joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100219fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x10040740]
mov esi, str.muesum.stfarcdnastra
push edi
push 5
pop ecx
lea edi, [ebp - 0x2c]
add eax, 0x253c56fc
rep movsd dword es:[edi], dword [esi]
imul edx, eax, 0xbb8fbb12
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, ebx
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2c], 0x6d
mov dword [ebp - 4], edx
jne 0x10021a61
mov cl, 0x6d
test cl, cl
je 0x10021a4e
cmp byte [ebp + eax - 0x2c], bl
je 0x10021a4e
mov cl, byte [eax + 0x10037f91]
inc eax
cmp cl, byte [ebp + eax - 0x2c]
je 0x10021a37
cmp dword [ebp - 4], eax
jae 0x10021a61
sub eax, dword [ebp - 4]
imul eax, eax, 0x4ae4729f
add edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
mov eax, str.ADsFreeEnumerator
xor ecx, 0x72d766e3
inc eax
cmp byte [eax], bl
jne 0x10021a69
mov esi, str.rDt2z0v_t
lea edi, [ebp - 0x14]
add edx, 0xea3c6c0f
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x14], 0x69
jne 0x10021aa7
mov cl, 0x69
test cl, cl
je 0x10021aa7
cmp byte [ebp + eax - 0x14], bl
je 0x10021aa7
mov cl, byte [eax + 0x10038155]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0x10021a90
movzx ecx, byte [eax + str.initials]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0xc34
jbe 0x10021ac5
lea ecx, [edx + 0x3267e905]
jmp 0x10021ace
mov ecx, dword [ebp - 4]
add ecx, 0x977d1091
xor ecx, 0xe74aa438
mov eax, ebx
xor edx, 0x693e74c9
mov dword [0x10040740], ecx
mov dword [0x100407f0], edx
inc eax
cmp byte [eax + str.txtFirstName], bl
jne 0x10021ae8
mov esi, dword [ebp - 8]
cmp esi, eax
jae 0x10021b1f
cmp esi, 0xd86
jne 0x10021b0c
lea ecx, [edx - 0x3df16131]
mov dword [0x10040740], ecx
mov edx, ecx
xor edx, 0x80375d8e
inc esi
cmp esi, eax
jb 0x10021af8
mov dword [0x100407f0], edx
imul eax, ecx, 0xef5de54
mov dword [0x10040808], eax
inc ebx
cmp byte [ebx + str.._AVbase_detail_exceptions_cryptocom_avast_com__], 0
jne 0x10021b2a
pop edi
pop esi
cmp ebx, 0x1bb2
pop ebx
jbe 0x10021b4b
mov eax, ecx
and eax, 0x8271c462
mov dword [0x10040808], eax
and eax, 0x4ed0dc01
mov dword [0x100407c8], eax
leave
ret
Function at 0x1002506b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, dword [0x100409f8]
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], ebx
movzx edi, word [ebx]
mov eax, esi
movzx ecx, di
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
test di, di
je 0x100250a8
inc eax
cmp word [ebx + eax*2], si
jne 0x10025094
mov esi, dword [0x100408a4]
cmp eax, 0x1ccd
ja 0x100250ae
lea esi, [edx - 0x7c2d6d6f]
mov eax, edx
xor ecx, ecx
or eax, 0x44609eb3
test di, di
je 0x100250dc
lea eax, [esi + 0x1e99a212]
xor esi, esi
inc ecx
cmp word [ebx + ecx*2], si
jne 0x100250c4
cmp dword [ebp - 0xc], ecx
jae 0x100250de
mov eax, dword [0x100409e8]
or eax, 0x49bdec5d
jmp 0x100250de
xor esi, esi
imul ecx, eax, 0x980f57c3
imul eax, edx, 0x76ba445e
mov dword [0x10040978], eax
mov eax, esi
inc eax
cmp word [eax*2 + 0x100396c0], si
jne 0x100250f1
cmp dword [ebp - 8], eax
jae 0x1002510f
sub eax, dword [ebp - 8]
imul ecx, ecx, 0x561950c2
sub eax, 1
jne 0x10025104
mov ecx, edx
mov eax, edx
xor ecx, 0xaf635ac7
or eax, 0xbca4d459
mov dword [0x100409e8], ecx
mov dword [0x100408a4], eax
test di, di
je 0x10025160
xor eax, eax
xor ecx, 0xd900fc5f
inc esi
cmp word [ebx + esi*2], ax
jne 0x10025130
mov dword [0x100409e8], ecx
mov ecx, dword [ebp - 0xc]
jmp 0x1002515c
cmp ecx, 0x1cbe
jne 0x1002515b
imul eax, edx, 0xf7e01d4d
mov dword [0x100409e8], eax
inc ecx
cmp ecx, esi
jb 0x10025148
mov eax, dword [ebp - 0xc]
lea edi, [ebp - 0x38]
xor ecx, ecx
mov esi, str.proxy_handshake_error
mov ebx, ecx
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
cmp ax, word [ebp - 0x38]
jne 0x100251a5
movzx ecx, di
xor eax, eax
xor edi, edi
test cx, cx
je 0x100251a2
cmp word [ebp + eax - 0x38], di
je 0x100251a2
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x38]
je 0x10025187
mov edi, dword [ebp - 4]
movzx ecx, byte [esi + ebx*2]
movzx eax, byte [ebp + ebx*2 - 0x38]
sub ecx, eax
cmp ecx, 0x184c
jb 0x100251c4
mov eax, edx
or eax, 0x589b9ec4
mov dword [0x100408a4], eax
imul eax, dword [0x10040978], 0x77fd8f4b
test di, di
pop edi
pop esi
pop ebx
mov dword [0x100408c8], eax
je 0x100251e7
and edx, 0xbae59482
mov dword [0x100409e8], edx
leave
ret
Function at 0x10025545
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, str.SafeZoneStable
lea edi, [ebp - 0x18]
xor ebx, ebx
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x44
jne 0x100255a7
mov cl, 0x44
test cl, cl
je 0x1002557f
cmp byte [ebp + eax - 0x18], bl
je 0x1002557f
mov cl, byte [eax + 0x100399f5]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x10025568
mov edx, dword [ebp - 4]
cmp edx, eax
jae 0x100255a7
mov ecx, dword [0x10040938]
cmp edx, 0x370
jne 0x1002559a
and ecx, 0x9f12b928
xor ecx, 0x53665c6b
inc edx
cmp edx, eax
jb 0x1002558c
jmp 0x100255ad
mov ecx, dword [0x10040938]
mov esi, ebx
imul edx, ecx, 0x116b7794
or edx, 0xea8129cb
inc esi
cmp byte [esi + str.lp.vog.nds], bl
jne 0x100255b5
cmp esi, 0xc12
mov eax, 0x917e5165
mov edi, 0xbcebf44f
mov ecx, ebx
cmovne eax, edi
xor eax, edx
or eax, 0xf9a88b0
add eax, 0x9a1366fa
inc ecx
cmp byte [ecx + str.muesum.nagihcim], bl
jne 0x100255e0
mov edx, dword [ebp - 4]
cmp edx, ecx
jae 0x10025613
mov esi, eax
and esi, 0xca5ce5f7
cmp edx, 0x1954
cmovne esi, eax
inc edx
lea eax, [esi - 0x2f51cfe0]
mov esi, eax
cmp edx, ecx
jb 0x100255f7
mov ecx, str.lp.kinsark
add eax, 0x3dfb0033
inc ecx
cmp byte [ecx], bl
jne 0x10025618
mov ecx, ebx
xor eax, 0x7532c0fd
inc ecx
cmp byte [ecx + str.ID_server_communication_error], bl
jne 0x10025624
mov edx, dword [ebp - 4]
cmp edx, ecx
jae 0x10025661
mov esi, eax
mov edi, eax
mov eax, edi
cmp edx, 0x13ec
jne 0x1002564e
mov eax, esi
or eax, 0xb270ec60
and eax, 0x847778c9
inc edx
mov dword [0x10040938], eax
mov esi, eax
mov edi, esi
cmp edx, ecx
jb 0x1002563d
mov ecx, ebx
or eax, 0xe1e1e92f
inc ecx
cmp byte [ecx + str.DataFolder], bl
jne 0x10025663
mov dword [0x10040938], eax
cmp ecx, 0x5af
jae 0x10025685
and eax, 0xabd71cba
jmp 0x1002568a
or eax, 0x17118edf
push 7
pop ecx
mov esi, str.invalid_sRGB_rendering_intent
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 0x3f1e4344]
mov eax, ebx
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x24], 0x6c
jne 0x100256c0
mov cl, 0x6c
test cl, cl
je 0x100256c0
cmp byte [ebp + eax - 0x24], bl
je 0x100256c0
mov cl, byte [eax + 0x10039555]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x100256a9
movzx ecx, byte [eax + str.last_command]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x784
jae 0x100256de
imul eax, edx, 0xa2ac8ddb
jmp 0x100256e4
lea eax, [edx - 0x5c07cc02]
mov ecx, ebx
or eax, 0xd6755edf
inc ecx
cmp word [ecx*2 + str.Missing_or_invalid_Encode_entry_in_stitching_function], bx
jne 0x100256e6
mov esi, dword [ebp - 4]
mov dword [0x10040938], eax
cmp esi, ecx
jae 0x1002572a
mov edi, eax
mov edx, eax
cmp esi, 0x1f1d
jne 0x10025716
mov edx, edi
and edx, 0x39d6769c
lea eax, [edx + 0x5abf7c67]
inc esi
mov dword [0x10040938], eax
mov edi, eax
mov edx, edi
cmp esi, ecx
jb 0x10025706
pop edi
or eax, 0xb4801bbb
add eax, 0x6393bd18
pop esi
mov dword [0x10040938], eax
pop ebx
leave
ret
Function at 0x10025b44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x100408ac]
sub esp, 0x4c
mov eax, str.888X888Y888
xor ecx, 0x9f7e770f
inc eax
cmp byte [eax], 0
jne 0x10025b55
push ebx
push esi
push edi
push 0xe
pop ecx
mov esi, str.com.avast.passwdmgr.proto.CreateUnlockKeyPayloadResponse
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x4c], 0x65
jne 0x10025bb6
mov cl, 0x65
test cl, cl
je 0x10025b94
cmp byte [ebp + eax - 0x4c], 0
je 0x10025b94
mov cl, byte [eax + 0x100394e1]
inc eax
cmp cl, byte [ebp + eax - 0x4c]
je 0x10025b7c
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x10025bb6
mov edx, dword [0x10040898]
cmp ecx, 0xb61
jne 0x10025baf
add edx, 0x6b1c1d3b
inc ecx
cmp ecx, eax
jb 0x10025ba1
jmp 0x10025bbc
mov edx, dword [0x10040898]
mov esi, str.kukatakana
lea edi, [ebp - 0x10]
and edx, 0xab34b96a
xor eax, eax
sub edx, 0x401110c
movsd dword es:[edi], dword [esi]
lea ebx, [edx - 0x16c8421f]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x38
jne 0x10025bfd
mov cl, 0x38
test cl, cl
je 0x10025bfd
cmp byte [ebp + eax - 0x10], 0
je 0x10025bfd
mov cl, byte [eax + 0x100395b5]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x10025be5
movzx ecx, byte [eax + str.888X888Y888]
movzx eax, byte [ebp + eax - 0x10]
sub ecx, eax
cmp ecx, 0xac8
jbe 0x10025c1b
and ebx, 0xf6802fb6
jmp 0x10025c23
mov edx, ebx
and edx, 0x838ce457
xor eax, eax
add ebx, 0x15a20dd2
inc eax
cmp byte [eax + str.PostData], 0
jne 0x10025c25
mov dword [0x100408ac], ebx
pop edi
pop esi
pop ebx
cmp eax, 0x159c
jbe 0x10025c4d
and edx, 0x6e01946b
jmp 0x10025c53
and edx, 0xc3c2ec32
mov dword [0x10040898], edx
leave
ret
Function at 0x10025c5b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov esi, str.Bad_delta_height_value_in_JBIG2_symbol_dictionary
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x48], 0x6f
jne 0x10025c98
mov cl, 0x6f
test cl, cl
je 0x10025c98
cmp byte [ebp + eax - 0x48], 0
je 0x10025c98
mov cl, byte [eax + 0x10039a01]
inc eax
cmp cl, byte [ebp + eax - 0x48]
je 0x10025c80
movzx ecx, byte [eax + str.orea.erawtfos]
movzx eax, byte [ebp + eax - 0x48]
mov edx, dword [0x10040880]
sub ecx, eax
cmp ecx, 0x12ff
jne 0x10025cc2
mov ebx, dword [0x10040994]
and edx, 0x16fc7d86
jmp 0x10025cc8
imul ebx, edx, 0x48b3726d
push 7
pop ecx
mov esi, str.muesum.loohcs
mov dword [ebp - 8], ebx
lea edi, [ebp - 0x34]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xc]
xor edi, edi
mov dword [ebp - 4], eax
movzx eax, word [esi]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ax, word [ebp - 0x34]
jne 0x10025d18
mov eax, edi
movzx ecx, cx
mov ebx, eax
test cx, cx
je 0x10025d12
cmp word [ebp + eax - 0x34], di
je 0x10025d12
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x34]
je 0x10025cf7
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [esi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x34]
sub ecx, eax
mov eax, dword [0x10040884]
cmp ecx, 0xf27
jbe 0x10025d3a
add eax, 0x175ced37
jmp 0x10025d3f
add eax, 0x61c1e263
mov dword [ebp - 0x14], edi
mov esi, str.COMPANY_ID
push 5
pop ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x10]
cmp di, word [ebp - 0x2c]
jne 0x10025db3
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov ebx, dword [ebp - 0xc]
movzx esi, di
xor edi, edi
test si, si
je 0x10025d85
cmp word [ebp + eax - 0x2c], di
je 0x10025d85
inc ecx
lea eax, [ecx + ecx]
movzx esi, word [eax + ebx]
cmp si, word [ebp + eax - 0x2c]
je 0x10025d6a
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
cmp eax, ecx
jae 0x10025db3
mov esi, dword [ebp - 4]
cmp eax, 0x1d29
jne 0x10025da8
mov edx, dword [0x10040964]
and edx, 0xc204804f
or esi, 0xc59ebc8a
inc eax
cmp eax, ecx
jb 0x10025d95
lea eax, [edx - 0x5a140c98]
or ebx, 0x87040346
mov dword [0x10040964], eax
lea ecx, [edx - 0x11ae9656]
xor eax, eax
mov dword [0x10040994], ebx
mov dword [0x100408bc], ecx
test di, di
je 0x10025dfc
mov esi, dword [ebp - 0xc]
xor edi, edi
add ecx, 0x248e9656
inc eax
cmp word [esi + eax*2], di
jne 0x10025de2
mov dword [0x100408bc], ecx
cmp eax, 0x17ad
jae 0x10025e08
xor edx, 0x51d42521
mov dword [0x10040964], edx
lea eax, [ebx + 0x1ce7ae0e]
pop edi
mov dword [0x10040884], eax
add eax, 0xb39bc574
pop esi
mov dword [0x10040880], eax
pop ebx
leave
ret
Function at 0x10026a06
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10040928]
xor edx, edx
push esi
push edi
push 8
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x3c]
pop ecx
mov esi, str.routerAddress
or eax, 0x8d0a75d1
rep movsd dword es:[edi], dword [esi]
push 0x61
pop esi
mov dword [ebp - 0x18], eax
mov eax, edx
cmp si, word [ebp - 0x3c]
jne 0x10026a6a
mov ecx, edx
test si, si
je 0x10026a6a
cmp word [ebp + ecx - 0x3c], dx
je 0x10026a6a
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.au.voginrehc]
cmp si, word [ebp + ecx - 0x3c]
je 0x10026a4c
movzx ecx, byte [eax*2 + str.au.voginrehc]
movzx eax, byte [ebp + eax*2 - 0x3c]
mov edi, dword [0x10040928]
sub ecx, eax
cmp ecx, 0x21f5
jae 0x10026a90
imul eax, dword [ebp - 0x18], 0x925454fd
jmp 0x10026a97
mov eax, edi
or eax, 0x7d8ad1a7
mov ecx, dword [ebp - 0x14]
mov esi, edx
movzx ecx, word [ecx]
mov dword [ebp - 0x18], ecx
test cx, cx
je 0x10026ae1
mov ecx, edi
mov edi, dword [ebp - 0x14]
and ecx, 0x94130cb3
mov dword [0x10040940], ecx
inc esi
cmp word [edi + esi*2], dx
jne 0x10026ab8
mov edi, dword [0x10040928]
cmp esi, 0x8ea
jne 0x10026ae7
lea ecx, [edi - 0x53d516cf]
mov edi, dword [0x100408ec]
mov dword [0x10040940], ecx
jmp 0x10026aef
mov ecx, dword [0x10040940]
mov edi, ecx
and edi, 0xbe742a2c
mov esi, eax
xor esi, 0x197b21c8
mov dword [ebp - 0x1c], esi
mov esi, edx
inc esi
lea edi, [edi - 0xf46f]
cmp byte [esi + str.ais_cmp_rdp], dl
jne 0x10026afc
cmp esi, 0x2485
jae 0x10026b22
mov eax, ecx
mov ecx, dword [0x10040874]
or eax, 0x5240be3a
jmp 0x10026b34
mov ecx, dword [0x10040874]
or ecx, 0x4eacc140
mov dword [0x10040874], ecx
mov dl, byte [str.av.settings.Set]
push 0
mov byte [ebp - 0x10], dl
test dl, dl
pop edx
je 0x10026b4b
mov eax, ecx
and eax, 0x3c60a94f
cmp word [ebp - 0x18], 0
mov esi, edx
je 0x10026b79
and eax, 0xa89a2dd5
mov dword [0x10040940], eax
mov eax, dword [ebp - 0x14]
inc esi
cmp word [eax + esi*2], dx
jne 0x10026b61
cmp dword [ebp - 0x1c], esi
jae 0x10026b79
mov eax, ecx
or eax, 0x5e57bd2c
mov dword [0x10040940], eax
lea eax, [edi - 0x677a563f]
mov esi, str.macronmonospace
lea edi, [ebp - 0x2c]
mov dword [0x1004091c], eax
mov al, byte [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp al, byte [ebp - 0x2c]
jne 0x10026be8
test al, al
je 0x10026bb0
cmp byte [ebp + edx - 0x2c], 0
je 0x10026bb0
mov al, byte [edx + 0x100409b1]
inc edx
cmp al, byte [ebp + edx - 0x2c]
je 0x10026b98
mov eax, dword [ebp - 0x1c]
mov esi, dword [0x1004091c]
cmp eax, edx
jae 0x10026bee
mov edi, dword [ebp - 0x1c]
or edi, 0x20ae15a2
cmp eax, 0x2341
jne 0x10026bd3
imul esi, ecx, 0x878c7579
inc eax
mov ecx, edi
cmp eax, edx
jb 0x10026bc6
mov dword [0x10040874], ecx
mov dword [0x1004091c], esi
jmp 0x10026bee
mov esi, dword [0x1004091c]
mov eax, esi
xor eax, 0x6534c190
mov dword [0x10040928], eax
lea eax, [esi + 0x2f6d3b93]
pop edi
mov dword [0x100408ec], eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x41dbc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc48
xor eax, eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41dd6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3a4]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a0]
call fcn.00408148
push dword [ebp - 0x3a0]
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.00408210
push dword [ebp - 0x3a8]
push 0x41dd80
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b0c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402d44
lea eax, [ebp - 0x1d0]
call fcn.00402ad4
lea eax, [ebp - 0x1d0]
call fcn.00402ee8
lea eax, [ebp - 0x3b0]
call fcn.0041ca9c
lea eax, [ebp - 0x3b0]
mov edx, 0x41dd90
call fcn.00404a54
mov edx, dword [ebp - 0x3b0]
lea eax, [ebp - 0x39c]
call fcn.00402d44
lea eax, [ebp - 0x39c]
call fcn.00402ad4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x39c]
call fcn.00404d90
call fcn.00403558
lea eax, [ebp - 0x39c]
call fcn.00402ee8
push 0
lea eax, [ebp - 0x3b4]
call fcn.0041ca9c
lea eax, [ebp - 0x3b4]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b4]
call fcn.00404c44
push eax
call sub.kernel32.dll_WinExec
push 0x5dc
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x3b8]
call fcn.0041ca9c
lea eax, [ebp - 0x3b8]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b8]
call fcn.004080e0
mov eax, dword [ebp - 4]
call fcn.004080e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dd74
lea eax, [ebp - 0x3b8]
mov edx, 7
call fcn.004047b8
lea eax, [ebp - 4]
call fcn.00404794
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3a347e5e
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x72eb7871
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b14
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059d5
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40a8c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a8fd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x40a906
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a910
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a931
mov al, byte [esp]
jmp 0x40a933
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40afb8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ae30
mov eax, dword [0x44e018]
cmp byte [eax], 0
je 0x40b034
mov eax, dword [0x44de3c]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408138
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b07c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b06a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x44ddec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x44f664]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret