joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x32db0e73
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x432060
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3bb40f0a
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x55571b4b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4de737ee
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7e1878af
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x623c7177
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40b7d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x40b7e1
jmp dword [eax*4 + 0x413588]
cmp dword [0x4170ac], 0
je 0x40b8e3
push 0x4170b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4170c8]
test edi, edi
je 0x40b8d8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b82b
mov edi, dword [edi + 8]
test edi, edi
je 0x40b8d8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40b820
test esi, esi
je 0x40b820
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40b820
cmp dword [0x4170ac], 0
jne 0x40b860
push 0x4170b0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4170ac], 1
jmp case.default.0x40b7e1
call fcn.0040b110
jmp case.default.0x40b7e1
cmp dword [0x4170ac], 0
je case.default.0x40b7e1
push 0x4170b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4170c8]
test edi, edi
je 0x40b933
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b8b7
mov edi, dword [edi + 8]
test edi, edi
je 0x40b933
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40b8b0
test esi, esi
je 0x40b8b0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40b8b0
push 0x4170b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4170ac]
cmp eax, 1
jne case.default.0x40b7e1
mov eax, dword [0x4170c8]
test eax, eax
je 0x40b912
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x40b900
mov dword [0x4170c8], 0
mov dword [0x4170ac], 0
push 0x4170b0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x40b7e1
push 0x4170b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40ba70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x412004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40bad6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40bad6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40bad6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40bad6
mov edx, dword [esp + 0xc]
sub edx, dword [0x412004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40bac6
add esi, 0x28
dec ecx
je 0x40bad6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40bac0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40bac0
mov eax, esi
pop esi
pop edi
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4c275889
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58c521a9
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, ecx
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x40102b
mov eax, dword [ebx + 0x20c]
movzx ecx, word [eax]
cmp cx, 0x20
je 0x401035
cmp cx, 0x2f
je 0x401035
cmp cx, 0x2d
je 0x401035
add eax, 2
mov dword [ebx + 0x20c], eax
test eax, eax
jne 0x40100d
call fcn.0040148a
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
pop ebx
ret

Function at 0x4011b2
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5fc]
sub esp, 0x67c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x5f8], eax
push esi
push edi
lea eax, [ebp - 0x80]
push eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
add edi, 4
lea eax, [ebp + 0x3ec]
push edi
push eax
call fcn.00403532
pop ecx
pop ecx
lea eax, [ebp + 0x3ec]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
call fcn.004034ea
movzx eax, word [esi + eax*2 - 2]
pop ecx
cmp ax, 0x69
je 0x40122b
cmp ax, 0x49
je 0x40122b
push ebx
push esi
lea eax, [ebp + 0x3ec]
push eax
push str.__s_s___s
jmp 0x401239
push ebx
push esi
lea eax, [ebp + 0x3ec]
push eax
push str.msiexec__i___s_s___s
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40126a
push 0xc
pop eax
jmp 0x401295
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x5f8]
pop edi
xor ecx, ebp
pop esi
call fcn.004034db
add ebp, 0x5fc
leave
ret
Function at 0x40148a
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0xb7
mov dword [ebp - 0x22c], 5
mov eax, dword [ebp - 0x22c]
dec dword [ebp - 0x22c]
test eax, eax
je 0x4015ed
push 3
pop edi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x40151d
mov al, byte [ebp - 0x22c]
mov dword [ebp - 0x228], 0x1df14869
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x2f
mov byte [ebp - 0x21e], 0x49
mov byte [ebp - 0x21d], 0x3a
mov byte [ebp - 0x21c], 0xe
mov byte [ebp - 0x21b], al
mov byte [ebp - 0x21a], 0xdb
mov byte [ebp - 0x219], 0x17
mov eax, 0xbab0
mov word [ebp - 0x224], ax
mov eax, 0x7891
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4015ed
lea eax, [ebp - 0x218]
push eax
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
movzx eax, byte [ebp - 0x219]
push eax
movzx eax, byte [ebp - 0x21a]
push eax
movzx eax, byte [ebp - 0x21b]
push eax
movzx eax, byte [ebp - 0x21c]
push eax
movzx eax, byte [ebp - 0x21d]
push eax
movzx eax, byte [ebp - 0x21e]
push eax
movzx eax, byte [ebp - 0x21f]
push eax
movzx eax, byte [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x224]
push eax
push dword [ebp - 0x228]
lea eax, [ebp - 0x218]
push eax
lea esi, [ebx + 4]
push str._s_08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x38
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4015ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
je 0x4014ae
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.004034db
leave
ret
Function at 0x401762
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x238
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x234], eax
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov esi, eax
push str.Files
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4017b1
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00401b0d
add esp, 0x10
jmp 0x4017b6
mov eax, 0x716
cmp eax, edi
jne 0x401879
mov eax, esi
lea ecx, [esp + 0x20]
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 3
call section..text
cmp eax, edi
jne 0x401879
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edi
call fcn.004018b5
test eax, eax
jne 0x401870
push 1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0040194e
cmp eax, edi
jne 0x401870
push str.ExecuteFiles
push esi
call fcn.00401602
mov esi, eax
push esi
call fcn.004034ea
add esp, 0xc
lea ecx, [esp + 0x20]
test eax, eax
je 0x401839
push esi
call fcn.0040134a
jmp 0x401858
push edi
mov edx, 0x404210
call fcn.004012ac
cmp eax, 5
jne 0x401858
push edi
mov edx, str.setup.exe
lea ecx, [esp + 0x24]
call fcn.004012ac
test byte [esp + 0x230], 2
jne 0x401870
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00401049
lea esi, [esp + 8]
call fcn.00401881
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40194e
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x401972
and dword [esi], 0
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x401993
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401afc
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x401988
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jae 0x401ae5
mov ecx, dword [esi + 8]
mov edi, dword [ecx + eax]
add eax, 4
mov dword [esi], eax
mov dword [ebp - 0x220], edi
mov edx, dword [eax + ecx]
add eax, 4
mov dword [ebp - 0x22c], edx
mov dword [esi], eax
cmp edx, 2
je 0x401ae5
test edx, edx
jne 0x401a0c
cmp dword [esi + 0xc], 1
jbe 0x401a0c
add ecx, eax
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x228]
sub dword [ebp - 0x21c], ecx
mov ebx, dword [ebp - 0x21c]
lea ecx, [ebp + edx - 0x228]
mov bl, byte [ebx + ecx]
inc edx
mov byte [ecx], bl
cmp edx, 8
jb 0x4019ef
add eax, 8
mov dword [esi], eax
mov ebx, dword [esi]
lea eax, [ebx + edi]
mov dword [esi], eax
call fcn.004018a2
mov edi, dword [esi]
add edi, dword [esi + 8]
push edi
call fcn.004034ea
lea eax, [eax + eax + 2]
add dword [esi], eax
pop ecx
call fcn.004018a2
cmp dword [ebp - 0x22c], 1
jne 0x401a6d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401a56
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401afc
push 0
push edi
mov ecx, esi
call fcn.0040194e
test eax, eax
je 0x40199e
jmp 0x401afc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401a83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401afc
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401ae0
push 0
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x220]
mov eax, dword [esi + 8]
add eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi + 0xc], 1
jbe 0x401ad4
lea eax, [ebp - 0x228]
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40199e
push 9
pop eax
jmp 0x401afc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x401988
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004034db
leave
ret 8
Function at 0x401b6a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401b81
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x401ba0
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401ba5
inc edi
cmp edi, dword [ebp - 8]
jb 0x401b97
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x401c94
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x401c27
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x401bd1
cmp cl, 0xff
jne 0x401c56
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, 5
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x401c67
movzx esi, byte [edx + 0x404244]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
test bl, bl
je 0x401c17
cmp bl, 0xff
jne 0x401c64
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x401bef
dec ecx
shl edx, cl
and edx, 7
je 0x401bbe
movzx ecx, byte [edx + 0x404244]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x40423c], 0
mov cl, byte [ebx + 4]
je 0x401c53
test cl, cl
je 0x401c53
cmp cl, 0xff
jne 0x401bbe
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401b92
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401b92
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x4034db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4034e5
repz ret
jmp fcn.00403609

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x40915c
nop
mov ecx, 0xa004fec
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0xc874a70
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7f2d6a84
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x274f5f40
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10025a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edi, edi
cmp dword [0x1005168], edi
mov ebx, eax
mov dword [ebp - 4], ebx
jne 0x10025e0
push 3
lea eax, [ebp - 0x10]
push eax
push 0x23
push ebx
call esi
lea eax, [ebp - 0x10]
push eax
call fcn.010012bf
mov word [0x10054aa], ax
jmp 0x10025e9
mov word [0x10054aa], 1
push 3
lea eax, [ebp - 0x10]
push eax
push 0x25
push ebx
call esi
lea eax, [ebp - 0x10]
push eax
call fcn.010012bf
push 3
mov word [0x10054ac], ax
lea eax, [ebp - 0x10]
push eax
push 0x1005
push ebx
call esi
lea eax, [ebp - 0x10]
push eax
call fcn.010012bf
cmp dword [0x1005168], edi
mov word [0x10054a8], ax
jne 0x1002681
push 0xa
mov ebx, 0x100547c
push ebx
push 0x28
push dword [ebp - 4]
call esi
push 0xa
mov edi, 0x1005490
push edi
push 0x29
push dword [ebp - 4]
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
push ebx
mov dword [ebp - 8], eax
call edi
mov ecx, dword [ebp - 8]
cmp eax, ecx
jle 0x100265f
push ebx
jmp 0x1002664
push 0x1005490
call edi
cmp word [0x10054a8], 0
mov dword [0x10054a4], eax
je 0x1002695
test eax, eax
je 0x1002695
inc eax
mov dword [0x10054a4], eax
jmp 0x1002695
mov word [0x1005490], di
mov word [0x100547c], di
mov dword [0x10054a4], edi
push 5
push 0x1005698
push 0x1e
push dword [ebp - 4]
call esi
push 0x50
push 0x10054ae
push 0x1f
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret