joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bd10
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x3128fd25
pop ebx
sub ecx, ebx
lcall 0x700, 0x8f3ccc44
pop ecx
inc esp
rcl dword [edx + 0x60]
call 0x22bfb382
jmp 0xba82dacf
and eax, 0x41af4b1c
and eax, 0x72bca3ee
push ebp
popfd
inc edx
jg 0x45bd36
push edx
xor ebx, dword [ecx - 0x2f6bd754]
jl 0x45bceb
lodsb al, byte [esi]
lahf
cmp al, 0x6d
mov cl, 0x3c
mov bh, 0x42
jae 0x45bd1a
sub al, 0xfc
int3
dec ecx
push ss
jl 0x45bd4f
loopne 0x45bce3
stosd dword es:[edi], eax
or eax, 0x7a3b8fb2
insd dword es:[edi], dx
cwde
and al, 0x99
pop ecx
inc esi
idiv dword [ebp - 0x7c8a4283]
cmpsd dword [esi], dword es:[edi]
xor ebp, dword [edi - 0x230442a3]
std
inc edx
pop eax
das
sub al, 0x7e
cmp eax, 0x5b1605cc
mov edi, 0x4a697150
mov esi, 0xc4dc3c3f
inc eax
inc esp
sub eax, ecx
or ah, byte [ebp - 0x635544b9]
popfd
pop esi
xor eax, 0xbc1ebecd
aaa
test eax, 0xf90fef09
sahf
and dword [ebx + 0xd], ecx
invalid

Function at 0x4694ef
Capabilities:
Check http status code

Disassembly:
pop edx
iretd
wait
push 0xffffffffffffffc6
and al, byte [edx - 0x640da506]
fiadd word [0xa3eaa96c]
cdq
leave
sub byte [edi - 0x907d077], cl
jne 0x4693f9
inc ecx
xor ebx, 0xffffff83
sub edi, ecx
jne 0x469341
push 0x13
mov ch, 0x68
invalid
mov esp, 0x26286887
das
aad 0x16
cmc
jmp 0x469436
je 0x469376
salc
invalid
stc
xchg esi, eax
sti
fdiv st(5), st(0)
xor byte [edx], ch
inc eax
sub dh, bl
inc eax
jp 0x469379
pop edx
sub ebx, esp
jnp 0x4693f4
int 0xc3
sbb eax, 0xd2b85b5d
lcall 0x1368, 0x8935f66b
add esi, dword [ebp - 0x56]
jbe 0x4693ee
salc
add dword [eax], eax
sub eax, 0x4ef62b96
add byte [0x4ef62b96], ch
and edi, dword [ebx + 0x3b]
jno 0x4693b5
sbb esi, ebp
outsb dx, byte [esi]
add edi, dword [ebx + 0x58]
add esi, 0xffffffd1
mov dh, 0xdc
mov ds, esi
aas
cdq
dec ebx
fcomp qword [esi + edx*8 + 2]
invalid
ja 0x4693d1
jnp 0x4693ef
fisttp qword [0xcaeba6d8]
retf 0xa807
push esi
push 0x97602bec
call 0xfe0fc510
xor cl, cl
std
cli
inc edi
jne 0x46947b
cmp dl, bh
jmp 0x469415
sub ebp, edx
mov edi, 0x4b169d90
in ax, dx
push eax
int3
xor eax, 0xbab42f6
mov ch, 0x6d
xchg edx, eax
mov eax, 0x21c69e26
sahf
xor al, bl
xchg dword [edx + 0x2a], ebx
push ss
cli
xchg edx, eax
mov eax, dword [0x65430e5f]
invalid
lodsb al, byte [esi]
out dx, eax
sahf
arpl word [eax + esi*2 - 0x3dd81d7a], si
jae 0x469483
jo 0x46947c
loop 0x46951f
ret 0x8873
sahf
push 0x72abe616
mov edi, ebp
and dword [edi], esi
xchg ebp, eax
inc eax
loop 0x46952d
xadd bl, bl
push 0xc06348a6
adc eax, 0x788635cc
shl byte [eax], cl
je 0x469513
int3
mov ss, esi
mov al, 0x68
pop ss
loopne 0x4694cc
pushal
jle 0x469570
adc dl, byte [esi]
scasb al, byte es:[edi]
loopne 0x469559
jmp 0x4694ba
sbb dh, al
cmpsb byte [esi], byte es:[edi]
test al, 0xc8
mov esi, 0x30b62c9f
jne 0x4694f4
sbb ch, ah
or byte [ebx + 0x40c87884], ah
insb byte es:[di], dx
mov bh, 0x45
xchg esi, eax
adc dword [edx], esi
fisttp qword [eax + 0x17]
push 0x510e16d1
mov byte [0x36f9305e], al
xchg ebp, eax
daa
arpl di, si
jmp eax
mov dl, pe_nt_image_headers32
xchg ebp, eax
mov cl, 0x56
outsd dx, dword [esi]
add dword [ebp + 0x45], 0x30
inc ecx
adc byte [edx - 0x2b1e2b10], dl
arpl dx, di
xlatb
clc
pushal
iretd
Function at 0x469a2f
Capabilities:
Encode data using xor

Disassembly:
dec dword [eax + 0x6e]
dec edx
insd dword es:[edi], dx
cmp ch, ah
mov byte [edx], cl
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
pop ss
popfd
pop edi
cmpsd dword [esi], dword es:[edi]
sbb al, 0xdc
fadd st(5), st(0)
add eax, 0x68c810da
cwde
sti
push esp
mov ah, 0x1e
xor al, 0xd
jnp 0x469a3a
sub eax, 0x6266ac54
js 0x469aaf
xchg ebp, eax
cmp al, 9
invalid
jmp 0x8249fea4

Function at 0x472970
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
adc dword [ecx + 0x40fd2b21], edx
mov ch, 0x36
push esi
pop ebp
push ss
cmp byte [ebx + ebx*8 - 0x12], dh
scasd eax, dword es:[edi]

Function at 0x4a1d10
Capabilities:
Encode data using xor

Disassembly:
pop es
mov fs, word [ebx + ebx*4 + 0x64]
inc edx
mov ebx, dword [edi]
cmc
aaa
sbb ebx, esp
sub bh, dl
mov al, byte [0x5b40b1eb]
ljmp 0xa5de
je 0x4a1c10
scasd eax, dword es:[edi]
lea edx, [ebp - 0x1fa63e7f]
adc eax, 0x84e566da
adc ebx, ecx
pushal
aaa
test al, 0xe8
loope 0x4a1c87
jbe 0x4a1c87
jne 0x4a1bdc
leave
in al, dx
xchg esi, eax
dec edi
pop ebp
movsb byte es:[edi], byte [esi]
xchg ebx, eax
clc
test byte [eax + 0x2bb122d4], 0xdd
fnstsw word [edi - 0x2c]
adc ecx, dword [ecx - 0x19]
push esp
or esp, edx
inc ebp
iretd
popfd
dec eax
lahf
mov edx, edx
xor al, 0xee
lahf
bswap ebp
int3
push ebx
mov dword [ebp + 0x2fcc1706], 0x77ca1e33
inc edx
mov ecx, esp
mov edi, 0xc0b85b9e
aam 0x45
sub byte [esi], 0x47
xor al, 0x36
cmp eax, 0xb99fa05f
pop ebp
mov byte [ebp - 0x5c], ah
pop edi
jg 0x4a1c39
or al, 0xa8
or byte [edx + 0x74], dh
jno 0x4a1bfb
mov bh, 0x99
pop esi
xor al, 0x8d
outsb dx, byte [esi]
lea esi, [esp + ebx + 0x37ebad2d]
jo 0x4a1c83
lodsd eax, dword [esi]
jmp 0x4a1cbd
sti
add eax, 0xa50bb7d3
popfd
hlt
mov eax, 0x895e9f4b
loope 0x4a1cec
add edi, dword [esi + 0x4f81efd0]
invalid
pop ds
jno 0x4a1c87
mov byte [edi + 0x6ad69ce6], bl
inc edx
out 0x9c, al
salc
push 0x42
jbe 0x4a1d33
aas
mov dword [edi], edi
out 0x59, eax
fadd dword [ebp + 0x7ff69e16]
sbb byte [edx + 0x1fcdcc6b], al
js 0x4a1ce7
or al, 0x4b
arpl word [eax - 0x4239d7f4], si
xor eax, 0xbf24d548
aad 0x24
mov edi, 0xc10fb44a
leave
add al, 0xcc
sub ah, byte [edx]
cld
adc edi, edx
inc ebx
mov bl, 5
xchg ebx, eax
mov edi, 0x97cd2ba3
xor dh, byte [ebp - 0x48]
les ecx, [ecx + 0x6d]
cmp edi, edi
cwde
sbb esp, 0x69
xchg edx, eax
xor eax, 0x6c44e9a4
jno 0x4a1cf3
invalid
Function at 0x6085bf
Capabilities:
Authenticate hmac

Disassembly:
sbb eax, 0xf92405fc
int1
pop esp
add dword [ebx + 0x32], ebp
imul esi, dword [edx], 0x28
sub cl, byte [ebx + 0x48]
imul esi, dword [edx], 0x28
sub cl, byte [ebx + 0x48]
add cl, byte [edi - 0x37]
pop ebx
mov al, 0x98
bound ebx, qword [ebx]
fsubrp st(6)
adc dl, byte [esi - 0x6d39d345]
movsd dword es:[edi], dword [esi]
jle 0x6085b7
mov edx, 0xef7d5910
cld
mov ecx, 0xd13e5dc8
dec edx
mov word [eax], es
popfd
pushfd
mov cl, 0x20
les esi, [eax + 0x4a]
adc byte [ebx - 5], cl
xchg ebp, eax
adc dl, bh
or dword [esi - 0x4865955d], esp
cmp cl, byte [edx - 0x69ca707a]
jnp 0x60862d
mov ebx, 0x580375c6
dec ecx
rol dword [esi - 0x36d9c8c4], 1
add ebp, esi
or ebx, dword [ecx + 0x1f752c38]
rcl byte [esi + 0x41480ac4], 0xb1
cwde
cmp dword [eax], ebp
mov ebx, 0x36314023
jno 0x608630
cmp al, 0x9e
imul edi, dword [ecx], 0x4a
dec edx
int1
cdq
stc
sub al, 0x7f
wait
scasd eax, dword es:[edi]
inc ebx
cli
psllq mm5, qword [0x864fa2da]
in al, 0x66
pop edx
fstp st(2)
pop ecx
invalid

Function at 0x627220
Capabilities:
Encode data using xor

Disassembly:
fadd qword [esi + 0xa2080d6]
and dword [edi + 0x1f], ebx
pop ds
jmp 0x6271e2
inc ebx
lahf
wait
loope 0x6271af
xchg dword [ebx - 0x3c08d857], eax
sbb cl, byte gs:[ebp*8 + 0x4a2443e7]
daa
test ebx, 0xed0c1a65
out 0x43, eax
and al, 0x4a
js 0x6271bb
jl 0x627204
popal
xor al, byte [esp + edx*8]
dec ecx
push ss
xor byte [edi + eax*4], dl
inc eax
jno fcn.00627220
xchg ebp, eax
cmc
movsb byte es:[edi], byte [esi]
fimul dword [esp + eax*2 - 1]
inc ecx
cmpsb byte [esi], byte es:[edi]
pop ecx
or al, 5
sbb al, 0x9d
jno 0x62722d
add edi, ebx
sub al, 0xc4
outsd dx, dword [esi]
test eax, 0x9b3c5ae4
jo 0x6271b3
cmp bh, byte [ebp + 0x4b9b4101]
adc bl, byte [edi + 0x381be81c]
or byte [ecx], al
add al, bl
pop edx
inc ebp
out dx, al
and al, byte [esi - 0x5fad0402]
sub dword [esi - 0x1e726028], esi
inc esp
jge 0x62721e
pop es
and dword [eax], ecx
out 0x99, al
jg 0x6271b4
popal
scasb al, byte es:[edi]
je 0x6271b5
xchg esi, eax
movsb byte es:[edi], byte [esi]
jns 0x6271a7
dec eax
push 0xcafa2cb2
mov esp, es
mov esp, gs
lodsb al, byte [esi]
scasd eax, dword es:[edi]
or bh, byte [esi]
jb 0x627280
cmp dword [ecx - 0x63], ebx
in eax, 0xaa
jnp 0x627246
push ss
aaa
xor al, 0x14
test dl, bh
wait
stosb byte es:[edi], al
arpl word [esi - 0x554353e3], cx
invalid
mov esp, 0x44bc8eaa
pop edi
xchg esp, eax
insd dword es:[edi], dx
in al, 0
fistp qword [eax + 0x5f9fbe63]
iretd
or dword [esi - 7], edx
dec eax
neg dword [esi - 0x41]
loopne 0x6272ba
cdq
xor eax, 0x59d6ce7
cmc
shr dword [ebp + 0x55], cl
inc ebx
adc ebx, dword [eax + 0x60d965ef]
xor ecx, ebp
out dx, al
dec ebp
faddp st(0)
aas
invalid
xor ah, dl
das
xor cl, 0xdf
call 0xbe429eab
iretd
Function at 0x629611
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6343e8
cmp edx, dword [eax]
je 0x629633
add eax, 8
inc ecx
cmp eax, 0x634478
jl 0x629624
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6343e8]
jne 0x629761
mov eax, dword [0x63cd70]
cmp eax, 1
je 0x62973b
test eax, eax
jne 0x629664
cmp dword [0x634310], 1
je 0x62973b
cmp edx, 0xfc
je 0x629761
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62969b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629ff0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a480
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6296de
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a480
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ef04
push edi
call fcn.0062c350
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629ff0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a000
lea eax, [ebp - 0xa0]
push 0x62eee4
push eax
call fcn.0062a000
push dword [esi + 0x6343ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a000
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c2c4
add esp, 0x2c
pop edi
jmp 0x629761
lea eax, [ebp + 8]
lea esi, [esi + 0x6343ec]
push 0
push eax
push dword [esi]
call fcn.0062a480
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10002140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10053bac], 0
je 0x10002158
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push str.___StartThread
call fcn.10002f20
mov eax, dword [0x10053cc0]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
jne 0x10002186
push 0
push 0
push 0
push 0
call esi
mov dword [0x10053cc0], eax
mov ecx, dword [0x10053cc4]
test ecx, ecx
jne 0x100021a3
push ecx
push ecx
push ecx
push ecx
call esi
mov ecx, eax
mov eax, dword [0x10053cc0]
mov dword [0x10053cc4], ecx
cmp dword [0x10053cc8], 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jne 0x100021c1
push 0
push 0
push 0
push 0
call esi
mov dword [0x10053cc8], eax
cmp dword [0x10053ccc], 0
jne 0x100021d9
push 0
push 0
push 0
push 0
call esi
mov dword [0x10053ccc], eax
push 0
push 0
push 0
push 0x10001c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
mov dword [0x10053bac], eax
lea eax, [ebp - 8]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
test edi, edi
jne 0x1000221d
push str.Thread_started_success
call fcn.10002f20
mov eax, dword [0x10053bac]
add esp, 4
jmp 0x10002255
cmp edi, 1
jne 0x10002231
push str.Thread_started_failed
call fcn.10002f20
add esp, 4
jmp 0x1000224e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push str.Thread_started_with_error:__d__errorcode:__d
call fcn.10002f20
push esi
call fcn.10003360
add esp, 0x10
xor eax, eax
mov dword [0x10053bac], eax
xor ebx, ebx
test eax, eax
setne bl
push ebx
push str.___StartThread_returns__d
call fcn.10002f20
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x201
push 0
push str.SOFTWAREBiometric_CenterID_CenterIDC_SmartCard_ConnectorMada
push 0x80000002
mov esi, 0xbb8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002e00
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.MutexTimeout
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002df7
cmp dword [ebp - 8], 4
jne 0x10002df7
cmp dword [ebp - 0xc], 4
jne 0x10002df7
mov edx, dword [ebp - 0x10]
lea ecx, [edx - 1]
cmp ecx, 0x1d4be
cmovbe esi, edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002e10
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x10053008]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10002e59
lea eax, [ebp - 0x208]
push eax
push str.Current_User:__s
call fcn.10002f20
add esp, 8
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x10002edd
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx eax, word [ebp - 0x20c]
push eax
movzx eax, word [ebp - 0x20e]
push eax
movzx eax, word [ebp - 0x210]
push eax
movzx eax, word [ebp - 0x212]
push eax
push str.Process_Start_Time:__02d___02d:_02d:_02d
call fcn.10002f20
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push edx
push str....System_is_up_for__u_seconds
call fcn.10002f20
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.100034e6
mov esp, ebp
pop ebp
ret
Function at 0x100317f8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100311b6

Function at 0x1004254b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004241f
Function at 0x41b790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x41b7aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41b7b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41b7a0
mov eax, 1
add ebx, ebx
jne 0x41b7c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41b7b8
jne 0x41b7d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b7b8
xor ecx, ecx
sub eax, 3
jb 0x41b7e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41b85a
mov ebp, eax
add ebx, ebx
jne 0x41b7f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41b800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41b824
inc ecx
add ebx, ebx
jne 0x41b810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41b805
jne 0x41b821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b805
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41b844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41b835
jmp 0x41b7a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41b844
add edi, ecx
jmp 0x41b7a6
pop esi
mov edi, esi
mov ecx, 0x12d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41b862
cmp byte [edi], 2
jne 0x41b862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41b867
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41b8d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b638]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b6cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41b894
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b6d4]
or eax, eax
je 0x41b8d0
mov dword [ebx], eax
add ebx, 4
jmp 0x41b8b1
call dword [esi + 0x1b6d0]
mov ebp, dword [esi + 0x1b6d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41b90a
sub esp, 0xffffff80
jmp 0x405a80

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
mov ecx, 0x377a5703
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x7e5c4ac0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402f6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x452020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403004
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fe4
xor eax, eax
push ebp
push 0x402fdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403020
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fe4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x452020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x452020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d40
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45404c], 0
je 0x403da1
cmp word [0x454220], 0xd7b2
jne 0x403d69
cmp dword [0x454228], 0
jbe 0x403d69
mov eax, 0x45421c
call dword [0x454238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45206c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403dc8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x452030], 0
jne 0x403dbd
push 0
push 0x452064
push 0x45206c
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x4053a0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055d0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405423
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405423
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055ec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4054ac
xor eax, eax
push ebp
push 0x4054a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004051e8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40548a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40560c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40548a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4054ac
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4055c6
cmp byte [ebp - 0xd], 0
jne 0x4054f3
cmp byte [ebp - 0x12], 0
je 0x4055c6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40550c
dec ebx
cmp byte [ebx], 0x2e
je 0x40551b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40550b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4055c6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405558
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4055c6
cmp byte [ebp - 0xd], 0
je 0x4055c6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4055c6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret