joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c58e
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
sub esp, 0x18
mov dword [ebp - 0x30], 0
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x435a84
mov eax, dword [ecx]
jmp 0x435a86
mov eax, ecx
push 0xffffffffffffffff
push 0
push 0x4abe68
mov byte [eax], 0
call fcn.00404af0
lea ecx, [ebp - 0x28]
call fcn.004354e0
add esp, 0x18
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x435ae1
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push 0x490ddc
mov byte [esi], 0
call fcn.004049f0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x435bc7
inc ecx
push ecx
jmp 0x435bbc
cmp dword [0x4abe7c], 0x10
mov eax, 0x4abe68
cmovae eax, dword [0x4abe68]
push eax
call fcn.004353f0
mov edx, eax
cmp byte [edx], 0
jne 0x435b05
xor ecx, ecx
jmp 0x435b19
mov ecx, edx
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x435b10
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00404c20
cmp dword [ebp - 0x14], 0x10
lea edi, [ebp - 0x28]
mov ebx, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmovae edi, dword [ebp - 0x28]
xor ecx, ecx
test ebx, ebx
je 0x435b51
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x435b40
lea ecx, [ebp - 0x48]
call fcn.00430810
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x435b92
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x435b77
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00405110
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00404e50
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x435ba7
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00405110
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004044e0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x435bc7
inc eax
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00405110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ed51
mov esp, ebp
pop ebp
ret
Function at 0x435bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c5da
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push esi
mov eax, dword [0x49c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x4a57c8]
test ecx, ecx
je 0x435c26
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x4005c
call fcn.0043ed67
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
push 0x4005c
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00443790
add esp, 0xc
mov ecx, esi
call fcn.00403020
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x4a81a0
mov dword [0x4a57c8], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00432e20
mov esi, eax
mov dword [ebp - 4], 1
call fcn.0043be40
cmp dword [esi + 0x14], 0x10
jb 0x435c86
mov esi, dword [esi]
push eax
push esi
push ecx
call fcn.00403b30
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov ecx, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x435cac
inc ecx
push ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x3c]
call fcn.00405110
test esi, esi
je 0x435db4
movaps xmm0, xmmword [0x491d40]
xor ecx, ecx
push 0x30
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x62
nop dword [eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x435cd0
movaps xmm0, xmmword [0x491c40]
lea eax, [ebp - 0x23]
movups xmmword [ebp - 0x84], xmm0
xor ecx, ecx
mov byte [ebp - 0x13], 0
movaps xmm0, xmmword [0x4916b0]
push eax
push esi
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x64], 0x30273162
mov dword [ebp - 0x60], 0x6c302734
mov dword [ebp - 0x5c], 0x26676a62
mov word [ebp - 0x58], 0x6b
nop dword [eax]
mov al, byte [ebp - 0x84]
xor byte [ebp + ecx - 0x83], al
inc ecx
cmp ecx, 0x2c
jb 0x435d20
sub esp, 0x18
mov byte [ebp - 0x57], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x83], 0
jne 0x435d5a
xor ecx, ecx
jmp 0x435d6c
lea ecx, [ebp - 0x83]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x435d63
sub ecx, esi
push ecx
lea eax, [ebp - 0x83]
mov ecx, edx
push eax
call fcn.004049f0
lea eax, [ebp - 0x54]
push eax
call fcn.00430960
add esp, 0x20
cmp dword [eax + 0x14], 0x10
jb 0x435d8f
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x40]
cmp eax, 0x10
jb 0x435dad
inc eax
lea ecx, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
call fcn.00405110
push 0
call fcn.0044f8b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435ef0
Capabilities:
Create process on windows
Create process suspended
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c653
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xc4]
call fcn.00435dd0
mov edx, eax
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x491610]
movups xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x9c], 0x544954
nop word [eax + eax]
mov al, byte [ebp - 0xac]
xor byte [ebp + ecx - 0xab], al
inc ecx
cmp ecx, 0x12
jb 0x435f50
lea eax, [ebp - 0xab]
mov byte [ebp - 0x99], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.00405500
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xb0]
cmp eax, 0x10
jb 0x435f9e
inc eax
lea ecx, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
call fcn.00405110
movaps xmm0, xmmword [0x491cd0]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
movups xmmword [ebp - 0xfc], xmm0
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
movaps xmm0, xmmword [0x491c00]
movups xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0xb0], 0xf
movaps xmm0, xmmword [0x491c70]
mov dword [ebp - 0xb4], 0
mov byte [ebp - 0xc4], 0
push eax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xcc], 0x6f393c79
mov byte [ebp - 0xc8], 0
mov al, byte [ebp - 0xfc]
xor byte [ebp + ecx - 0xfb], al
inc ecx
cmp ecx, 0x33
jb 0x436002
sub esp, 0x18
mov byte [ebp - 0xc8], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0xfb], 0
jne 0x43603f
xor ecx, ecx
jmp 0x436051
lea ecx, [ebp - 0xfb]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436048
sub ecx, esi
push ecx
lea eax, [ebp - 0xfb]
mov ecx, edx
push eax
call fcn.004049f0
lea eax, [ebp - 0x28]
push eax
call fcn.00430960
push 0x40
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.00443790
add esp, 0x2c
mov dword [ebp - 0x88], 0x44
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x98]
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
cmovae eax, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x98], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4360d3
cmp dword [ebp - 0x90], 0
je 0x4360d3
mov esi, dword [ebp - 0x94]
jmp 0x4360d5
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4360ea
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00405110
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x436111
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00405110
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ed51
mov esp, ebp
pop ebp
ret
Function at 0x43cbc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cb18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x43ccee
cmp byte [ebx + 0x3d], 0
je 0x43ccee
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x43cc19
xor al, al
jmp 0x43ccf0
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0043c940
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x43cc7f
sub eax, 1
je 0x43cc83
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x43ccd6
xor bl, bl
jmp 0x43ccd8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x43ccb8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0044a69c
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x43cc7b
cmp byte [ebx + 0x3d], 0
je 0x43ccd6
test esi, esi
jne 0x43cc41
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0043ca10
jmp 0x43cc3e
mov bl, 1
cmp ecx, 0x10
jb 0x43ccea
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00405110
mov al, bl
jmp 0x43ccf0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ed51
mov esp, ebp
pop ebp
ret
Function at 0x43e0a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c296
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x49c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0043ed67
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004406b4
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x457769
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004575e8

Function at 0x4621a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x411e10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x411e2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411e31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411e20
mov eax, 1
add ebx, ebx
jne 0x411e43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411e38
jne 0x411e54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411e38
xor ecx, ecx
sub eax, 3
jb 0x411e68
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411eda
mov ebp, eax
add ebx, ebx
jne 0x411e73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411e80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411ea4
inc ecx
add ebx, ebx
jne 0x411e90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411e85
jne 0x411ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411e85
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411ec4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411eb5
jmp 0x411e26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411ec4
add edi, ecx
jmp 0x411e26
pop esi
mov edi, esi
mov ecx, 0xaf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411ee2
cmp byte [edi], 1
jne 0x411ee2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x411ee7
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411f5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13330]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x133ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411f14
mov ecx, edi
jns 0x411f43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x133f4]
or eax, eax
je 0x411f59
mov dword [ebx], eax
add ebx, 4
jmp 0x411f31
call dword [esi + 0x133f0]
mov ebp, dword [esi + 0x133f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x411f93
sub esp, 0xffffff80
jmp 0x403ac6
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x31250119
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x18d6401b
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4029e4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403fa0
test esi, esi
jne 0x402a1a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404090
jmp 0x402a38
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004028f8
mov edi, eax
test esi, esi
je 0x402a38
cmp dword [ebx], 0
je 0x402a38
dec esi
jmp 0x402a21
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x457020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403178
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403158
xor eax, eax
push ebp
push 0x403151
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403194
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403158
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x457020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x457020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x459048], 0
je 0x403e85
cmp word [0x45921c], 0xd7b2
jne 0x403e4d
cmp dword [0x459224], 0
jbe 0x403e4d
mov eax, 0x459218
call dword [0x459234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45706c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403eac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x457030], 0
jne 0x403ea1
push 0
push 0x457064
push 0x45706c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405af8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b5e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404210
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ca4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b48
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b65
lea eax, [ebp - 0x10]
call fcn.00403fa0
ret

Function at 0x40abdc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac15
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404090
jmp 0x40ac1e
mov eax, ebx
mov edx, esi
call fcn.00403ff4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac28
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac49
mov al, byte [esp]
jmp 0x40ac4b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b148
mov eax, dword [0x4580ec]
cmp byte [eax], 0
je 0x40b34c
mov eax, dword [0x457f08]
call fcn.00402b10
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408450
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b394
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b382
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x457eb4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x459664]
call fcn.0040500c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret