joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411dfc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
lea eax, [ebp - 0x18]
mov esi, 0x200
lea edx, [ebp - 0x28]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4137d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], 2
mov dword [edx + 8], eax
cmp esi, 0x201
jae 0x411e5a
lea eax, [ebp - 0x44c]
mov edi, esi
mov ebx, 0x200
mov esi, eax
jmp 0x411e8a
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, ebx
sub esi, eax
sub ecx, eax
cmp ecx, esi
jae 0x411e82
mov dword [ebp - 0x10], 0
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00433178
add esp, 0xc
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov esi, dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov dword [ebp - 0x2c], esi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test eax, eax
jne 0x411eb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x411f80
cmp esi, edi
jne 0x411ed6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x411fc6
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x411e41
ja 0x411e41
cmp esi, ebx
mov dword [ebp - 0x10], 0
ja 0x411fe3
lea eax, [ebp - 0x4c]
push esi
push dword [ebp - 0x2c]
push eax
call fcn.0041530a
add esp, 0xc
mov eax, dword [ebp + 0xc]
movsd xmm0, qword [ebp - 0x4c]
movsd xmm1, qword [ebp - 0x44]
lea edx, [ebp - 0x3c]
mov eax, dword [eax]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
push eax
push ecx
push edx
call fcn.00410a54
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
cmp byte [eax], 0
jne 0x411f4b
push 3
push 0x4371e8
lea eax, [ebp - 0x3c]
push eax
call fcn.004111c4
add esp, 0xc
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea eax, [ebp - 0x4c]
push eax
call fcn.0040a45a
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
call fcn.00401356
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x4c]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
jmp 0x411f99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x80000001
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x411fb0
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402b10
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x4372ec
push 0x28
push 0x4372c4
call fcn.0043386f
add esp, 0xc
jmp 0x411ff2
push 0x4372b4
push ebx
push esi
call fcn.00433b14
add esp, 0xc
ud2
Function at 0x41202b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
lea eax, [ebp - 0x18]
mov esi, 0x200
lea edx, [ebp - 0x28]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4137e0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], 2
mov dword [edx + 8], eax
cmp esi, 0x201
jae 0x412089
lea eax, [ebp - 0x44c]
mov edi, esi
mov ebx, 0x200
mov esi, eax
jmp 0x4120b9
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, ebx
sub esi, eax
sub ecx, eax
cmp ecx, esi
jae 0x4120b1
mov dword [ebp - 0x10], 0
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00433178
add esp, 0xc
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov esi, dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x2c], esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4120dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412148
cmp esi, edi
jne 0x412101
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41218e
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x412070
ja 0x412070
cmp esi, ebx
mov dword [ebp - 0x10], 0
ja 0x4121ab
lea eax, [ebp - 0x3c]
push esi
push dword [ebp - 0x2c]
push eax
call fcn.0041530a
add esp, 0xc
movsd xmm0, qword [ebp - 0x3c]
movsd xmm1, qword [ebp - 0x34]
mov esi, dword [ebp + 8]
movsd qword [ebp - 0x44], xmm1
movsd qword [ebp - 0x4c], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
jmp 0x412161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x412178
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402b10
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x4372ec
push 0x28
push 0x4372c4
call fcn.0043386f
add esp, 0xc
jmp 0x4121ba
push 0x4372b4
push ebx
push esi
call fcn.00433b14
add esp, 0xc
ud2
Function at 0x4121df
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x444
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov esi, 0x200
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x4137f0
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
xor ecx, ecx
lea edx, [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [edx], ecx
mov dword [edx + 4], 2
mov dword [edx + 8], ecx
mov dword [ebp - 0x30], eax
cmp esi, 0x201
jae 0x412247
lea eax, [ebp - 0x450]
mov edi, esi
mov ebx, 0x200
mov esi, eax
jmp 0x412277
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, ebx
sub esi, eax
sub ecx, eax
cmp ecx, esi
jae 0x41226f
mov dword [ebp - 0x10], 0
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00433178
add esp, 0xc
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov esi, dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov dword [ebp - 0x2c], esi
push esi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x41229d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412309
cmp esi, edi
jne 0x4122c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41234f
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x41222e
ja 0x41222e
cmp esi, ebx
mov dword [ebp - 0x10], 0
ja 0x41236c
lea eax, [ebp - 0x40]
push esi
push dword [ebp - 0x2c]
push eax
call fcn.0041530a
add esp, 0xc
movsd xmm0, qword [ebp - 0x40]
movsd xmm1, qword [ebp - 0x38]
mov esi, dword [ebp + 8]
movsd qword [ebp - 0x48], xmm1
movsd qword [ebp - 0x50], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
jmp 0x412322
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x412339
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402b10
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x444
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x4372ec
push 0x28
push 0x4372c4
call fcn.0043386f
add esp, 0xc
jmp 0x41237b
push 0x4372b4
push ebx
push esi
call fcn.00433b14
add esp, 0xc
ud2
Function at 0x412bdd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
lea eax, [ebp - 0x18]
mov esi, 0x200
lea edx, [ebp - 0x28]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x413830
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], 2
mov dword [edx + 8], eax
cmp esi, 0x201
jae 0x412c3b
lea eax, [ebp - 0x44c]
mov edi, esi
mov ebx, 0x200
mov esi, eax
jmp 0x412c6b
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, ebx
sub esi, eax
sub ecx, eax
cmp ecx, esi
jae 0x412c63
mov dword [ebp - 0x10], 0
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00433178
add esp, 0xc
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov esi, dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov dword [ebp - 0x2c], esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x412c92
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412d61
cmp esi, edi
jne 0x412cb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x412da7
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
jmp 0x412c22
ja 0x412c22
cmp esi, ebx
mov dword [ebp - 0x10], 0
ja 0x412dc4
lea eax, [ebp - 0x4c]
push esi
push dword [ebp - 0x2c]
push eax
call fcn.0041530a
add esp, 0xc
mov eax, dword [ebp + 0xc]
movsd xmm0, qword [ebp - 0x4c]
movsd xmm1, qword [ebp - 0x44]
lea edx, [ebp - 0x3c]
mov eax, dword [eax]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
push eax
push ecx
push edx
call fcn.00410a54
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
cmp byte [eax], 0
jne 0x412d2c
push 3
push 0x4371e8
lea eax, [ebp - 0x3c]
push eax
call fcn.004111c4
add esp, 0xc
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea eax, [ebp - 0x4c]
push eax
call fcn.0040a45a
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
call fcn.00401356
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x4c]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
jmp 0x412d7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x80000001
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x412d91
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402b10
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x4372ec
push 0x28
push 0x4372c4
call fcn.0043386f
add esp, 0xc
jmp 0x412dd3
push 0x4372b4
push ebx
push esi
call fcn.00433b14
add esp, 0xc
ud2
Function at 0x417b9e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x418260
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x417be8
mov ecx, dword [ebp - 0x18]
mov edx, eax
mov dword fs:[0], ecx
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
mov dword [edx + 4], eax
xor eax, eax
xor esi, esi
mov dword [ecx], edx
mov dword [ecx + 4], 0x40ceb4
mov dword [edx], eax
lea edx, [ebp - 0x44]
inc esi
mov dword [ebp - 0x10], eax
mov dword [edx], str.failure_getting_env_string_from_OS:
mov dword [edx + 4], esi
mov dword [edx + 0x10], eax
mov dword [edx + 8], ecx
mov dword [edx + 0xc], esi
push 0x4386c0
push edx
call fcn.004337eb
add esp, 8
ud2

Function at 0x424765
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4247aa
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x4247a2
cmp ebx, ebp
ja 0x424801
cmp ebp, dword [esp + 0x1c]
ja 0x42480d
add ebx, esi
test eax, eax
je 0x4247a4
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x424794
jmp 0x4247ea
ja 0x4247aa
cmp edx, edi
mov ebx, ebp
jne 0x42477a
mov edx, dword [esp + 0x24]
test edx, edx
je 0x4247ee
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x4247cb
mov esi, edi
jmp 0x4247de
cmp edi, edx
je 0x4247f7
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x4247f0
xor al, 1
cmp esi, edx
jne 0x4247bd
jmp 0x4247f0
xor eax, eax
jmp 0x4247f0
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43ad90
call fcn.00433787
push 0x43ada0
push ebp
push ebx
call fcn.00433b25
push 0x43ada0
push dword [esp + 0x20]
push ebp
call fcn.00433b14

Function at 0x42536c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4253ab
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4253ab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4253ab
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4253ab
cmp dword [ecx + 0x74], 0xe
jbe 0x4253ab
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42c603
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42c6a0
push ebx
push esi
call fcn.0042c5cc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042c560
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42c64d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42c69f
push edi
push eax
call fcn.0042d220
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42c66d
call fcn.0042b0c1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42c69e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042c560
add esp, 0x20
test eax, eax
jne 0x42c68c
push edi
call fcn.0042b0c1
jmp 0x42c694
push ebx
call fcn.0042b0c1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42d99d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43d358
push 0x43d350
push str.FlsAlloc
push 0x1f
call fcn.0042d85c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42d9d1
push dword [ebp + 8]
mov ecx, esi
call dword [0x4341e8]
call esi
jmp 0x42d9d7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42da1b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43d368
push 0x43d360
push str.FlsGetValue
push 0x21
call fcn.0042d85c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42da52
push dword [ebp + 8]
mov ecx, esi
call dword [0x4341e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42da5a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43d370
push 0x43d368
push str.FlsSetValue
push 0x22
call fcn.0042d85c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42da94
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4341e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x432ef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x432f1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x432f1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1003dce9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1003dd19
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1003da2b
sbb dh, bh
xor eax, 0xc0458dc0
push eax
call fcn.1003da3b
push eax
push esi
push dword [ebp + 8]
call fcn.1003d9f0
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1003da2b
test eax, 0x8dc5059e
inc ebp
call 0x60ec3b21
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1003da3b
push eax
push esi
push dword [ebp + 8]
call fcn.1003d9f0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1003da3b
push eax
push esi
push dword [ebp + 8]
call fcn.1003d9f0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1003da3b
push eax
push esi
push dword [ebp + 8]
call fcn.1003d9f0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1003da2b
add byte [eax - 0x6277c5b4], al
jl 0x1003deb0
invalid
invalid
Function at 0x1003e0df
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0xc], ebx
jmp 0x1003e0ea
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1003e102
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1003e120
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1003e17e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1003e165
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1003e16e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1003e178
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1003e15a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1003e0e4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1003e1cb
dec eax
je 0x1003e1c2
sub eax, 3
je 0x1003e1b9
mov dword [ebp - 4], 0x40
jmp 0x1003e1e8
mov dword [ebp - 4], 4
jmp 0x1003e1ce
mov dword [ebp - 4], 0x20
jmp 0x1003e1ce
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1003e21a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1003e19a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1003da2b
or ah, byte [ecx]
lds eax, [ebx]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1003e226
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x59552301
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x238567be
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4014c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
push str.Russian
push 0
call fcn.00408b25
add esp, 8
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0x104
call fcn.0040564a
add esp, 4
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov edx, eax
mov dword [esp + 8], 0
mov ecx, edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0xf
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401532
sub ecx, esi
push ecx
push edx
lea ecx, [esp + 0x10]
call fcn.00403f40
cmp dword [esp + 0x1c], 0x10
lea eax, [esp + 8]
push 0x4266fc
cmovae eax, dword [esp + 0xc]
push eax
call fcn.00406810
mov edx, dword [esp + 0x24]
add esp, 8
mov esi, eax
cmp edx, 0x10
jb 0x40159a
mov ecx, dword [esp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401590
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401659
push edx
push ecx
call fcn.0040560c
add esp, 8
test esi, esi
je 0x4015aa
call fcn.00401070
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x104
call fcn.0040564a
add esp, 4
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, esi
mov dword [esp + 8], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0xf
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015f0
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x10]
call fcn.00403f40
cmp dword [esp + 0x1c], 0x10
lea eax, [esp + 8]
push 0x4266fc
cmovae eax, dword [esp + 0xc]
push eax
call fcn.00408d65
mov edx, dword [esp + 0x24]
add esp, 8
cmp edx, 0x10
jb 0x401652
mov ecx, dword [esp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401648
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40165e
push edx
push ecx
call fcn.0040560c
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0040ad56
call fcn.0040ad56
int3