joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100342a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x358], 0
push edi
push 0x1b0
push eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov word [ebp - 8], ax
mov word [ebp - 0x35c], ax
mov byte [ebp - 0x35a], al
lea eax, [ebp - 0x354]
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.10108310
add esp, 0x24
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x100343be
push 0x10
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push edi
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov ebx, eax
lea eax, [ebp - 0x358]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x35c]
push 3
push eax
call fcn.10022270
lea eax, [ebp - 0x358]
push eax
push str.windowsZones
push edi
call fcn.10022270
mov esi, eax
lea eax, [ebp - 0x358]
push eax
push esi
push str.mapTimezones
push esi
call fcn.10022270
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2a8]
push eax
push edi
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.10022270
add esp, 0x4c
cmp dword [ebp - 0x358], edi
jle 0x100343d1
test esi, esi
je 0x100343be
push esi
call fcn.10022270
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2a8], di
je 0x100344b6
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.10022270
add esp, 0x10
cmp dword [ebp - 0x358], edi
jg 0x100344ab
test ebx, ebx
je 0x10034441
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.10022270
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x1003446b
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], edi
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1a4]
push 0x101684d4
push eax
call fcn.10022270
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x358], edi
jg 0x100344ab
movzx eax, word [ecx]
xor edx, edx
test ax, ax
je 0x100344a3
mov ebx, eax
nop
cmp bx, 0x20
je 0x1003449b
add ecx, 2
mov byte [ebp + edx - 0x8c], bl
inc edx
movzx eax, word [ecx]
mov ebx, eax
test ax, ax
jne 0x10034480
cmp edx, 0x80
jae 0x100344f0
mov byte [ebp + edx - 0x8c], 0
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x8c], 0
je 0x100344d0
lea eax, [ebp - 0x8c]
push eax
call fcn.10022270
add esp, 4
mov edi, eax
test esi, esi
je 0x100344dd
push esi
call fcn.10022270
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e580b
mov esp, ebp
pop ebp
ret
call fcn.10022270
int3
Function at 0x100a5380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154133
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_67::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_67::UnicodeSet.0
mov dword [edi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10022270
test al, al
je 0x100a5581
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.10108470
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a5528
cmp dword [eax + 4], 0
je 0x100a5528
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10022270
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a5488
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc67.dll_uhash_compareUnicodeString_67
push sym.icuuc67.dll_uprv_deleteUObject_67
mov ecx, eax
call fcn.10022270
mov ebx, eax
jmp 0x100a548a
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a549e
mov dword [ebp - 0x10], 7
jmp 0x100a54d8
cmp dword [ebp - 0x10], 0
jle 0x100a54bf
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015821c]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a54d8
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100a6cb0
push dword [esi + 0x2c]
call fcn.10022270
cmp dword [ebp - 0x10], 0
jle 0x100a5528
cmp dword [edi + 0x18], 0
jne 0x100a5522
cmp dword [edi + 0x30], 0
jne 0x100a5522
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a5512
push eax
call fcn.10022270
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a551e
call sym.icuuc67.dll_public:_void___thiscall_icu_67::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a5581
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a5581
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a5550
push eax
call fcn.10022270
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10022270
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a5581
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.10022270
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a55a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154158
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_67::UnicodeSet.0
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10022270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a5650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154188
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.10022270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100a81d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 0xc], ebx
push edi
mov eax, dword [ebx + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
test eax, eax
jle 0x100a8233
mov eax, dword [ebx + 4]
movzx edx, byte [ebp + 8]
mov dword [ebp - 8], eax
nop dword [eax]
mov ebx, dword [eax + esi*8 + 4]
mov ecx, dword [eax + esi*8]
dec ebx
mov eax, ebx
movzx edi, cl
xor eax, ecx
test eax, 0xffffff00
jne 0x100a821c
cmp edi, edx
ja 0x100a8227
jmp 0x100a8220
cmp edi, edx
jbe 0x100a827c
movzx eax, bl
cmp edx, eax
jbe 0x100a827c
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jl 0x100a8200
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x100a8271
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100a8271
xor esi, esi
test ecx, ecx
jle 0x100a8271
movzx edi, byte [ebp + 8]
nop dword [eax + eax]
push esi
mov ecx, eax
call fcn.10022270
push 0
mov ecx, eax
call fcn.10022270
movzx eax, al
cmp eax, edi
je 0x100a827c
mov eax, dword [ebx + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x100a8250
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100a96e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154548
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10022270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100a97a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154578
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_67::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10022270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100a9f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154688
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101fac9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_67::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_67::UnicodeSet.0
mov dword [esi + 4], vtable.icu_67::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10022270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4098bc
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x44c9b6
call fcn.00411f45
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.0040961d
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4098ee
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x44f8d8
call fcn.00401f72
push 0x44f8dc
mov ecx, esi
call fcn.00401f72
push 0x45f854
mov ecx, esi
call fcn.00401f72
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00401f14
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x409943
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4099db
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00428d50
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004094f1
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40999a
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401f72
push 0x45f854
mov ecx, esi
call fcn.00401f72
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00401f14
cmp dword [esi + 0x14], 8
jb 0x4099e3
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4099fb
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x44f8d8
call fcn.00401f72
push 0x44f8dc
mov ecx, esi
call fcn.00401f72
push 0x45f854
mov ecx, esi
call fcn.00401f72
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.0040967c
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00404486
lea ecx, [ebp - 0x248]
call fcn.00401fc4
lea ecx, [ebp - 0x230]
call fcn.00401fc4
call fcn.00411eef
ret
Function at 0x40d292
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x3c
mov eax, 0x44ce0c
call fcn.00411f45
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x40d2b5
xor al, al
jmp 0x40d375
lea edi, [ecx + 4]
cmp dword [edi + 0x10], 0
ja 0x40d2d8
lea eax, [ebp - 0x40]
push eax
call fcn.0040d93f
pop ecx
push eax
mov ecx, edi
call fcn.00403f04
lea ecx, [ebp - 0x40]
call fcn.00401fc4
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
push edi
call fcn.00401d8c
xor edi, edi
lea ecx, [ebp - 0x28]
push str.Software_
mov dword [ebp - 4], edi
call fcn.00401f72
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.00401f72
test ebx, ebx
je 0x40d320
push 0x45f854
lea ecx, [ebp - 0x28]
call fcn.00401f72
push ebx
lea ecx, [ebp - 0x28]
call fcn.00401f72
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x44]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], edi
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d36b
test esi, esi
je 0x40d358
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40d362
push edi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.00401fc4
mov al, 1
call fcn.00411eef
ret 0xc
Function at 0x408bd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
adc byte [edx + 4], al
lea ecx, [eax + esi*8]
push 1
push ecx
push eax
pop ss
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 8], 0x39000000
call dword [sym.imp.WS2_32.dll_WSARecv]
sub dword [eax + 0x4b2c78ff], 0xffffffa2
cmp eax, sym.imp.WSOCK32.dll_WSAGetLastError
call edi
test eax, eax
jne 0x408b9e
mov dword [esi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
cld
or al, 0
call edi
ret 6
nop
nop
jbe 0x408b5d
in al, dx
sub eax, 0x8d66e18b
inc ebp
and dl, byte [eax + 0x58]
jle 0x408c44
add al, 0x80
push ecx
mov dword [ebp - 0x41], 0xbfdf004b
lodsd eax, dword [esi]
adc eax, sym.imp.WSOCK32.dll_ioctlsocket
push ecx
clc
xchg esp, eax
jne 0x408c3e
push esi
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ch, 0xd6
test ebx, esi
jne 0x408bce
pop esi
mov esp, ebp
mov bl, 0xc7
jmp [edx]
dec ebp
clc
jl 0x408cb7
mov ecx, 0xd8358b56
rol dword [eax], 5
salc
test eax, eax
jne 0x408c55
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0x75c085d6
add eax, 0x25e50d3f
xchg ebp, eax
aas
or eax, 0xff9525e5
salc
call esi
add eax, 0xc0afc80
pop esi
daa
scasd eax, dword es:[edi]
pop ebp
adc dh, byte [ebx]
mov byte [0xc3e1e58b], al
nop
js 0x408bfa
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push ebx
push esp
sub cl, byte [esi + edx*2]
popfd
jne 0x408c83
add ecx, dword [ebx - 0x3c74ef83]
or eax, edi
jne 0x408cae
dec esp
das
and byte [ebx + 0x370b2425], cl
je 0x408d9d
mov ebp, dword [edi + 4]
push edx
call 0xef3f9cb0
dec ebx
add al, 0x85
ror byte [edi], 0x84
test byte [eax], 0
add byte [esi + ebx*2 + 0xcc25d39], ah
add al, byte [ebp - 0x5e22af01]
add byte [eax + eax + 0x45], bl
test edi, edi
push eax
frstor dword [ecx + 0x45005c00]
or byte [ebp - 0x7879f025], al
add al, bh
add byte [ebx + 0x4e8b7a46], cl
and al, 0xb
sal dword [ebp + 0x14], 0x8b
dec esi
add al, 0x51
call fcn.00408bd0
add esp, 0xffffffd1
test eax, eax
mov ebp, 0x3f23c74e
add byte [ebx - 0x3938dfaa], cl
jne 0x408cf0
inc edx
inc esi
and al, 0xa
invalid
or eax, 0x6aa34d
push 0x380
mov ah, 0x53
lea edi, [esi + 0x18]
call 0xbd40b590
xchg ebp, eax
push esi
add al, 0x8b
sbb eax, sym.imp.WSOCK32.dll_setsockopt
push 4
sahf
xor byte [esi], al
adc byte [ecx - 0x9800], bh
add byte [eax], al
push edx
mov dword [edi], eax
call ebx
out dx, al
inc esi
mov eax, 0x68f90429
add eax, 0x686b0010
invalid
mov dword [esi - 0x24], ebx
mov dword [esi + 0x24], edi
xor eax, eax
fcomp dword [esi + 0x5b]
cmp edx, eax
movsd dword es:[edi], dword [esi]
add byte [eax - 0x326f6f70], dl
int 0x89
inc esi
push ecx
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x304663b2
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..7LWLf
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x35052d20
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000aaa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000aab2
pop dword [ebp - 0x34]
mov eax, 0x1000aab2
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x59ead4d8
add dword [ebp - 0x44], 0xf4677073
mov dword [ebp - 0x40], 0xcd85bba3
sub dword [ebp - 0x40], 0x9b526f5e
mov dword [ebp - 0x3c], 0xf4b5f5ec
sub dword [ebp - 0x3c], 0xa869b1be
mov dword [ebp - 0x38], 0x2ad3b0dd
add dword [ebp - 0x38], 0xd52c4f23
lea eax, [ebp - 0x44]
push eax
mov eax, 0x68506d10
sub eax, 0x584facec
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x51c8dcfe
add dword [ebp - 0x44], 0x22a98c58
mov dword [ebp - 0x40], 0x703f479f
sub dword [ebp - 0x40], 0x2ed2e62a
mov dword [ebp - 0x3c], 0x8fe36e20
sub dword [ebp - 0x3c], 0x2c7401b4
mov dword [ebp - 0x38], 0x32ca6dcb
sub dword [ebp - 0x38], 0x32ca6dcb
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x73bd0c89
sub eax, 0x63bc4c5d
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36a2b
push 0
call eax
mov ecx, 0x4288
mov edx, eax
mov ebx, 0xed296b14
add ebx, 0x22db08ec
add ebx, dword [ebp - 0x34]
mov edi, 0x9b6493cd
sub edi, 0xf8d32f89
mov esi, dword [ebx]
sub dword [ebp - 0x30], 0xf1e5477c
xor esi, edi
xor dword [ebp - 0x18], 0x71857f01
mov dword [edx], esi
xor dword [ebp - 0x2c], 0x91f7140c
add edx, 0xeddd1340
add edx, 0x1222ecc4
add ebx, 0xfb134360
add ebx, 0x4ecbca4
loop 0x1000abc9
add eax, 0x204f83b
add eax, 0xfdfc04b8
mov ebx, eax
add eax, 5
mov ecx, 0xd8cb7bba
sub ecx, 0xc8cb7bba
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x348cfeff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x348cff0e
pop dword [ebp - 0x50]
mov eax, 0x348cff0e
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x34dd8
push 0
mov eax, 0x82bab65b
sub eax, 0x4e31a503
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x3896968
sub ecx, 0x38928a3
mov edi, eax
mov edx, 0xe5cca7e6
add edx, 0x4ec0b81a
add edx, dword [ebp - 0x50]
mov esi, 0x75d1f9f
sub dword [ebp - 0x14], 0xd2cf3c40
mov ebx, dword [edx]
xor dword [ebp - 0x20], edx
xor ebx, esi
xor dword [ebp - 0x2c], 0x12ca2379
mov dword [edi], ebx
add edi, 0xf1c232ef
add edi, 0xe3dcd15
add edx, 0xdc470fda
sub edx, 0xdc470fd6
loop 0x348cff62
add eax, 0xf5e7
xor ebx, ebx
add ebx, eax
add eax, 0xf21d8d6e
add eax, 0xde27297
mov ecx, 0xbc714629
add ecx, 0x7817b9d7
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00420db7
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401104
pop ecx
mov esi, ebp
call fcn.0040e687
cmp dword [eax], ebp
jle 0x401076
call fcn.0040e68d
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401104
add esp, 0xc
inc esi
call fcn.0040e687
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040120f
call fcn.00401277
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401127
pop ecx
pop ecx
mov esi, eax
call fcn.0040127d
mov edx, ebp
test ebx, ebx
jle 0x4010b0
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x4010a5
mov edi, dword [0x431004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010bf
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cb
mov edx, dword [esi]
mov ecx, dword [0x431990]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42526c
push 0x425270
push dword [0x431994]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d57
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret