joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416080
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419665
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x420008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
call fcn.004165a0
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], eax
test al, al
je 0x4160ed
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 4], 0x4924924
je 0x416186
mov ebx, dword [esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x24], 0
call fcn.00416ea3
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push dword [ebp - 0x10]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.00401ef0
mov edx, dword [ebp - 0x10]
push edi
mov al, byte [edx + 0x18]
mov byte [edi + 0x28], al
mov ecx, dword [edx + 0x24]
mov eax, dword [edx + 0x20]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov ecx, dword [ebp - 0x14]
mov byte [edx + 0x18], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
push dword [ebp - 0x1c]
mov dword [edi], ebx
push dword [ebp - 0x20]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.0040c7e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004011d0
int3
Function at 0x41796e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4179ad
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4179ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4179ad
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4179ad
cmp dword [ecx + 0x74], 0xe
jbe 0x4179ad
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43045f
Capabilities:
Encode data using xor

Disassembly:
inc ebx
rol dx, 0xaf
neg cl
neg edx
xor bl, cl
lea ecx, [esp + ecx + 8]
or edx, edx
add ax, word [ecx + eax - 0x60000000]
mov ecx, 0xe3213422
add word [esp + 6], dx
pop ecx
sbb esi, 2
mov word [esi], ax
mov eax, dword [edi]
add edi, 4
call fcn.0042b78f
or cx, ax
not cx
call fcn.004b6f24
sal dword [edi - 0x273794d1], cl
xlatb
cmp al, byte [0xe792fa6a]
cmp al, byte [0xebeec86a]
cmp al, byte [0xf788ca6a]
cmp al, byte [0xdfd2a66a]
cmp ebp, ecx
xor dl, byte [edx + 0x7f]
sti
movsd dword es:[edi], dword [esi]
nop
sub eax, 0x2acb623b
js 0x430425
xor ecx, eax
mov bl, 0xb9
insd dword es:[edi], dx
fucomi st(6)
les ebx, [eax + 0x6f]
ret 0x5458

Function at 0x43f9cd
Capabilities:
Packed with generic packer

Disassembly:
not ecx
mov edx, eax
rol ecx, 2
inc edx
lea eax, [edx + edx*8 - 0x157851e1]
add ecx, 0x92cf4b2
neg ecx
lea eax, [edx + eax*4 - 0x6f565c67]
ror eax, 0x7e
sar edx, 0x26
rol ecx, 2
not ecx
dec ecx
bswap ecx
call fcn.00533a57
call fcn.00525a7b
xor eax, 0x4c181382
jns 0x5584b4
mov dl, byte [edi + 2]
mov ecx, 0xe7bc809e
dec dword [esp]
add edi, 2
not al
xchg byte [esp + 2], ch
add dword [esp], ecx
sar ecx, cl
xor dl, cl
pop ecx
or al, dl
inc cx
mov word [ecx + edi + 0x1dc358cb], ax
push ecx
and byte [esp + ecx + 0x1dc358cc], cl
sal cl, 0x44
mov dword [esi + 4], eax
mov eax, 0xa879181
or byte [esp + eax - 0xa879181], 0x31
jno 0x51dfd4
mov dword [esp], ecx
sub al, 0x8c
rol word [esp], 0xa7
jb 0x5569d9
mov dword [esp], 0x798b350f
ror al, 1
sub al, 0xbb
mov ecx, 0xbc8d020e
ror al, 1
dec cx
jns 0x5004df
mov ecx, 0x81a17f34
mov ecx, dword [esi]
mov eax, 0x77ba7a12
mov eax, dword [esi + eax - 0x77ba7a0e]
push 0xb62a92bf
mul ecx
sub word [esp + 1], 0xf130
mov dword [esi], edx
jb 0x43c583
jmp 0x53cf2e
xor edx, edx
lea eax, [esp + eax + 4]
xor dl, byte [eax + edx*2]
shl cl, 0x21
call fcn.00460a8d
not eax
call fcn.00454667
movsx ecx, ax
mov eax, dword [ebp]
shl cl, cl
lea edx, [ecx*2 - 0x2b5c4065]
add edx, edx
mov edx, dword [ebp + 4]
add ebp, 4
jmp 0x4fd210
dec cx
dec al
dec cl
and ecx, ecx
xor al, 0xb5
push ecx
neg ecx
ror al, 1
call fcn.0047ffc2
mov eax, 0xca2d9b82
jmp 0x476ff2
mov edx, dword [eax + ebp - 0xa879181]
call fcn.00440b8a
xor ecx, ebx
sub ecx, 0xfe19a534
mov eax, 0xdfa0ab0e
jmp 0x4318ee
mov eax, dword [edi]
add edi, 4
xor eax, ebx
mov edx, 0x2d8631b7
push edx
ror edx, 0xd8
sub eax, 0xa737ebb4
jmp 0x470dbd
ror edx, 0x5f
xor bl, al
rol ecx, 0x25
jb 0x46a5f3
ror ecx, 1
sub dx, dx
push eax
pop eax
lea ecx, [edx + ecx + 0x1d2c61b2]
or eax, edx
sub edx, edx
dec dx
xor ecx, 0x4d0e933f
jmp 0x55e00b
Function at 0x45cd1f
Capabilities:
Encode data using xor

