword [ebp - 8], eax
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp eax, ecx
jge 0x402df6
jmp 0x402d4c
mov eax, dword [ebp - 4]
mov ecx, eax
inc eax
mov dword [ebp - 4], eax
jmp 0x402d2e
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
movsx eax, byte [ecx]
cmp eax, 0x27
je 0x402d6b
mov eax, dword [ebp - 8]
mov ecx, eax
inc eax
mov dword [ebp - 8], eax
jmp 0x402d4c
mov eax, dword [ebp - 8]
mov ecx, eax
inc eax
mov dword [ebp - 8], eax
mov eax, 0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
movsx eax, byte [ecx]
cmp eax, 0x27
je 0x402dc9
mov eax, dword [ebp - 4]
mov ecx, 0xff
imul eax, ecx
lea ecx, [ebp - 0xa02]
add ecx, eax
mov eax, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
add edx, eax
movsx eax, byte [edx]
mov byte [ecx], al
mov eax, dword [ebp - 8]
mov ecx, eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, eax
inc eax
mov dword [ebp - 0xc], eax
jmp 0x402d7c
mov eax, dword [ebp - 4]
mov ecx, 0xff
imul eax, ecx
lea ecx, [ebp - 0xa02]
add ecx, eax
mov eax, dword [ebp - 0xc]
add ecx, eax
mov eax, 0
mov byte [ecx], al
mov eax, dword [ebp - 8]
mov ecx, eax
inc eax
mov dword [ebp - 8], eax
jmp 0x402d41
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp eax, ecx
jge 0x402e8a
jmp 0x402e1c
mov eax, dword [ebp - 4]
mov ecx, eax
inc eax
mov dword [ebp - 4], eax
jmp 0x402dfe
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xa08], ax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
add eax, ecx
dec eax
mov word [ebp - 0xa06], ax
sub esp, 4
mov eax, esp
mov ecx, 4
push ecx
lea ecx, [ebp - 0xa08]
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov eax, dword [0x40c688]
push eax
call sub.kernel32.dll_SetConsoleCursorPosition
mov eax, dword [ebp - 4]
inc eax
mov ecx, dword [ebp - 4]
mov edx, 0xff
imul ecx, edx
lea edx, [ebp - 0xa02]
add edx, ecx
push edx
push eax
mov eax, 0x4097d8
push eax
call sub.msvcrt.dll_printf
add esp, 0xc
jmp 0x402e11
call sub.msvcrt.dll__getch
mov byte [ebp - 0xa03], al
movsx eax, byte [ebp - 0xa03]
cmp eax, 0x31
jl 0x402e8a
mov eax, dword [ebp + 8]
add eax, 0x30
movsx ecx, byte [ebp - 0xa03]
cmp ecx, eax
jg 0x402e8a
movsx eax, byte [ebp - 0xa03]
sub eax, 0x30
leave
ret

Function at 0x402fcc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll__mkdir
add esp, 4
call sub.msvcrt.dll__errno
mov ecx, dword [eax]
cmp ecx, 0
je 0x403058
call sub.msvcrt.dll__errno
mov ecx, dword [eax]
cmp ecx, 0x11
je 0x403058
mov eax, 0x409b0c
push eax
call sub.msvcrt.dll_perror
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov eax, 0x409b13
push eax
call sub.msvcrt.dll_printf
add esp, 8
mov eax, 0x409b4f
push eax
call sub.msvcrt.dll_printf
add esp, 4
mov eax, 0x409b6a
push eax
call sub.msvcrt.dll_printf
add esp, 4
mov eax, 0
mov dword [0x4095bc], eax
call fcn.00401000
mov eax, 0xffffffff
jmp 0x40305d
mov eax, 0
leave
ret
Function at 0x403ffa
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
mov eax, 0x40a3a5
push eax
call sub.msvcrt.dll_system
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.00403d2f
add esp, 4
mov eax, 0x40a3aa
push eax
call sub.msvcrt.dll_printf
add esp, 4
mov eax, 0x10
push eax
mov eax, 1
push eax
mov eax, 0x40a3da
push eax
mov eax, 6
push eax
call fcn.00402d14
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 6
je 0x40417b
jmp 0x404141
mov eax, 0x40c798
push eax
mov eax, dword [0x40c7b4]
push eax
mov eax, 0x40a432
push eax
mov eax, 0x40a421
push eax
mov eax, 0x40a419
push eax
call fcn.00403ee6
add esp, 0x14
jmp 0x40417b
mov eax, 0x40c79c
push eax
mov eax, dword [0x40c7b8]
push eax
mov eax, 0x40a455
push eax
mov eax, 0x40a448
push eax
mov eax, 0x40a441
push eax
call fcn.00403ee6
add esp, 0x14
jmp 0x40417b
mov eax, 0x40c7a0
push eax
mov eax, dword [0x40c7bc]
push eax
mov eax, 0x40a476
push eax
mov eax, 0x40a46b
push eax
mov eax, 0x40a464
push eax
call fcn.00403ee6
add esp, 0x14
jmp 0x40417b
mov eax, 0x40c7a4
push eax
mov eax, dword [0x40c7c0]
push eax
mov eax, 0x40a49e
push eax
mov eax, 0x40a491
push eax
mov eax, 0x40a485
push eax
call fcn.00403ee6
add esp, 0x14
jmp 0x40417b
mov eax, 0x40c7a8
push eax
mov eax, dword [0x40c7c4]
push eax
mov eax, 0x40a4c1
push eax
mov eax, 0x40a4b6
push eax
mov eax, 0x40a4ad
push eax
call fcn.00403ee6
add esp, 0x14
jmp 0x40417b
mov eax, dword [ebp - 4]
cmp eax, 3
jg 0x40416d
cmp eax, 3
jge 0x4040b8
cmp eax, 1
je 0x404060
cmp eax, 2
je 0x40408c
jmp 0x40417b
cmp eax, 4
je 0x4040e4
cmp eax, 5
je 0x404110
mov eax, dword [ebp - 4]
cmp eax, 6
jne 0x404004
leave
ret
Function at 0x4012ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc al, 0x12
mov esi, edi
mov dl, 0x21
test ebx, ebp
mov ah, 0x39
les edi, [ecx]
or edx, edi
test ebp, 0x181e10a3
imul edx, esi, 0x76ca931
inc edx
lea edx, [0xa5192f46]
jmp 0x401285
cmp ecx, ebp
movzx edi, ax
test cl, al
lea edx, [0x7038b626]
push 0xc5084c
and eax, ebx
imul ebp, edi, 0x74b9c1fa
mov eax, 0x768b3ed8
je 0x4012aa
test ecx, eax
mov cl, dh
call 0x4012ce
inc cl
mov cl, 0x82
and bl, bl
movsx ebp, dx
imul ebp, esi
xor edx, 0x3e8b
and bh, 0x30
imul ebp, ebx, 0x72ecb318
cmp bl, 0xab
sub ebx, ebx
inc ebx
mov edi, eax
add eax, esi
mov esi, 0x50bfdbd6
mov esi, esi
cmp ebx, 0x23f
jl 0x4012d0
pop ecx
inc edx
mov dh, ch
test esi, edi
jne 0x4012f7
xor al, 0xf1
mov edx, ecx
mov bl, 0x3c
mov edx, 0xbfc55a3b
mov bh, dl
movzx edi, al
test ebx, 0x6c2a609b
and eax, 0x7393ae28
test eax, edx
add bh, ah
test cl, 0xfe
mov bl, 0x68
add ecx, 0x1445a
mov eax, 0x4c8d765a
add ecx, 0xb93
movzx ebp, di
mov ebp, ebx
jno 0x401338
mov ebx, 0x26013095
test ebp, ecx
cmp dh, ah
jmp 0x40133f
sbb ebx, ebp
imul ebp, edi
movsx ebp, cl
cmp eax, ecx
mov edi, 0xf2ad29d7
xlatb
sub dword [ebp + 0x6dc7f7f2], ebp
xchg ecx, eax
shl byte [esi], 0xb0
push eax
mov dh, 0x98
lea ebx, [0x8443cef1]
push ecx
sbb esi, 0x4f9ddd25
xchg eax, edx
dec edx
test bh, cl
mov dh, ah
add ah, 0x9c
xchg al, al
sbb esi, esi
jno 0x40137d
test eax, edi
adc al, bh
mov eax, edi
push eax
pop esi
adc ah, bh
xchg eax, eax
mov edx, esi
mov al, 0x1a
imul esi, ecx
sub eax, 0x2ea640ff
push edx
mov esi, ebx
pop ebp
movzx esi, dx
movzx esi, si
jo 0x4013a7
mov edx, 0x645dbeb3
mov eax, edx
mov edi, ebp
test esi, 0xc9617c6e
inc esi
or ah, bl
dec esi
sub ebx, edi
and dh, cl
sbb ah, 0x6a
dec edx
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0xca45869
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
mov ecx, 0x15cf2f20
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x408943
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
mov edi, dword [esp]
add esp, 4
add esi, ebx
call fcn.00408974
push 0xbedf078c
mov ebx, dword [esp]
add esp, 4
add ebx, ebx
xor dword [ecx], edi
mov ebx, ebx
or esi, esi
inc ecx
cmp ecx, eax
jne fcn.00408943
dec ebx
ret
Function at 0x402e90
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404580
test esi, esi
jne 0x402ec7
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404670
jmp 0x402ee8
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d2c
mov dword [esp], eax
test esi, esi
je 0x402ee8
cmp dword [ebx], 0
je 0x402ee8
dec esi
jmp 0x402ecf
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4035a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4e4020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403638
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403618
xor eax, eax
push ebp
push 0x403611
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403654
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403618
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4e4020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4e4020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404358
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ef04c], 0
je 0x4043b9
cmp word [0x4ef220], 0xd7b2
jne 0x404381
cmp dword [0x4ef228], 0
jbe 0x404381
mov eax, 0x4ef21c
call dword [0x4ef238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4e406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043e0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e4030], 0
jne 0x4043d5
push 0
push 0x4e4064
push 0x4e406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404534
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402acc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4ef04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4044fc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406578
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4065de
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004047f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403140
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4065c8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065e5
lea eax, [ebp - 0x10]
call fcn.00404580
ret

Function at 0x4091bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404a40
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4091d5
test al, 0x10
jne 0x4091d9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c574
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c5ad
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404670
jmp 0x40c5b6
mov eax, ebx
mov edx, esi
call fcn.004045d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c5c0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c5e1
mov al, byte [esp]
jmp 0x40c5e3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cdc4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cc2c
mov eax, dword [0x4ee584]
cmp byte [eax], 0
je 0x40ce40
mov eax, dword [0x4ee07c]
call fcn.00402fac
call fcn.00402c58
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409500
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ce88
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ce76
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4edfd4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ef668]
call fcn.004059e4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret