joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4848f5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4af6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00476c71
mov dword [ebp - 0x14], eax
cmp dword [0x4d0e78], esi
jne 0x4849e8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x484975
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x484ac8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x484ac8
push 0x4a3e50
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x484ac8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4d0e78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4d0e7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4d0e80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d0e88], eax
test eax, eax
je 0x4849e5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d0e84], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x484a0d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x484a00
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x484a22
push 4
pop eax
jmp 0x484aca
cmp dword [ebp - 0x14], esi
je 0x484a22
push dword [0x4d0e78]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x484a07
mov eax, dword [0x4d0e84]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x484a80
cmp dword [0x4d0e88], edi
je 0x484a80
push eax
call ebx
push dword [0x4d0e88]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x484a80
test eax, eax
je 0x484a80
call ecx
test eax, eax
je 0x484a75
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x484a75
test byte [ebp - 8], 1
jne 0x484a80
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x484ab0
mov eax, dword [0x4d0e7c]
cmp eax, edi
je 0x484aad
push eax
call ebx
test eax, eax
je 0x484aad
call eax
mov esi, eax
test esi, esi
je 0x484aad
mov eax, dword [0x4d0e80]
cmp eax, edi
je 0x484aad
push eax
call ebx
test eax, eax
je 0x484aad
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4d0e78]
call ebx
test eax, eax
je 0x484ac8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x484aca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ebfa
mov esp, ebp
pop ebp
ret
Function at 0x4020e0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [0x413020]
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x2a0], esi
lea esp, [esp]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x28a]
push eax
call fcn.0040c940
push esi
push 0x418aa8
lea eax, [ebp - 0x28c]
push 0x104
push eax
call fcn.00403717
add esp, 0x1c
lea eax, [ebp - 0x28c]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [0x413014]
mov dword [ebp - 0x2a8], eax
cmp eax, 0xffffffff
je 0x4022da
xor eax, eax
mov dword [ebp - 0x298], 0
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
mov dword [ebp - 0x294], 0
call fcn.0040c940
push ebx
lea eax, [ebp - 0x84]
push 0x418aa8
push eax
call fcn.00402d00
add esp, 0x18
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [0x413014]
mov ebx, eax
mov dword [ebp - 0x2a4], ebx
cmp ebx, 0xffffffff
je 0x4022b9
push 8
call fcn.0040376b
mov edi, eax
add esp, 4
test edi, edi
je 0x4022b3
push 0
lea eax, [ebp - 0x2ac]
push eax
push 8
push edi
push 0xc
lea eax, [ebp - 0x298]
push eax
push 0x2d1400
push ebx
call dword [0x41301c]
test eax, eax
jne 0x40222e
push edi
call fcn.00403733
mov edi, dword [0x413020]
add esp, 4
push ebx
call edi
jmp 0x4022b9
mov esi, dword [edi + 4]
push esi
call fcn.0040376b
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x2ac]
push 0
push eax
push esi
mov esi, dword [ebp - 0x2a4]
lea eax, [ebp - 0x298]
push ebx
push 0xc
push eax
push 0x2d1400
push esi
call dword [0x41301c]
push edi
call fcn.00403733
mov edi, dword [0x413020]
add esp, 4
push esi
call edi
cmp dword [ebx + 0x1c], 7
push ebx
jne 0x4022a3
call fcn.00403733
mov esi, dword [ebp - 0x2a0]
add esp, 4
mov ebx, dword [ebp - 0x29c]
inc esi
mov dword [ebp - 0x2a0], esi
push dword [ebp - 0x2a8]
call edi
jmp 0x402110
call fcn.00403733
mov esi, dword [ebp - 0x2a0]
add esp, 4
jmp 0x4022b9
mov edi, dword [0x413020]
mov ebx, dword [ebp - 0x29c]
inc esi
push dword [ebp - 0x2a8]
inc ebx
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x29c], ebx
call edi
jmp 0x402110
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402eba
mov esp, ebp
pop ebp
ret
Function at 0x402470
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x41a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [0x418b04]
mov dword [ebp - 0x258], eax
mov eax, dword [0x418b0c]
push ebx
mov dword [ebp - 0x1c], eax
mov ax, word [0x418b10]
push esi
push edi
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x224]
push eax
push 0x100
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x248], ecx
movq qword [ebp - 0x24], xmm0
call dword [0x413004]
cmp word [ebp - 0x224], 0
lea ebx, [ebp - 0x224]
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x240], ebx
je 0x4026c4
mov edi, dword [0x413020]
push ebx
call dword [section..rdata]
cmp eax, 3
jne 0x402694
mov eax, dword [0x418b0c]
movq xmm0, qword [0x418b04]
push 0
push 0
mov dword [ebp - 0xc], eax
movzx eax, word [0x418b10]
push 3
push 0
mov word [ebp - 8], ax
movzx eax, word [ebx]
push 3
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push 0xc0000000
push eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
movq qword [ebp - 0x14], xmm0
call dword [0x413014]
mov esi, eax
mov dword [ebp - 0x24c], esi
cmp esi, 0xffffffff
je 0x40262b
push 8
call fcn.0040376b
mov edi, eax
add esp, 4
test edi, edi
je 0x402625
push 0
lea eax, [ebp - 0x250]
push eax
push 8
push edi
push 0xc
lea eax, [ebp - 0x230]
push eax
push 0x2d1400
push esi
call dword [0x41301c]
test eax, eax
jne 0x4025b8
push edi
call fcn.00403733
mov edi, dword [0x413020]
add esp, 4
push esi
call edi
jmp 0x40262b
mov esi, dword [edi + 4]
push esi
call fcn.0040376b
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x250]
push 0
push eax
push esi
mov esi, dword [ebp - 0x24c]
lea eax, [ebp - 0x230]
push ebx
push 0xc
push eax
push 0x2d1400
push esi
call dword [0x41301c]
push edi
call fcn.00403733
mov edi, dword [0x413020]
add esp, 4
push esi
call edi
cmp dword [ebx + 0x1c], 7
push ebx
jne 0x402615
call fcn.00403733
mov ebx, dword [ebp - 0x240]
add esp, 4
jmp 0x402694
call fcn.00403733
mov ebx, dword [ebp - 0x240]
add esp, 4
jmp 0x40262b
mov edi, dword [0x413020]
mov ax, word [ebx]
push 0
push 0
push 3
push 0
push 3
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x24]
push 0
push eax
call dword [0x413014]
mov esi, eax
cmp esi, 0xffffffff
je 0x402694
push 0
lea eax, [ebp - 0x254]
push eax
push 0xc
lea eax, [ebp - 0x23c]
push eax
push 0
push 0
push 0x2d1080
push esi
call dword [0x41301c]
test eax, eax
je 0x402691
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x238], eax
jne 0x402691
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x234], eax
je 0x4026d7
push esi
call edi
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4026a0
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2]
add ebx, 2
mov dword [ebp - 0x240], ebx
cmp word [ebx], cx
jne 0x4024f6
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402eba
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x258]
mov ax, word [ebx]
push esi
mov word [ecx], ax
call edi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402eba
mov esp, ebp
pop ebp
ret
Function at 0x401bdf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c1e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c1e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c1e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c1e
cmp dword [ecx + 0x74], 0xe
jbe 0x401c1e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401478
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x124]
mov dword [esp + 0x10], eax
mov eax, dword [0x4307ec]
or eax, 8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401589
lea edi, [ebp - 0x11d]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyA
sub esp, 0x10
test eax, eax
jne 0x401525
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x124]
je 0x40150a
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push ecx
mov eax, 1
jmp 0x401589
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00401478
sub esp, 0xc
test eax, eax
je 0x4014c5
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push edi
mov dword [esp], 2
call fcn.00407d0c
push edx
test eax, eax
je 0x401565
mov dword [esp + 0xc], 0
mov edx, dword [0x4307ec]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
jmp 0x401589
mov eax, 1
cmp dword [0x4307ec], 0
jne 0x401589
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
push ebx
push ebx
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4039dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x403a06
mov eax, dword [0x40dc4c]
test eax, eax
je 0x4039fa
mov dword [esp], eax
call sub.USER32.dll_DestroyWindow
push eax
mov dword [0x40dc4c], 0
jmp 0x403a72
cmp dword [0x40dc4c], 0
je 0x403a1e
mov dword [esp], 0
call fcn.0040829a
push ecx
jmp 0x403a72
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x430840]
jbe 0x403a72
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40392c
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov eax, dword [0x430858]
mov dword [esp], eax
call sub.USER32.dll_CreateDialogParamA
sub esp, 0x14
mov dword [0x40dc4c], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push edx
push edx
leave
ret

Function at 0x403a74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
xor edx, edx
test eax, eax
je 0x403ab6
xor edx, edx
cmp dword [ebp - 0xc], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x4072d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x42dc74], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x42dc74
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x40734e
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x18]
jmp 0x407350
xor eax, eax
leave
ret 4

Function at 0x407595
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
push edx
cmp eax, 0xffffffff
je 0x4075be
and eax, 0xfffffffe
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetFileAttributesA
push eax
push eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4075c5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
push ecx
xor edx, edx
cmp eax, 0xffffffff
setne dl
neg edx
and eax, edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x407620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, 0x65
lea edi, [ebp - 0x1c]
jmp 0x407673
mov dword [ebp - 0x1c], 0x61736e
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
div ecx
add edx, 0x61
mov byte [ebp - 0x1a], dl
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 0x10
test eax, eax
jne 0x40767b
dec esi
jne 0x407636
mov byte [ebx], 0
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407687
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
mov byte [ebx], 0
cmp dword [ebp + 0x18], 1
sbb eax, eax
xor al, al
add eax, 0x20119
lea edx, [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x407726
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x407710
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x407713
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407c5e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x42e0b8
call fcn.004077f4
push ebx
push ebx
mov dword [esp], 0x42e0b8
call fcn.0040748c
push edx
mov ebx, eax
test eax, eax
jne 0x407c91
xor eax, eax
jmp 0x407d05
mov dword [esp], eax
call fcn.00407870
push ecx
test byte [0x430844], 0x80
je 0x407ccd
mov al, byte [ebx]
cmp al, 0x5c
je 0x407c8d
test al, al
jne 0x407ccd
jmp 0x407c8d
call fcn.00407c28
push edx
test eax, eax
je 0x407cbe
test byte [eax], 0x10
je 0x407c8d
mov dword [esp], 0x42e0b8
call fcn.00407428
push ecx
jmp 0x407cd3
sub ebx, 0x42e0b8
mov dword [esp], 0x42e0b8
call sub.KERNEL32.dll_lstrlenA
push edx
mov dword [esp], 0x42e0b8
cmp eax, ebx
jg 0x407caf
call fcn.0040782d
push ecx
mov dword [esp], 0x42e0b8
call sub.KERNEL32.dll_GetFileAttributesA
push ebx
inc eax
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4082e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
cmp dword [0x42f1fc], 0
je 0x408301
mov eax, dword [ebp + 8]
not eax
mov ecx, dword [ebp + 0x10]
add ecx, edx
jmp 0x408341
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x40830a
mov dword [ecx*4 + 0x42f1f8], eax
inc ecx
cmp ecx, 0x100
jne 0x408303
jmp 0x4082f5
mov bl, byte [edx]
xor ebx, eax
movzx ebx, bl
shr eax, 8
xor eax, dword [ebx*4 + 0x42f1f8]
inc edx
cmp edx, ecx
jne 0x40832f
not eax
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x2e0142db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e022064]
jne 0x2e0168f9
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x2e023900], eax
mov dword [0x2e0238fc], ecx
mov dword [0x2e0238f8], edx
mov dword [0x2e0238f4], ebx
mov dword [0x2e0238f0], esi
mov dword [0x2e0238ec], edi
mov word [0x2e023918], ss
mov word [0x2e02390c], cs
mov word [0x2e0238e8], ds
mov word [0x2e0238e4], es
mov word [0x2e0238e0], fs
mov word [0x2e0238dc], gs
pushfd
pop dword [0x2e023910]
mov eax, dword [ebp]
mov dword [0x2e023904], eax
mov eax, dword [ebp + 4]
mov dword [0x2e023908], eax
lea eax, [ebp + 8]
mov dword [0x2e023914], eax
mov eax, dword [ebp - 0x320]
mov dword [0x2e023850], 0x10001
mov eax, dword [0x2e023908]
mov dword [0x2e023804], eax
mov dword [0x2e0237f8], 0xc0000409
mov dword [0x2e0237fc], 1
mov eax, dword [0x2e022064]
mov dword [ebp - 0x328], eax
mov eax, dword [0x2e022068]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x2e023848], eax
push 1
call fcn.2e01c6b4
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x2e002c04
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x2e023848], 0
jne 0x2e0169e5
push 1
call fcn.2e01c6b4
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x2e01b83b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x2e01b8cf
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x2e01b3a4
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
invalid
invalid
xchg ebx, eax
clc
cmp dword [ebp - 0x380], 0xffffffff
je 0x2e01b873
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x2e01b878
jmp 0x2e01b1cb
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x2e01b8bf
lea eax, [ebp - 0x714]
push eax
call fcn.2e019839
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.2e0197ee
add esp, 0xc
invalid
invalid
invalid
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0xf305775
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x3c543448
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x418c00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1a4
mov ebx, dword [ebp + 8]
cmp ebx, dword [0x6971a0]
jg 0x418c20
xor edx, edx
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
movzx eax, bx
mov dword [esp], eax
call sub.WS2_32.DLL_WSAStartup
sub esp, 8
test eax, eax
mov edx, 1
jne 0x418c17
movzx eax, word [ebp - 0x198]
mov edx, 2
cmp eax, ebx
jl 0x418c17
mov ecx, dword [0x6971a0]
test ecx, ecx
je 0x418c63
mov dword [0x6971a0], ebx
jmp 0x418c15
mov dword [esp], 0x418ab0
mov edx, 0x697190
mov dword [esp + 4], edx
call fcn.00418cf4
jmp 0x418c5b

Function at 0x4195ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
sub esp, 0x20
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [0x698fa0], ebx
mov eax, dword [edx]
mov dword [esp + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], 0x800
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
xor ecx, ecx
test eax, eax
mov dword [0x698fa0], ecx
mov esi, eax
jne 0x419645
mov edx, dword [ebp + 0xc]
mov eax, 1
test edx, edx
jne 0x41969d
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 8]
cmp dword [edx], eax
jl 0x419655
xor eax, eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call fcn.00420a10
mov dword [edi], eax
test eax, eax
je 0x41969d
mov dword [0x698fa0], ebx
mov edx, dword [ebp + 8]
mov dword [edx], esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], 0x800
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetLocaleInfoA
xor eax, eax
sub esp, 0x10
mov dword [0x698fa0], eax
xor eax, eax
jmp 0x41964e
call fcn.00439640
nop
Function at 0x41a444
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov esi, dword [ebp + 8]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov dword [esp + 8], esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov esi, str.SIGSEGV_cannot_be_cured._Fault_address__0x_lx.
mov dword [esp + 4], esi
add eax, 0x40
mov dword [esp], eax
call fcn.00419b20
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
add esp, 0x14
pop esi
pop ebp
jmp fcn.0041a1a4