Disassembly:
add edx, 0xa00acd8b
sar dword [esp], 0x63
rol edx, 2
ror byte [esp + 1], 0x82
mov eax, dword [esp]
pop ecx
bswap edx
neg cl
jnp 0x5313b6
rol ax, 0xe5
xor edx, 0x38bb670d
xor ebx, edx
inc ecx
add edi, edx
jmp 0x45a8a8
rol eax, cl
mov edx, dword [eax + ebp - 0x78f24e2f]
setb al
mov eax, dword [ebp + eax - 0x78f24dfd]
mov cl, byte [ebp + 8]
call fcn.004813f6
mov dword [esp + ebp - 0x76e52fe1], ecx
push esi
mov esi, ebp
lea esi, [ebp + ebp*8 - 0x4e6b07f0]
not si
push edx
push ebx
pushfd
or ebp, ebp
lea ebx, [esi*8 - 0x9d7d642]
lea ebp, [esp + ebp - 0x76e52fe5]
mov eax, esi
sub ebx, esi
mov ecx, esi
push edi
jge 0x4a0ab3
xor eax, 0x329fbab3
pop es
inc edi
jne 0x45cd5d
popal
pop es
inc edi
jne 0x45cdc3
and eax, 0x75470722
adc eax, 0x47075215
push edx
pop es
inc edi
jne 0x45cddf
sbb eax, 0x41c701ea
out 0x9e, al
or edx, dword es:[edx - 0x37eb8c]
sal dword [edi + 0x5843f8bb], 1
in eax, 0xfc
sub eax, 0x54843c0c
imul edx, dword cs:[ecx], 0x3037b887
xor esp, edi
push edx
add byte [ebx + 0x4ecc1e], ch
arpl word [edi], si
jp 0x45cd69
dec esi
add byte [edi + 0x4417a070], al
add byte [esi], bl
mov cs, word [ebp + 0x1bdd06b4]
outsb dx, byte [esi]
mov byte [0xd58ac381], ch
lea edx, [eax*2 - 0x26638ff9]
mov ecx, dword [esi + edx*4 - 0x76aac50c]
or eax, 0x6d89c5a1
xor ecx, ebx
not eax
neg eax
bswap ecx
lds ecx, [ecx - 0x834cc93]
sal bh, 1
fmul dword [edi]
leave
shl dx, 0x41
jl 0x483457
or edx, 0xea143c93
sbb edx, edx
bswap ecx
ror byte [edi], cl
leave
bswap eax
sub eax, edx
sal edx, 0x34
neg ecx
push edx
call fcn.004d1700
jmp 0x484c9a
xor ebx, ecx
sub ax, ax
push edx
adc edi, ecx
or byte [esp + edx*2 - 0x1e7fe], 0x81
lea esi, [edx + esi - 0xf401]
movzx eax, byte [edx + esi - 0xf400]
xor al, bl
sal dword [esp + edx - 0xf400], 0x65
lea ecx, [edx*2 + 0xaa8ad11]
rol al, 1
sal cx, 0xad
and edx, dword [esp + edx*4 - 0x3d000]
xor ecx, dword [esp + edx*8 - 0x40000]
neg al
jmp 0x54c685
lea ecx, [ecx + eax - 0x28815789]
add edx, 0x721c5d87
or edx, edx
not ecx
ror ecx, 2
sub ecx, 0xff370a23
lea eax, [eax + edx + 0x751fff88]
neg ax
bswap eax
xor ecx, 0x490bfb3d
sub edx, edx
lea ecx, [ecx + edx*8 - 0x66268e81]
and dl, al
xchg dh, al
jle 0x46aa5d
mov edx, 0xdd11de04
movzx eax, dl
movzx ecx, byte [eax + edi - 4]
call fcn.00450e43
xor eax, 0x3920ea09
shl edx, cl
not eax
js 0x4dcb83
xor edx, ebx
jmp 0x4391f1
sbb dx, word [esp + ecx*8 - 0x55d]
xor eax, 0x38ad48b5
ror dx, cl
xor ebx, eax
sar word [esp + ecx*2 - 0x158], cl
call fcn.004c665e
sar word [esp + edx*4 - 0x1ffff], 0xe9
dec al
ror al, 1
or dl, dl
xor bl, al
neg edx
sbb ecx, ecx
lea eax, [esp + eax + 4]
xor edx, dword [esp]
shr cx, 0x8f
mov dx, word [eax]
sub ebp, 2
mov word [ebp], dx
pop ecx
jmp fcn.004f0b52

Function at 0x490168
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edi + edx*2 - 0x2e]
xor eax, ebx
movzx ecx, dx
not eax
sub ecx, 0x4802ec0f
mov dword [esp + edx - 0x19], edx
bswap eax
shr word [esp + edx - 0xf], cl
pop ecx
sal dl, 0xa3
neg eax
bswap ecx
dec eax
sub cx, dx
neg byte [esp + edx*2 - 0x18d]
xor eax, 0x56b229ba
call fcn.00540c9d
invalid
Function at 0x4dbcce
Capabilities:
Encode data using xor

Disassembly:
ror eax, 0x91
add ebp, 4
mov ecx, eax
mov dword [esp], ecx
xor edx, ebx
add cx, 0x5d8c
jno 0x4b1bd3

Function at 0x5360ac
Capabilities:
Check for software breakpoints

Disassembly:
sub ecx, 0xf2a2488d
movzx edx, al
xchg dword [esp + eax*4 - 0x1ebbd2c8], eax
ror dl, 4
neg ecx
mov dword [esp + eax - 0x7aef4b4], eax
bswap ecx
xor eax, eax
cmove dx, word [esp + eax*4 + 1]
or word [esp + eax + 6], dx
lea ecx, [ecx + eax*2 + 0x5d88aa80]
xor ebx, ecx
call fcn.0048c2ca
sbb dword [esi], 0xffffffac
lahf
test byte [edx - 0x70608aaf], ch
enter 0x51aa, 0x75
invalid

Function at 0x54f495
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [edx + ebp - 0x471a4049]
rol eax, 0x6a
xor ecx, ebx
not ecx
ror ecx, 2
lea ecx, [ecx + edx*4 - 0x444c4af7]
not edx
neg dword [esp + eax - 0x34404c8e]
not ecx
ror edx, 0x6c
neg ecx
sub eax, 0x938efe23
xor ecx, 0x52378a92
not edx
or al, 0x12
or al, byte [esp + edx - 0x4d471a1]
dec ecx
not ax
dec eax
call fcn.00486ae6
not edx
add ecx, ecx
lea edx, [edx + ecx - 0xeec4868]
call fcn.00487801
sal edx, cl
mov ecx, dword [esp + 8]
add ecx, 0x2b1ac
jmp ecx
lea esp, [esp + 4]
ja 0x4baccc
mov eax, esp
mov ecx, 0x7e14842a
rol ecx, 0xd7
lea ecx, [ecx - 0x153f09fe]
jae 0x4fda9e
mov ecx, 0xf5a6cc07
mov edx, dword [ebp]
lea eax, [ecx + ecx*2 + 0x77b69423]
sar cl, 0x23
lea ebp, [ebp + eax - 0x58aaf834]
xor al, ah
jo 0x4257d4
xor edx, ebx
sal ecx, 0x36
bswap edx
jp 0x5541af
mov edx, 0x6c9f6098
xor edx, edx
lea edx, [edx + ebp - 0x80]
je 0x503be8
jp 0x5611d9
cmp ebp, ecx
mov dword [esp], 0xb923de80
jmp 0x47905a
sar ax, 0x45
add cl, 0x1c
dec edx
bswap edx
rol edx, 1
or al, 0x87
sar eax, cl
dec edx
and ecx, eax
call fcn.00430966
lea esi, [esi + ecx - 0x77ffffc]
and dword [esp + eax - 0xaab2], ecx
xor edx, ebx
neg ecx
dec edx
rol dword [esp + eax - 0xaab2], 0xa4
jae 0x44e90a
call fcn.004c5aad
mov edx, 0xafb6313e
movsx ecx, dl
mov ecx, dword [ebp + ecx - 0x3e]
mov eax, 0xc5176b98
xadd edx, eax
lea ebp, [ebp + edx - 0x74cd9cd2]
rol ax, 0x84
sal al, 0x45
adc ax, 0xe8c
xor ecx, ebx
inc ecx
sar dx, 0x69
xor ecx, 0x4a18f8b0
call fcn.00537375
Function at 0x10007110
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
xor edx, esi
mov esp, 0x4c50e522
in al, dx
adc ch, byte [eax + ecx + 0x61]
push es
push esp
pop ds
mov ds, word [esi + esi*4 + 0x25]
test eax, 0xf21a5d43
push edi
cmp eax, 0xe8d5d660
ja 0x10007149
into
aaa
inc ebp
cmp ebx, dword [edi - 0x22]
push ss
add byte [ebx + eax*8], 0x36
fnop
push ebp
jecxz 0x10007188
adc dword [ebx - 0x2a], edi
int3
pop edi
fld dword [ebp - 0x6bf2b399]
aaa
dec eax
mov esi, 0x4d64d40a
or dl, ah
dec ebp
insd dword es:[edi], dx
invalid
jae 0x10007153
call 0x9b706586
loopne 0x1000710f
mov esp, eax
test byte [ebx], ah
xchg dword [ebp + 0x4b816c30], esp
and eax, dword [edi - 0x7e93cf5b]
dec ebx
jne 0x10007182
into
dec ecx
mov ecx, 0xb0b5f63f
inc ebp
and ah, byte [edi - 0x11]
add ebx, dword [esi + 0x6e]
mov cl, 0xb7
inc ebp
jmp 0x10007134

Function at 0x10008490
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c288
push 0x1000b316
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
cmp dword [0x1000d308], esi
jne 0x10008597
xor edi, edi
cmp dword [0x1000d300], esi
je 0x100084dc
push 0x1000c228
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x1000d308], esi
jne 0x1000856b
cmp dword [0x1000d300], esi
jne 0x100084f9
call fcn.10007110
test eax, eax
je 0x10008570
mov ebx, dword [0x1000d028]
mov eax, dword [0x1000e128]
cmp eax, esi
jne 0x10008560
mov eax, dword [0x1000e12c]
cmp eax, esi
jne 0x10008545
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x1000853a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000853a
push 0x1000d088
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov eax, esi
mov dword [0x1000e12c], eax
test esi, esi
je 0x10008551
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1000e128], eax
xor esi, esi
cmp eax, esi
jne 0x10008560
xor eax, eax
jmp 0x10008567
lea ecx, [ebp - 0x24]
push ecx
push ebx
call eax
cmp eax, esi
je 0x10008570
mov edi, 1
cmp edi, esi
jne 0x10008597
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x10008584
cmp eax, 0x78
jne 0x1000858f
mov edi, 1
mov dword [0x1000d308], edi
cmp edi, esi
jne 0x10008597
xor eax, eax
jmp 0x1000859c
mov eax, 1
cmp eax, esi
jne 0x100085b6
xor ax, ax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], esi
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100085e9
mov ax, word [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100087a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c298
push 0x1000b316
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
cmp dword [0x1000d308], esi
jne 0x100088a7
xor edi, edi
cmp dword [0x1000d300], esi
je 0x100087ec
push 0x1000c228
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x1000d308], esi
jne 0x1000887b
cmp dword [0x1000d300], esi
jne 0x10008809
call fcn.10007110
test eax, eax
je 0x10008880
mov ebx, dword [0x1000d028]
mov eax, dword [0x1000e128]
cmp eax, esi
jne 0x10008870
mov eax, dword [0x1000e12c]
cmp eax, esi
jne 0x10008855
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x1000884a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000884a
push 0x1000d088
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov eax, esi
mov dword [0x1000e12c], eax
test esi, esi
je 0x10008861
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1000e128], eax
xor esi, esi
cmp eax, esi
jne 0x10008870
xor eax, eax
jmp 0x10008877
lea ecx, [ebp - 0x24]
push ecx
push ebx
call eax
cmp eax, esi
je 0x10008880
mov edi, 1
cmp edi, esi
jne 0x100088a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x10008894
cmp eax, 0x78
jne 0x1000889f
mov edi, 1
mov dword [0x1000d308], edi
cmp edi, esi
jne 0x100088a7
xor eax, eax
jmp 0x100088ac
mov eax, 1
cmp eax, esi
jne 0x100088c5
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], esi
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100088fb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4038c8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x40390d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x40d11b]
shl eax, 2
mov dword [0x40d11f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00402100
pop edx
call fcn.0040149c
call fcn.00402104
push 0
call fcn.00402e20
pop ecx
push 0x40d0c4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40d123], eax
push 0
jmp fcn.0040a9c4

Function at 0x401df4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4069a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.0040223c
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004022cc
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004022cc
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x40e79d
lea ecx, [ebp - 0x200]
push ecx
call fcn.0040223c
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004022cc
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00407b30
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x406ab1
push esi
call fcn.004022cc
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004022cc
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004013ac
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x406a88
xor eax, eax
jmp 0x406b38
push esi
call fcn.004022cc
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004022cc
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00402198
add esp, 0xc
jmp 0x406af1
mov edi, dword [ebx + 0x24]
push edi
call fcn.004022cc
pop ecx
push eax
push esi
call fcn.004022cc
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004022cc
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004013cc
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x406af1
xor eax, eax
jmp 0x406b38
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0040223c
add esp, 8
push 0x40e79f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0040223c
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.0040223c
add esp, 8
push 0x40e7a1
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0040223c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409a48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x409aaa
call fcn.004099f8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004022cc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004022cc
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x409b08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40edb0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x409be2
cmp dword [0x40edac], 0
jne 0x409be2
cmp dword [0x40efa0], 0
je 0x409b9c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004098f8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409b82
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004098f8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409b82
lea ebx, [ebp - 0x84]
jmp 0x409b83
inc ebx
call fcn.00409ac4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x409c1d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40edb4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004022cc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40edb7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x409c1d
cmp dword [0x40edac], 0
je 0x409bfc
cmp dword [0x40edac], 0xffffffff
je 0x409c1d
push esi
call dword [0x40edac]
pop ecx
mov eax, dword [0x40edb0]
test eax, eax
je 0x409c1d
cmp dword [0x40edb0], 0xffffffff
je 0x409c1d
cmp byte [eax], 0
je 0x409c1d
push esi
push eax
call fcn.00409a48
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a408
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x410040], 0
jne 0x40a489
cmp dword [0x410060], 0
jne 0x40a438
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x410060], eax
test eax, eax
jne 0x40a438
push str.GetEnvironmentStrings_failed
call fcn.00409c34
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x410060]
jmp 0x40a44c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004022cc
pop ecx
mov edi, eax
test eax, eax
jne 0x40a444
lea edi, [ebp + 1]
push edi
call fcn.004013ac
pop ecx
mov ebx, eax
mov dword [0x410044], ebx
test ebx, ebx
jne 0x40a476
xor eax, eax
jmp 0x40a54c
push edi
mov edx, dword [0x410060]
push edx
push ebx
call fcn.00402128
add esp, 0xc
jmp 0x40a4a9
xor esi, esi
mov ebx, dword [0x410040]
jmp 0x40a4a3
push eax
call fcn.004022cc
pop ecx
test eax, eax
jne 0x40a49f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a493
lea ebx, [esi + 4]
push 4
mov dword [0x410048], ebx
inc ebx
push ebx
call fcn.004011ac
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40a4cc
xor eax, eax
jmp 0x40a54c
cmp dword [0x410040], 0
jne 0x40a4fd
xor esi, esi
mov ebx, dword [0x410044]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40a4ee
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004022cc
pop ecx
mov edi, eax
test eax, eax
jne 0x40a4e4
jmp 0x40a52e
xor esi, esi
mov ebx, dword [0x410040]
mov eax, dword [esp]
mov edi, eax
jmp 0x40a528
push eax
call fcn.004022cc
pop ecx
test eax, eax
je 0x40a51d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40a521
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a50c
mov eax, dword [0x410040]
test eax, eax
je 0x40a53e
push eax
call fcn.004013bc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x410040], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x86821a5
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x22fb5ea8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219