joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035d0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push edi
push str.C:HPData
push eax
mov edi, ecx
call esi
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.HPWMISVC.log
lea eax, [ebp - 0x210]
push eax
call esi
push 0
push 0x80
push 4
push 0
push 1
push 4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0xa20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xa12]
movzx eax, word [ebp - 0xa14]
push edi
push ecx
push eax
movzx eax, word [ebp - 0xa16]
push eax
movzx eax, word [ebp - 0xa18]
push eax
movzx eax, word [ebp - 0xa1a]
push eax
movzx eax, word [ebp - 0xa1e]
push eax
movzx eax, word [ebp - 0xa20]
push eax
push str._04d:_02d:_02d:_02d:_02d:_02d:_04d:_s_r_n
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.00401120
add esp, 0x2c
lea eax, [ebp - 0xa10]
mov edx, 0x7fffffff
nop
cmp word [eax], 0
je 0x4036be
add eax, 2
sub edx, 1
jne 0x4036b0
xor eax, eax
mov ecx, 0x80070057
test edx, edx
cmovne ecx, eax
mov eax, 0x7fffffff
sub eax, edx
xor esi, esi
test edx, edx
cmovne esi, eax
test ecx, ecx
js 0x4036e1
lea eax, [esi + esi]
jmp 0x4036e3
xor eax, eax
cmp ebx, 0xffffffff
je 0x403707
push 0
lea ecx, [ebp - 0xa34]
push ecx
push eax
lea eax, [ebp - 0xa10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aea4
mov esp, ebp
pop ebp
ret
Function at 0x4040b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0041d300
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.0040ce90
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0x800
push 0
push eax
call fcn.0040ce90
add esp, 0xc
mov dword [ebp - 0x100c], 0
cmp dword [0x42d3bc], 0
je 0x404130
push str.ServiceImpersonateLoggedInToRevertUser
push str._S___Start
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
push 0x423938
lea eax, [ebp - 0x1008]
push 0x104
push eax
call fcn.00401120
add esp, 0xc
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40418a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1008]
push eax
push str.GetUserName_fail__s__GetLastError__:_08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x14
jmp 0x4041b3
cmp dword [0x42d3bc], 0
je 0x4041be
lea eax, [ebp - 0x1008]
push eax
push str.GetUserName_pass__s
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, eax
test esi, esi
jne 0x4041d1
push str.RevertToSelf___Fail
jmp 0x4041df
cmp dword [0x42d3bc], 0
je 0x4041fe
push str.RevertToSelf___pass
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0xc
lea ecx, [ebp - 0x808]
call fcn.004035d0
push 0x423938
lea eax, [ebp - 0x1008]
push 0x104
push eax
call fcn.00401120
add esp, 0xc
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x404258
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1008]
push eax
push str.GetUserName_fail__s__GetLastError__:_08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x14
jmp 0x404281
cmp dword [0x42d3bc], 0
je 0x4042bf
lea eax, [ebp - 0x1008]
push eax
push str.GetUserName_pass__s
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [ebp - 0x808]
call fcn.004035d0
cmp dword [0x42d3bc], 0
je 0x4042bf
push esi
push str.ServiceImpersonateLoggedInToRevertUser
push str._S___end_return:_08X
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.00401120
add esp, 0x14
lea ecx, [ebp - 0x808]
call fcn.004035d0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040aea4
mov esp, ebp
pop ebp
ret
Function at 0x40a3e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa18
mov eax, dword [0x42c008]
xor eax, esp
mov dword [esp + 0xa14], eax
push esi
push edi
push str.SetOMENPlatformInformationToReg___Start
lea eax, [esp + 0x14]
mov dword [esp + 0x10], edx
push 0x400
push eax
mov edi, ecx
call fcn.004011b0
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004035d0
push 0x208
lea eax, [esp + 0x814]
push 0
push eax
call fcn.0040ce90
add esp, 0xc
lea eax, [esp + 0x810]
push str.CLSID60EB195D_B64E_4209_8AB8_53E040061B9CKeyboardUtility
push 0x4239b4
push 0x104
push eax
call fcn.00401120
lea eax, [esp + 0x820]
push eax
push str.RegOpenKeyEx_HKEY_CLASSES_ROOT__s
lea eax, [esp + 0x28]
push 0x400
push eax
call fcn.00401120
add esp, 0x20
lea ecx, [esp + 0x10]
call fcn.004035d0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x2001b
push 0
lea eax, [esp + 0x81c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a50b
push eax
push str.RegOpenKeyEx_KEY_READKEY_SET_VALUE_fail_lRet_d
lea eax, [esp + 0x18]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.004035d0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x814]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40a502
push eax
push str.RegCreateKeyExW_fail_lRet_d_return_0
lea eax, [esp + 0x18]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
jmp 0x40a5e3
push 0
push str.RegCreateKeyExW_success_lRet_d
jmp 0x40a512
push 0
push str.RegOpenKeyEx_KEY_READKEY_SET_VALUE_success_lRet_d
lea eax, [esp + 0x18]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.004035d0
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push edi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push ecx
push ecx
push edi
push str._s_RegSetValueEx_dwOutValue_d_0x08X
lea eax, [esp + 0x20]
push 0x400
push eax
call fcn.00401120
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.004035d0
lea eax, [esp + 0x10]
push dword [esp + 0xc]
test esi, esi
je 0x40a57f
push str.RegSetValueEx_fail
jmp 0x40a584
push str.RegSetValueEx_success
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.004035d0
cmp dword [esp + 8], 0
je 0x40a5cc
push 0x429b60
lea eax, [esp + 0x14]
push 0x400
push eax
call fcn.00401120
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004035d0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SetOMENPlatformInformationToReg___End
lea eax, [esp + 0x14]
push 0x400
push eax
call fcn.004011b0
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004035d0
mov ecx, dword [esp + 0xa1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040aea4
mov esp, ebp
pop ebp
ret
Function at 0x40a610
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa28
mov eax, dword [0x42c008]
xor eax, esp
mov dword [esp + 0xa24], eax
push str.SetHPWMIEventRegistryValue___Thread_Start
lea eax, [esp + 0x224]
push 0x400
push eax
call fcn.004011b0
add esp, 0xc
lea ecx, [esp + 0x220]
call fcn.004035d0
push 0x208
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0040ce90
movzx eax, byte [0x42dc9b]
add esp, 0xc
push eax
movzx eax, byte [0x42dc9a]
push eax
movzx eax, byte [0x42dc99]
push eax
movzx eax, byte [0x42dc98]
push eax
push str.OutValue_0__02X__OutValue_1__02X__OutValue_2__02X__OutValue_3__02X_
lea eax, [esp + 0x234]
push 0x400
push eax
call fcn.00401120
add esp, 0x1c
lea ecx, [esp + 0x220]
call fcn.004035d0
push 0x2000b
push str.CLSID60EB195D_B64E_4209_8AB8_53E040061B9CSystemEvent
push str._s_X
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.00401120
add esp, 0x14
lea eax, [esp + 0x18]
push eax
push str.RegOpenKeyEx_HKEY_CLASSES_ROOT__s
lea eax, [esp + 0x228]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x220]
call fcn.004035d0
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x2001b
push 0
lea eax, [esp + 0x24]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a7a3
push eax
push str.RegOpenKeyEx_KEY_READKEY_SET_VALUE_fail_lRet_d
lea eax, [esp + 0x228]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x220]
call fcn.004035d0
lea eax, [esp]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40a79a
push eax
push str.RegCreateKeyExW_fail_lRet_d_return_0
lea eax, [esp + 0x228]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x220]
call fcn.004035d0
xor eax, eax
mov ecx, dword [esp + 0xa24]
xor ecx, esp
call fcn.0040aea4
mov esp, ebp
pop ebp
ret
push 0
push str.RegCreateKeyExW_success_lRet_d
jmp 0x40a7aa
push 0
push str.RegOpenKeyEx_KEY_READKEY_SET_VALUE_success_lRet_d
lea eax, [esp + 0x228]
push 0x400
push eax
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x220]
call fcn.004035d0
xor eax, eax
xorps xmm0, xmm0
push 1
push 0x429cc0
mov word [esp + 0xc], ax
mov word [esp + 0x1e], ax
lea eax, [esp + 0xc]
push 0xa
push eax
movups xmmword [esp + 0x16], xmm0
call fcn.00401120
lea eax, [esp + 0x14]
push eax
push str.strCommandType_s
lea eax, [esp + 0x238]
push 0x400
push eax
call fcn.00401120
lea ecx, [esp + 0x240]
call fcn.004035d0
push str.lRet__ERROR_SUCCESS
lea eax, [esp + 0x244]
push 0x400
push eax
call fcn.00401120
add esp, 0x2c
lea ecx, [esp + 0x220]
call fcn.004035d0
push 0x80
push 0x42dc98
push 3
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [esp], 0
je 0x40a892
push 0x429b60
lea eax, [esp + 0x224]
push 0x400
push eax
call fcn.00401120
add esp, 0xc
lea ecx, [esp + 0x220]
call fcn.004035d0
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa24]
xor eax, eax
xor ecx, esp
call fcn.0040aea4
mov esp, ebp
pop ebp
ret
Function at 0x41941a
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x419423
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x419441
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41949f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x419486
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41948f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x419499
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41947b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x419405
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4194ec
dec eax
je 0x4194e3
sub eax, 3
je 0x4194da
mov dword [ebp - 4], 0x40
jmp 0x419509
mov dword [ebp - 4], 4
jmp 0x4194ef
mov dword [ebp - 4], 0x20
jmp 0x4194ef
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41953b
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4194bb
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00418d4c
push 0xffffffffffffffd0
movsb byte es:[edi], byte [esi]
xor al, 0xff
jne 0x419546
push 1
push esi
call edi
mov eax, esi
jmp 0x419547
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41986c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [edi]
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov al, byte [0xb0fffff9]
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.00418d5c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00418d11
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00418d5c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00418d11
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00418d4c
stc
dec edx
out dx, eax
sub al, byte [eax - 0x5135b]
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
invalid
test ecx, esi

Function at 0x419877
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [edi]
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov al, byte [0xb0fffff9]
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.00418d5c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00418d11
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00418d5c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00418d11
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00418d4c
stc
dec edx
out dx, eax
sub al, byte [eax - 0x5135b]
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
invalid
test ecx, esi
Function at 0x8f9a30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b2000]
push edi
or ebp, 0xffffffff
jmp 0x8f9a52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8f9a59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f9a48
mov eax, 1
add ebx, ebx
jne 0x8f9a6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8f9a60
jne 0x8f9a7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8f9a60
xor ecx, ecx
sub eax, 3
jb 0x8f9a90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8f9b02
mov ebp, eax
add ebx, ebx
jne 0x8f9a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x8f9aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x8f9acc
inc ecx
add ebx, ebx
jne 0x8f9ab8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8f9aad
jne 0x8f9ac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8f9aad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8f9aec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8f9add
jmp 0x8f9a4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8f9aec
add edi, ecx
jmp 0x8f9a4e
pop esi
mov edi, esi
mov ecx, 0x664a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8f9b0a
cmp byte [edi], 0x24
jne 0x8f9b0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8f9b0f
lea edi, [esi + 0x4f5000]
mov eax, dword [edi]
or eax, eax
je 0x8f9b87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x501dd4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x501f64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8f9b3c
mov ecx, edi
jns 0x8f9b6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x501f68]
or eax, eax
je 0x8f9b81
mov dword [ebx], eax
add ebx, 4
jmp 0x8f9b59
call dword [esi + 0x501f70]
mov ebp, dword [esi + 0x501f6c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8f9bbb
sub esp, 0xffffff80
jmp 0x4d51cb
Function at 0x404c95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sar eax, 2
push edi
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x404d15
push esi
xor esi, esi
cmp dword [ebp + 0x18], esi
jbe 0x404d14
push ebx
mov ebx, 0x461fe8
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebx
mov byte [edi + esi], al
call fcn.004013cb
push eax
call fcn.00401eb7
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebx
mov byte [edi + esi], al
call fcn.004013cb
push eax
call fcn.00401eb7
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x425548
mov byte [edi + esi], al
call fcn.0040dc8e
xor byte [edi + esi], al
add esp, 0x1c
inc esi
cmp esi, dword [ebp + 0x18]
jb 0x404cb7
pop ebx
pop esi
lea ecx, [ebp + 8]
call fcn.00404812
pop edi
pop ebp
ret 0x14

Function at 0x405447
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push 0x10
mov eax, 0x42491e
call fcn.0040894f
push fcn.00401eb7
push 0x4255a0
push 0x461fe8
call fcn.004013cb
pop ecx
pop ecx
mov ecx, eax
call fcn.00402db1
and dword [ebp - 4], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0040856c
pop ecx
test eax, eax
je 0x4054a3
mov ecx, eax
call fcn.004022ad
test eax, eax
je 0x4054a3
push 1
mov ecx, eax
call fcn.0040312b
or dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x407cad
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x407cce
jl 0x407cc5
test edi, edi
jne 0x407cce
xor eax, eax
xor edx, edx
jmp 0x407d8f
cmp dword [ebx + 0x38], 0
je 0x407ce3
push eax
push edi
push dword [ebp + 8]
call fcn.00407d95
jmp 0x407d8f
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407d2a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x407d2a
cmp eax, edi
jb 0x407d04
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409510
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x407d30
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x407d84
mov ecx, ebx
call fcn.00407547
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x407d6f
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00410ed3
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x407d84
jmp 0x407d42
test edx, edx
je 0x407d84
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00410ed3
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x41a76b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a5dc

Function at 0x41ab65
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004094c0
mov eax, dword [0x460400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00418728
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41aba7
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41ad03
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004242f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x462990]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041b904
mov ecx, dword [esi*4 + 0x462990]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41acfc
cmp eax, dword [edi + ecx + 0x24]
jne 0x41acfc
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41acfc
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b904
add esp, 0x14
test edx, edx
jl 0x41acfc
jg 0x41ac72
test eax, eax
jb 0x41acfc
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41acfc
jl 0x41ac8c
cmp dword [ebp - 0x1008], eax
ja 0x41acfc
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41acaa
test ebx, ebx
je 0x41ace3
cmp ecx, edi
jae 0x41ace3
mov al, byte [ecx]
cmp al, 0xd
jne 0x41acc4
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41acd0
cmp byte [ecx + 1], 0xa
jne 0x41acd0
inc ecx
jmp 0x41acd0
movzx eax, al
movsx eax, byte [eax + 0x4606c8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41acaa
cmp edx, ebx
jne 0x41acaa
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41ad01
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004088b5
leave
ret