joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418610
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x624
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, dword [esp + 0x63c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebp
push 1
push edi
call ebx
push ebp
mov esi, dword [esp + 0x63c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41872d
push 0x2a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x41867b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x624
ret 8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4186b3
mov eax, dword [0x4ca7ec]
push 0x4ca4f0
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [esp + 0x14], eax
jne 0x41872d
lea ecx, [esp + 0x42c]
push ecx
push 0xffffffffffffffff
push esi
push 1
push edi
call ebx
lea edx, [esp + 0x224]
push edx
push 0xffffffffffffffff
push esi
push 4
push edi
call ebx
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebp
push 1
push edi
call ebx
cmp word [esi], 0
je 0x41871b
xor eax, eax
mov cl, pe_nt_image_headers32
test byte [esp + eax + 0x224], cl
je 0x41870f
mov dx, word [esp + eax + 0x42c]
cmp dx, word [esp + eax + 0x1c]
jne 0x41872d
add esi, 2
add eax, 2
cmp word [esi], 0
jne 0x4186f7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x624
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x624
ret 8

Function at 0x418740
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov al, byte [0x4cb9f0]
test al, al
je 0x4187ad
mov ecx, dword [0x4cba60]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
and ecx, 0xffff
cmp ecx, 0xffffd7b2
push edi
jne 0x41877a
mov eax, dword [0x4c9cdc]
test eax, eax
je 0x41877a
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0xc]
push 0
push edx
push 0x1d
push 0x4ca9c0
push eax
call edi
push 0xfffffffffffffff5
call esi
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
push 0x4cba70
push eax
call edi
pop edi
pop esi
ret
mov al, byte [0x4ca548]
test al, al
jne 0x4187c7
push 0
push 0
push 0x4ca9c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
Function at 0x4669cf
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
xchg esi, eax
sbb byte [eax - 0x76], ch
sahf
dec esi
loop 0x4669e5
cmp al, byte [edi + 0x4b166aa3]
les edi, [esi - 0x64355889]
push ss
cli
sbb al, byte [eax + 0x1b]
fcmovne st(0), st(6)
pushal
sub eax, 0x2feef441
lea ebp, [ebx - 0x6e]
test eax, 0x8f06b4e
cmp esp, dword [esi]
in eax, 0x97
invalid
xchg esi, eax
jne 0x4669d0
dec ebp
xchg esi, eax
sub byte [eax], cl
and esp, dword [eax - 0x3b279b38]
out 0xb3, eax
push ebp
pop ecx
jge 0x46697f
sub cl, byte [esi + 0x17]
add ah, byte [edi - 0x52e96c7f]
cmpsd dword [esi], dword es:[edi]
ljmp 0x8b4e

Function at 0x4bf29a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c7390
cmp edx, dword [eax]
je 0x4bf2bc
add eax, 8
inc ecx
cmp eax, 0x4c7420
jl 0x4bf2ad
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c7390]
jne 0x4bf3ea
mov eax, dword [0x4cba7c]
cmp eax, 1
je 0x4bf3c4
test eax, eax
jne 0x4bf2ed
cmp dword [0x4c72d4], 1
je 0x4bf3c4
cmp edx, 0xfc
je 0x4bf3ea
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf324
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bf9b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bfbe0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bf367
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bfbe0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c39c8
push edi
call fcn.004c13b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bf9b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bf9c0
lea eax, [ebp - 0xa0]
push 0x4c39a8
push eax
call fcn.004bf9c0
push dword [esi + 0x4c7394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bf9c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c1324
add esp, 0x2c
pop edi
jmp 0x4bf3ea
lea eax, [ebp + 8]
lea esi, [esi + 0x4c7394]
push 0
push eax
push dword [esi]
call fcn.004bfbe0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x528857
Capabilities:
Packed with generic packer

Disassembly:
cmp al, 5
add cl, ch
or eax, 0xe90003e0
adc edx, esi
add eax, dword [eax]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [0x65000000], cl
Function at 0x52886f
Capabilities:
Packed with generic packer

Disassembly:
add byte [0x65000000], cl
jb 0x5288f0
push esi
popal
insb byte es:[edi], dx
jne 0x5288e1
dec ebx
jns 0x528880
inc edx
cwde
jg 0x5288ed
cwde
jp 0x5288f4
pushal
cdq
imul eax, dword [edi + 0x69], 0x95
add byte [eax], al
add byte [eax], al
add byte [eax], al
jmp 0x58c373
and al, 4
add al, 0
add byte [eax], al
add byte [ecx], al
fcomp dword [ebx - 0x7d]
call 0x24570ffe
mov edi, ebp
add edi, 0x6c
mov esi, dword [edi]
mov eax, ebp
add eax, 0x95
or dword [eax], esi
mov edi, ebp
add esi, 0x40
add edi, 0x8c
and eax, 0x80
sub eax, 0x40
mov edi, dword [edi]
mov ecx, 1
sub eax, ebx
add edi, 0
and esi, 0x1c
movzx edx, word [edi]
sub esi, 0x20
and ecx, ecx
mov edi, ebp
add ecx, 0x800
add edi, 0x6c
mov ecx, 0xa
sub edx, dword [edi]
mov edi, ebp
mov eax, 1
add edi, 0x95
and eax, 0x800
or esi, 0x20
sub edx, dword [edi]
mov edi, ebp
add esi, 0x80
add edi, 0x6c
add ecx, ebx
sub dword [edi], edx
or esi, 0x7fffffff
mov esi, ebp
sub ecx, 0x20
add esi, 0xf
and dword [esi], 0x28c8a7bd
mov edi, ebp
add edi, 0x42
mov bl, byte [edi]
cmp bl, 0xb7
jbe 0x58c434
mov eax, ecx
add edx, 0x486d3a8d
and eax, 0x7fffffff
mov edi, ebp
mov esi, 0
add esi, edx
add edi, 0x80
sub word [edi], dx
mov ecx, ebp
sub eax, 0x20
add ecx, 0x8c
mov ecx, dword [ecx]
add ecx, 2
movzx edx, byte [ecx]
and esi, 0x40
mov edi, ebp
add edi, 0x6c
xor edx, dword [edi]
mov edi, 0x400
xor edi, 4
mov ebx, ebp
add ebx, 0xf
and edi, 4
sub edx, dword [ebx]
mov ecx, ebp
add ecx, 0x6c
xor dword [ecx], edx
mov ecx, ebp
mov ebx, eax
sub eax, 0x1c
add ecx, 0xf
mov esi, 0x400
mov ecx, ebp
sub edi, edi
xor esi, ecx
add ecx, 0xab
sub esi, edi
add dword [ecx], edx
sub esi, 0x28
xor esi, ecx
mov ecx, ebp
add ecx, 0x26
or dword [ecx], edx
mov eax, 0x15b31cdb
mov esi, ebp
add esi, 0xf
xor dword [esi], eax
mov esi, ebp
mov edi, ebp
add edi, 0xab
mov edi, dword [edi]
xor edi, 0x115eb019
add edx, 1
add esi, 0x80
add edx, 0x40
movzx esi, word [esi]
or edx, 0x20
xor si, 0x3fe7
movzx esi, si
add esi, ebp
mov edx, 0x400
mov eax, esi
mov ecx, edi
mov edi, 0
add edx, edx
mov esi, ebp
mov ebx, 0x200
add esi, 0x8c
mov esi, dword [esi]
add esi, 9
mov edx, 0xa
mov di, word [esi]
add edi, ebp
and edx, 1
push dword [edi]
popfd
ror dword [eax], cl
xor edx, 0x1c
and esi, 0x800
add esi, 1
add edi, esi
mov cl, 0x88
mov ebx, ebp
add edx, 0xffff
add ebx, 0x42
and esi, edi
and byte [ebx], cl
mov esi, 0xa
mov edi, 0
sub edx, esi
mov ecx, ebp
add ecx, 0x8c
mov eax, ebp
mov ecx, dword [ecx]
add eax, 5
add ecx, 3
add esi, 0x1f
movzx ecx, word [ecx]
mov eax, dword [eax]
mov esi, 0x400
add edi, 0x400
mov ebx, ebp
add ebx, 0x6c
add ecx, dword [ebx]
xor esi, 0xffff
and edx, 1
mov ebx, ebp
or edi, 0x20
xor edi, 4
add ebx, 0x6c
xor edx, 0x24
add dword [ebx], ecx
and ecx, 0xffff
shl ecx, 2
add eax, ecx
and esi, edi
mov ecx, dword [eax]
and esi, edx
mov esi, ebp
add esi, 0x8c
mov edi, edi
mov esi, dword [esi]
add esi, 5
mov eax, dword [esi]
sub edi, 0x400
mov edi, ebp
add edi, 0x8c
add dword [edi], eax
jmp ecx
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2c3a3461
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x155118f8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x40915c
nop
nop
mov ecx, 0x733d23d3
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x1a40600
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x414dc9
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], esi
or edi, ebx
sub ebx, 0xeeeb068b
add eax, 4
sub ecx, 1
and ecx, edi
push edi
mov edi, dword [esp]
add esp, 4
cmp eax, edx
jne fcn.00414dc9
or ecx, ecx
sub ecx, ebx
sub edi, edi
ret
Function at 0x100073c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [0x1001e090], 0xfba
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1001e090], 0xb30
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000744c
mov eax, 1
mov dword [0x1001e090], 0xcfb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x1000751c
jmp 0x1000750d
mov dword [0x1001e090], 0xffffef9a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x100074f0
jmp 0x1000750d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x10007483
mov dword [0x1001e090], 0x9a7
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x1000744c
mov eax, dword [ebp - 0x20]
mov dword [0x1001e094], 0xb13
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1000750d
mov dword [0x1001e094], 0x7b7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1000750d
mov dword [0x1001e090], 0x1cec
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000750d
mov dword [0x1001e090], 0x14d8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000742a
jmp 0x1000750d
mov dword [0x1001e094], 0x2308
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10007400
xor eax, eax
mov dword [0x1001e090], 0x187b
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
Function at 0x10007570
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [0x1001e090], 0x135
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10006cf0
lea ecx, [0x10007bf0]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x68], edx
mov dword [esp + 0x2c], 0x14ac00
mov edx, dword [0x1001e07c]
mov dword [esp + 0x64], edx
mov edx, dword [0x1001e080]
mov dword [esp + 0x78], edx
mov edx, dword [0x1001e084]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1001e088]
mov dword [esp + 0x50], edx
mov edx, dword [0x1001e08c]
mov dword [esp + 0x7c], edx
mov dword [0x1001e090], 0x25a4
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10007660
mov eax, dword [esp + 0x18]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x6c], eax
mov dword [0x1001e090], 0x1227
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x34], eax
call fcn.100073c0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x10007671
jmp 0x100075fc
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x10007604
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
je 0x10007636
jmp 0x1000764e
lea eax, [esp + 0x28]
mov dword [0x1001e094], 0xb4a
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.100080f0
mov dword [esp + 8], eax
mov eax, esp
lea ecx, [esp + 0x28]
mov dword [eax], ecx
mov eax, dword [esp + 8]
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x1001e094]
add ecx, 0xffffee6a
mov dword [0x1001e090], ecx
mov dword [esp + 0x18], eax
jmp 0x100075fc
Function at 0x100076d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1001e098], 0
cmp eax, 0
sete bl
mov dword [0x1001e09c], 0
mov dword [0x1001e0a8], 0
mov dword [0x1001e090], 0x170a
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x10007866
jmp 0x10007731
xor eax, eax
mov ecx, 0x170a
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], eax
jmp 0x1000774a
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
mov ebx, edx
add ebx, 1
add esi, 1
add ecx, 0xffffe6ec
mov dword [ebp - 0x34], eax
mov eax, esi
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x1001e098], edx
mov dword [0x1001e090], ecx
mov ecx, dword [ebp - 0x1c]
movzx esi, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x1001e09c], edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x1001e0a0], cl
mov dword [0x1001e090], 0x11c7
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x1001e090]
add edx, 0xffffd940
mov dword [0x1001e090], edx
mov cl, byte [0x1001e0a0]
mov edx, dword [0x1001e09c]
mov byte [edi + edx], cl
mov dword [0x1001e094], 0x1a03
mov edx, dword [0x1001e098]
movzx edx, byte [edi + edx]
mov ecx, dword [0x1001e09c]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1001e0a8], ecx
mov dword [0x1001e094], 0xd2d
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x38]
xor cl, byte [edx + esi]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov dword [0x1001e094], 0x1454
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x40], ebx
je 0x10007864
mov eax, dword [0x1001e090]
mov ecx, dword [0x1001e098]
mov edx, dword [0x1001e09c]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1000774a
jmp 0x10007866
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007920
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1001e094], 0x1ec5
mov dword [0x1001e09c], 0
mov byte [0x1001e0a0], 0
mov dword [0x1001e090], 0x1d83
mov dword [0x1001e098], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10007a3c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1001e0a4], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x1001e09c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1001e0a4], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x1001e09c], edx
mov dword [0x1001e094], 0x1f91
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x1001e0a0], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov esi, dword [0x1001e090]
add esi, 0x19b
mov dword [0x1001e090], esi
mov cl, byte [0x1001e0a0]
mov esi, dword [0x1001e09c]
mov byte [ebx + esi], cl
mov esi, dword [0x1001e094]
add esi, 0x1e57
mov dword [0x1001e094], esi
mov esi, dword [0x1001e098]
add esi, 1
mov dword [0x1001e098], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1000797c
jmp 0x10007974
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1001e094]
add eax, 0x1b49
mov dword [0x1001e090], eax
mov eax, dword [0x1001e098]
add eax, 1
mov dword [0x1001e098], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007a3c
mov dword [0x1001e090], 0x14d0
mov dword [0x1001e098], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1000797c
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x2b0c1b92
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x74e37fdc
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x100015d4
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10001622
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10001633
push 0xd
pop eax
jmp 0x1000165d
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10001636
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10001d68
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x858
mov eax, dword [0x10011c4c]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7e4]
push ebx
push esi
mov esi, dword [ebp + 0x7e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.gdi32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.gdi32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.gdi32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.gdi32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.gdi32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.gdi32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x1000c690]
fld qword [0x1000c688]
fdiv st(1), st(0)
fxch st(1)
call fcn.1000a870
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1000a870
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.gdi32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x1000c680]
fadd qword [0x1000c678]
call fcn.1000a870
neg eax
cmp dword [ebp + 0x7f0], ebx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x7ec]
mov dword [ebp - 0x58], eax
setne al
mov byte [ebp - 0x53], al
mov eax, 0x800
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x1002
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push str.Japan
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10001ea7
push dword [ebp - 0x78]
jmp 0x10001eac
push str.MS_UI_Gothic
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.gdi32.dll_RestoreDC]
mov ecx, dword [ebp + 0x7d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a812
add ebp, 0x7d8
leave
ret 0x14
Function at 0x10002cbc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10011c4c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1000acde
mov ebx, eax
cmp ebx, esi
je 0x10002d2f
lea ecx, [ebp - 0x74]
call fcn.10001502
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a812
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x10002d47
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10002cbc
cmp eax, esi
jne 0x10002d79
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x10002d37
lea ecx, [ebp - 0x74]
call fcn.10001502
push dword [ebp - 0x78]
mov ecx, edi
call fcn.10001493
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001502
mov eax, esi
jmp 0x10002d15