joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dfa3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42e040
push ebx
push esi
call fcn.0042df6c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042deb5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42dfed
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42e03f
push edi
push eax
call fcn.0042b3cd
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42e00d
call fcn.0042b27a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42e03e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042deb5
add esp, 0x20
test eax, eax
jne 0x42e02c
push edi
call fcn.0042b27a
jmp 0x42e034
push ebx
call fcn.0042b27a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42e2ab
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43a4b0
push 0x43a4a8
push str.FlsAlloc
push 0x1e
call fcn.0042e1c9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42e2df
push dword [ebp + 8]
mov ecx, esi
call dword [0x43626c]
call esi
jmp 0x42e2e5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42e329
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43a4c0
push 0x43a4b8
push str.FlsGetValue
push 0x20
call fcn.0042e1c9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42e360
push dword [ebp + 8]
mov ecx, esi
call dword [0x43626c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x435170
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43519d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43519d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x53a596
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], 0xf2
pushfd
call fcn.00537b60
pop ss
mov esp, dword [ecx]
add dword [ebx], ecx
or al, 0xdd
and al, 0x3c
js 0x53a5e3
pushal
int3
jl 0x53a5eb
dec dword [eax - 0x4f]
in eax, 0xb1
mov byte [edi + 0xf], ch
out 0xb3, eax
mov cl, 0xe5
mov cl, 0x88
outsd dx, dword [esi]
movntq qword [ebx + 0x2a50822b], mm6
in al, 0x53
sub eax, dword [edx + 0x53e42a50]
in eax, 0xc4
pop esi
mov bl, 8
xchg edx, eax
mov dword [0x6b2cd14], eax
jecxz 0x53a59b
sal dword [eax + 0x5c], 0xf7
cmc
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
pop es
push eax
mov al, byte [0xea0b1f40]
pop esp
mov ecx, dword [ecx]
inc ebx
lodsd eax, dword [esi]
sub ebp, 0xffffffe3
sub byte [ecx - 0x77564ecc], bh
arpl word [edx - 0x4bceaad1], si
inc esi
out 0xff, eax
or cl, byte [esp + ebp*8]
xor dword [esi + eax*2 + 0xc0affe7], esi
in al, dx
sub dword [ecx], esp
jge 0x53a63f
jne 0x53a67d
inc ebp
in eax, 1
jno 0x53a61e
jne 0x53a65c
mov eax, 0x3a369a2f
and byte [eax], dh
lea esi, [ebp - 0x166a7b28]
not ecx
add eax, 0xa7cdf0f
in eax, dx
aad 0x65
mov al, byte [0x70865703]
mov ebp, 0x8dbe03d8
ljmp 0x4d1
jmp 0xf59783b
je 0x53a5df
retf
lodsd eax, dword [esi]
test eax, 0x28bac0e5
jp 0x53a6a5
adc byte [eax], 0x96
xchg esp, eax
retf 0xa5a0
dec ebx
Function at 0x542763
Capabilities:
Encode data using xor

Disassembly:
push 0xe9653e7a
push 0x243c3494
call fcn.00543153
daa
cmp eax, 0xc0b2be2
push es
mov dword [ecx], eax
mov ebp, 0x95d9f11d
fnstenv [ecx + 0xd41a9d9]
adc ch, dh
xor dword [ebx], ebx
out dx, eax
mov bh, 2
push edx
pop ds
and eax, 0xe635a63c
inc esp
cmp dword [ecx + 0x7dfca51c], ecx
sub edx, ebx
jo 0x537a9d
mov dword [0x2fb9515d], eax
mov word [edi - 0x38], ss
movsb byte es:[edi], byte [esi]
invalid
cmp eax, dword [ebp - 0x10]
mov byte [esp + 4], 0xf
lea esp, [esp + 8]
jae 0x538ef5
sal cl, cl
shr edi, 0x10
adc bl, 0x93
mov ebx, eax
sar cx, 1
pushfd
mov edi, eax
jmp 0x601260
pushfd
lea esp, [esp + 4]
jne 0x538ee6
mov esi, eax
rcl cx, cl
mov ecx, edi
test ch, dl
push 0x56b80ba0
sub ecx, ebx
neg si
btc si, dx
push edi
shr si, 9
lea esi, [esp + 8]
cmp bp, 0xc877
sub edi, 4
cmp dx, cx
bt ax, 0xe
push dword [edi]
pop dword [esp + 4]
pushal
bt ebx, ecx
clc
cmp edi, ebx
pushfd
mov word [esp], 0xcdc0
lea esp, [esp + 0x28]
ja 0x539d7d
sar al, 1
adc al, dh
shl al, 1
xor al, dh
sub ebx, edi
neg di
rcl di, 7
and di, 0x2251
add ebx, esp
not di
rcl edi, 0xc
setae al
pushfd
mov edi, ebx
bt di, si
dec al
mov al, 0x2e
test ax, 0x3cec
repne scasb al, byte es:[edi]
call fcn.00535ff8
sar cx, 0xe
mov ecx, 0x104
stc
sub al, al
cmp ebp, 0x1a216068
test si, dx
repne scasb al, byte es:[edi]
mov byte [esp], 0x18
lea esp, [esp + 4]
jno 0x543055
pushal
lea esp, [esp + 0x20]
jne 0x538ee6
push eax
pop esi
sbb cx, di
mov ecx, edi
cmc
btr si, bx
not si
clc
sub ecx, ebx
shrd si, dx, cl
bswap esi
sar esi, 8
mov esi, esp
bt ecx, 0x11
pushfd
sub edi, 4
cmc
test bh, dl
push dword [edi]
pop dword [esp]
clc
cmc
cmp edi, ebx
ja 0x537a85
ja 0x539d7d
inc al
sub ebx, edi
shr al, 4
movsx di, dl
bts di, 8
bsr di, cx
add ebx, esp
dec al
not al
rcl al, cl
mov edi, ebx
sal al, cl
mov al, 0x2e
cmp dh, 0x7e
cmp cx, sp
push 0xd20857ae
cmc
repne scasb al, byte es:[edi]
push ecx
pushal
push dword [esp]
push ebp
lea esp, [esp + 0x30]
jne 0x63c3dc
movzx ax, bl
lahf
movsx ax, dl
lahf
mov byte [edi - 1], 0
movzx ax, dl
push ebx
lahf
push ebx
not ax
lea eax, [0x5413f1]
jmp 0x6034a1
call fcn.0053d026
xor edi, edx
js 0x60351c
dec byte [ebx]
popfd
pop eax
and byte [eax + 0x70], dh
inc eax
push eax
cmp al, 0xec
enter 0xffffffffffff94e8, 0x74
pop eax
fstp qword [ebp + 0x331e83a9]
mov dword [0x91df9a7e], eax
int 0x90
cmp al, 0xf9
xchg ecx, eax
invalid
aad 0x5d
test eax, 0xcc66f644
imul ecx, dword [ebx + 0x1b7b0566], 0xffffffc0
ffree st(5)
lodsb al, byte [esi]
push esi
pop ebp
shl bh, cl
invalid
fistp word gs:[ebp + 0x6693d103]
int3
fstp dword [eax]
dec esi
lodsd eax, dword [esi]
jp 0x6034f7
sub al, 0xdd
jle 0x6034cd
mov ch, 0xe7
movsd dword es:[edi], dword [esi]
hlt
Function at 0x63cbaa
Capabilities:
Encode data using xor

Disassembly:
cmp edi, ebx
pushal
lea esp, [esp + 0x28]
ja 0x539d7d
or al, ch
add al, dh
sub ebx, edi
bts di, si
add ebx, esp
rcl di, cl
ror edi, cl
xor di, 0x9f80
mov edi, ebx
shl al, cl
mov al, 0x2e
bt esi, 7
jmp 0x63c1e2
repne scasb al, byte es:[edi]
push 0xa241f55f
mov byte [esp], 0x2a
push 0xe38e45c4
push dword [esp + 4]
lea esp, [esp + 0xc]
jne 0x63c3dc
lea eax, [esp - 0x7853f8c]
pushal
lea eax, [edi*2 - 0x373fe68]
mov byte [edi - 1], 0
lahf
push dword [esp + 4]
movzx ax, al
lea eax, [edx + 0x7c21e4be]
mov dword [esp + 0x20], ebx
call fcn.00603de9
mov esp, 0xfae3fb5a
or ebp, ecx
add ch, byte [edx - 0x62]
mov edx, 0x2e0a3e2e
jle 0x63c23f
ljmp 0x6827:0x4f7a2be2
sub edi, dword [edx + 0x4f]
daa
push 0xb2b64728
out 0xae, eax
xchg esp, eax
invalid
sar si, 0xf
mov ecx, edi
movzx si, dl
sub ecx, ebx
inc si
mov si, cx
test di, 0x4044
adc esi, esp
lea esi, [esp + 8]
test bh, 0xc9
sub edi, 4
pushfd
stc
push dword [edi]
pop dword [esp + 8]
jmp 0x53e377
Function at 0x439e80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
jmp 0x439e9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x439ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x439e90
mov eax, 1
add ebx, ebx
jne 0x439eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x439ea8
jne 0x439ec4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x439ea8
xor ecx, ecx
sub eax, 3
jb 0x439ed8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x439f4a
mov ebp, eax
add ebx, ebx
jne 0x439ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x439ef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x439f14
inc ecx
add ebx, ebx
jne 0x439f00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x439ef5
jne 0x439f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x439ef5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x439f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x439f25
jmp 0x439e96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x439f34
add edi, ecx
jmp 0x439e96
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x439f52
cmp byte [edi], 9
jne 0x439f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x439f57
lea edi, [esi + 0x37000]
mov eax, dword [edi]
or eax, eax
je 0x439fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x55844]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5590c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x439f84
mov ecx, edi
jns 0x439fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x55910]
or eax, eax
je 0x439fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x439fa1
call dword [esi + 0x55920]
mov ebp, dword [esi + 0x55914]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43a003
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x22ea23c5
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x432e68be
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x41cae0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x9435c0], 0x37
jne 0x41cb30
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push str.Bim_kigasajalumi_tazameyumayi_hukediluz_colasuvege
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [0x93b00c]
add ecx, dword [ebp + 8]
mov edx, dword [0x9435c4]
add edx, dword [ebp + 8]
mov al, byte [edx + 0x12336]
mov byte [ecx], al
mov esp, ebp
pop ebp
ret 4
Function at 0x41cfc0
Capabilities:
Accept command line arguments
Create pipe
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ea8
call fcn.0040fc40
mov dword [ebp - 4], 0
jmp 0x41cfdf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x41d097
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x9435c0], 0x16
jne 0x41d016
push 0
push 0
push str.yukusababodavohojuxogeza
push 0
push str.rifekuvafuxogiyukepufowekoze
push str.koyenajey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x9435c0], 0x9e
jne 0x41d087
lea ecx, [ebp - 0x1290]
push ecx
push 0
lea edx, [ebp - 0x128c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
lea eax, [ebp - 0xa78]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 0
lea ecx, [ebp - 0x1278]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea edx, [ebp - 0x278]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
cmp dword [ebp - 4], 0x9be51dc
jle 0x41d092
jmp 0x41d097
jmp 0x41cfd6
push 0x5181f8
mov eax, dword [0x9435c0]
push eax
mov ecx, dword [0x93b00c]
push ecx
call fcn.0041cf30
mov dword [ebp - 0x1294], 0
jmp 0x41d0c9
mov edx, dword [ebp - 0x1294]
add edx, 1
mov dword [ebp - 0x1294], edx
cmp dword [ebp - 0x1294], 0x3e79e
jge 0x41d10a
cmp dword [0x9435c0], 0x10
jne 0x41d0f7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.vocikizifonefakifohihezederomaritefibafecoyibiyitosaharuxo
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp dword [ebp - 0x1294], 0x1e673
jne 0x41d108
call fcn.0041cac0
jmp 0x41d0ba
mov dword [ebp - 0x1298], 0
jmp 0x41d125
mov eax, dword [ebp - 0x1298]
add eax, 1
mov dword [ebp - 0x1298], eax
cmp dword [ebp - 0x1298], 0xdd9a7
jge 0x41d14d
cmp dword [0x9435c0], 0xc01
jne 0x41d14b
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x41d116
jmp dword [0x93b00c]
Function at 0x401000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
push 0x103
lea eax, [ebp - 0x117]
push 0
push eax
mov byte [ebp - 0x118], 0
call sub.ntdll.dll_memset
xor eax, eax
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
push 0x1c
stosb byte es:[edi], al
pop eax
mov dword [ebp - 4], 1
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x401059
push 0x7f
push 0x1b
mov edx, str.Z0_Z_Z12:__09___0_:__0__Z
call fcn.00402d34
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4010e2
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401079
lea ecx, [ebp - 0x14]
sub eax, edx
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00401c4f
test eax, eax
je 0x4010e2
xor al, al
lea edi, [ebp - 0x118]
mov ecx, 0x104
rep stosb byte es:[edi], al
lea eax, [ebp - 0x118]
lea edi, [ebp - 0x14]
call fcn.00401d26
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x4010e2
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [0x42b17c], ax
test ax, ax
je 0x4010e2
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x11c]
pop edi
leave
ret

Function at 0x4010ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x103]
push ebx
push eax
mov byte [ebp - 0x104], bl
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call sub.ntdll.dll_memset
add esp, 0x18
inc esi
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
cmp eax, ebx
je 0x401151
mov byte [eax], bl
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4011cd
lea eax, [ebp - 0x208]
push eax
lea ebx, [ebp - 0x104]
call fcn.004025e4
test eax, eax
je 0x4011cd
push edi
mov edi, ebx
call fcn.0040266f
test eax, eax
je 0x4011cc
mov eax, ebx
push eax
call fcn.00402761
xor edi, edi
inc edi
push esi
test eax, eax
jne 0x4011ad
push 0x42b188
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [0x42b178], edi
jmp 0x4011c6
lea eax, [ebp - 0x104]
push eax
push 0x42b188
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
and dword [0x42b178], 0
mov dword [0x42b174], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40137b
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push 0x11c
lea eax, [ebp - 0x158]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
mov dword [ebp - 0x158], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40140d
cmp dword [ebp - 0x154], 6
jb 0x40140d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00402065
cmp eax, 0x2000
jae 0x40140d
call fcn.00401880
test eax, eax
jne 0x40140d
push 6
push eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40140d
lea eax, [ebp - 0x3c]
call fcn.00401ac4
test eax, eax
je 0x4013ff
lea edi, [ebp - 0x3c]
call fcn.00401bfc
test eax, eax
je 0x4013f3
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret
Function at 0x403288
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4041fc
sub eax, eax
test esi, esi
je 0x403360
sub eax, 1
test ecx, ecx
je 0x40335e
test esi, 3
je 0x4032c6
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032ab
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403345
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032d0
mov ecx, edx
test ecx, ecx
je 0x40335e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40334b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3415531b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x69be14ba
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219