joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0xcdd348
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ccbe3c
jmp 0xcdd412
mov dword [esp], esi
jmp 0xcdd38b
call fcn.00cdd3b2
inc ebp
fmul dword [esi + 0x29]
fsubr dword [ebp - 0x6b]
xor eax, 0xba3fcca5
movsb byte es:[edi], byte [esi]
xlatb
or dword ds:[eax + reloc.MSVCRT.dll_strncpy], ebp
add edi, dword [ecx - 0x1d]
push word [esp + 3]
jns 0xcdd375
js 0xcdd375
mov dword [esp + 0xf], edi
mov dword [esp + 0x11], edi
pop dword [esp + 2]
pop word [esp + 4]
push dword [esp + 0xd]
jmp 0xcdd3e3
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
pushal
mov byte [esp + 4], dl
mov byte [esp + 0x1c], dl
jmp 0xcdd42c
ja 0xcdd3c1
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
jmp 0xcdd45b
mov cx, 0x9ffb
rdtsc
jmp 0xcdd43a
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
pushfd
jmp 0xcdca67
mov ecx, 0xa20109
mov al, dl
mov esi, dword [esp + 0x2c]
mov bl, byte [esp]
neg ch
jmp 0xcdd466
pushal
mov byte [esp + 4], dl
mov byte [esp + 0x1c], dl
jmp 0xcdd42c
jle 0xcdd47c
btr ebp, edx
lea ebp, [esi*4]
jmp 0xcdd486
btr ebp, edx
lea ebp, [esi*4]
jmp 0xcdd570
lea ebp, [ebp*4]
mov dh, 0x2c
jmp 0xcdd4d1
mov dh, 0x2c
jmp 0xcdd4d1
jmp 0xcdd541
sub esp, 0xb8
mov ebp, esp
cmc
jb 0xcdd4bb
bt ebx, edi
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0xcdd54a
pop edx
lea ebx, [edx + edx]
jmp 0xcdd522
sub esp, 0x13
jp 0xcdd4e7
pop edx
lea ebx, [edx + edx]
lea esp, [esp + 3]
cmc
mov eax, ebx
jmp 0xcdd550
lea esp, [esp + 3]
cmc
mov eax, ebx
jmp 0xcdd550
sub esp, 0x1b
mov word [esp + 5], sp
mov ebx, dword [esp + 0xd]
lea esp, [esp + 3]
jmp 0xcdd5a7
bt ebx, edi
lea ebx, reloc.MSVCRT.dll_strncpy
mov ecx, esi
xchg ebx, eax
jmp 0xcdd4fd
mov ah, byte [esp]
sub esp, 0x14
jle 0xcdd52b
sub esp, 0x1b
jmp 0xcdd5dc
lea edi, [esp]
sub esp, 8
jg 0xcdd48b
lea ebp, [ebp*4]
jmp 0xcdd49b
jmp 0xcdd5c1
mov dx, 0x9cc1
mov eax, ecx
bsf eax, esi
jmp 0xcdd610
lea esp, [esp + 0x2c]
sub esi, 0x5f7d145b
rdtsc
dec bx
jle 0xcdd588
jg 0xcdd58a
arpl si, si
add edi, esi
dec edx
mov fs, word [bp - 0x46]
rcr dword [ebx + ecx*4 - reloc.MSVCRT.dll_strncpy], 0x8a
cli
mov dx, 0x9cc1
mov eax, ecx
bsf eax, esi
mov bh, dl
rdtsc
jmp 0xcdd5eb
mov word [esp + 5], sp
mov ebx, dword [esp + 0xd]
lea esp, [esp + 3]
jmp 0xcdd5a7
neg esi
xchg ebx, eax
bsr edx, edi
jmp 0xcdd62c
neg al
xor bl, dh
mov dh, 0x1e
mov eax, dword [esp]
jmp 0xcdd634
mov bh, dl
rdtsc
jmp 0xcdd5eb
mov dh, 0x1e
mov eax, dword [esp]
jmp 0xcdd634
jnp 0xcdd5f7
neg al
xor bl, dh
jmp 0xcdd616
ror esi, 0
mov dh, byte [esp]
mov al, ch
xchg ebx, edx
jmp 0xcdd67e
dec esi
lea eax, reloc.MSVCRT.dll_strncpy
pushfd
lea esp, [esp]
mov edx, dword [esp + 1]
xchg bl, dh
call fcn.00cdd668
inc ebp
in eax, 0x75
sbb al, 0xef
push 0xffffffffffffff94
pop es
scasb al, byte es:[edi]
invalid

Function at 0xcdd362
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp], esp
call fcn.00cdd348

Function at 0xcdd3b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 3], ch
lea esp, [esp + 2]
mov dword [esp + 4], ebp
pushal
jmp 0xcdd394
Function at 0xcde43c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edi, edx
jmp 0xcdea73
lea ebp, [ebp + 0x10]
bsf ax, bp
bts eax, ebx
mov eax, dword [esp]
mov eax, 0x2e39ac0
mov ax, cx
jmp 0xcdea5c
lea esp, [esp + 2]
xchg dword [esp + 0x14], ebp
cmc
lea eax, [eax*4]
not al
mov ah, byte [esp]
jmp 0xcde973
push dword [esp + 0x14]
ret 0x18
xchg dword [esp + 0x14], ebp
bts eax, ebx
lea eax, [edi*4]
bswap eax
mov ax, si
mov al, bl
jmp 0xcdea27
ja fcn.00cde41a
inc bh
jne 0xcdeaa1
btr eax, esi
jmp 0xcdeaa6
mov eax, 0xc1db0096
rdtsc
jmp 0xcdeab3
btr eax, esi
jmp 0xcdea8b
mov eax, 0xc1db0096
rdtsc
jmp 0xcdeab3
mov eax, ebp
mov edx, dword [esp]
sub esp, 0x10
je 0xcdeaf8
jne 0xcdeae2
xchg edx, eax
xor byte [esi - 0x5248cf3f], ah
sub eax, 0x8a37c4bd
mov esp, 0x1db8668f
mov ax, 0x651d
mov ax, 0xb889
stc
sub esp, 0x16
xchg byte [esp + 4], al
jmp 0xcde98e
dec bh
jmp 0xcdeafa
dec bh
lea ebx, [ebp + 0x40]
mov edx, 0xc9d410a4
xchg dl, dh
clc
jmp 0xcdeb3b
lea edx, [edi*4]
and edx, 0x873b3be0
jmp 0xcdeb3f
lea edx, [edi*4]
and edx, 0x873b3be0
jmp 0xcdeb3f
jl 0xcdeb67
jge 0xcdeb67
lea edx, [edi - 0x80]
call 0xcdeb48
fisttp word [ebp - 0x6fcdb9c]
jb 0xcdeb70
jae 0xcdeb7a
and dl, 0xfc
push ebp
jmp 0xcdeb80
sub ebx, eax
shr edx, 5
jbe 0xcdeb1d
ja 0xcdeb07
lea esp, [esp + 1]
jmp 0xcdeb51
lea esp, [esp + 1]
jmp 0xcdeb51
sub edx, ebx
jg 0xcdebc6
jle 0xcdebc6
nop
sbb cl, byte [eax - 0xd24e511]
jg 0xcdeb7e
mov bh, byte [ecx + 0x31]
fcom dword [eax - 0x3a]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov edx, dword [esp]
call 0xcdeba5
lea ebp, [edx + ebx - 0x40]
jmp 0xcdec02
call 0xcdebec
push edi
jmp 0xcdec1f
push ecx
mov esi, eax
mov edi, edx
jmp 0xcdec2a
pushal
cmc
jmp 0xcdec65
mov dword [esp + 0x18], ebx
popal
jmp 0xcdec4f
push esi
rol dword [eax - reloc.MSVCRT.dll_strncpy], 0xff
invalid
cld
call fcn.00cdec97
in al, dx
js 0xcdec46
mov dword [eax - 0x43], edi
ret 0xc555
jns 0xcdec32
mov dword [esp + 0x18], ebx
popal
jmp 0xcdec4f

Function at 0xcde484
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebx
mov ax, 0x5e8d
lea ebx, [ebx + 0x23]
mov ax, di
and ah, dh
jmp 0xcde600
mov eax, 0x68657204
lea eax, reloc.MSVCRT.dll_strncpy
push cx
lea esp, [esp + 2]
jmp 0xcde46e
mov al, byte [esp]
mov ax, sp
mov ah, byte [esp]
xchg dword [esp], ebx
rcl eax, cl
call fcn.00cde514
Function at 0xcde58c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jno 0xcde5dc
mov word [esp + 6], bx
lea edx, [esp - 0x5a]
jmp 0xcde5e1
mov edx, dword [esp + 9]
bswap edx
xchg word [esp + 3], dx
jmp 0xcde6db

Function at 0xcdfa52
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp]
inc bl
mov ah, bh
xchg dword [esp + 4], ebx
jmp 0xcdfaa9
bswap eax
rdtsc
btc ebp, edi
lea ecx, [edx*4]
call fcn.00cdfa8b

Function at 0xce1ca5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ax
push dword [esp + 8]
jo 0xce1ce1
jno 0xce1cc9
inc ebx
enter 0x395e, 0xffffffffffffffc8
jle fcn.00ce1ca5
cmc
pushfd
outsd dx, dword [esi]
test al, 0x1f
xchg esi, eax
add al, 0x63
sahf
sub al, 0x87
cmp eax, ebp
fdiv st(7), st(0)
invalid
push word [esp + 4]
lea esp, [esp + 2]
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]

Function at 0xce1faa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, ebp
push cx
neg bx
jb 0xce1df6
jae 0xce1dd6
rcl byte [edx + ecx*8 - 0x53], 0x5c
cdq
inc ecx
ret
sub esp, 0xf
mov bl, cl
lea esp, [esp + 1]
jmp 0xce1e21
sub esp, 0xf
mov bl, cl
lea esp, [esp + 1]
or eax, 0x2d0bcefb
dec ah
xchg dl, al
inc ebp
jmp 0xce1ec9
or eax, 0x2d0bcefb
dec ah
jmp 0xce1e06
lea eax, [ebx*4]
mov ebx, esp
mov word [esp], sp
jmp 0xce1e69
mov dh, byte [esp]
jmp 0xce1e4e
setnp bh
lea esp, [esp + 2]
jmp 0xce1ea0
push si
mov ah, dh
add ah, 0xd8
jnp 0xce1e64
mov dh, byte [esp]
lea eax, [ebx*4]
mov ebx, esp
mov word [esp], sp
setnp bh
jmp 0xce1e6c
inc ebp
neg dh
jmp 0xce1ef6
bt ebx, edx
rdtsc
seto al
mov eax, 0xb0b72463
jmp 0xce1eff
mov dl, byte [esp]
mov eax, 0x953e12bc
mov bx, 0xe262
mov edx, dword [esp]
xor ebp, 0x59120bbe
jmp 0xce1e82
seto al
mov eax, 0xb0b72463
jmp 0xce1eff
jb 0xce1ea9
bt ebx, edx
rdtsc
jmp 0xce1ee0
sub ebp, 0x36ba5b96
lea ebx, [ebx + edi]
pushal
pop dword [esp + 0x17]
neg eax
jmp 0xce1f1a
jg 0xce1f30
lea eax, [eax + esi]
mov eax, dword [esp + 0xe]
jmp 0xce1f41
lea eax, [eax + esi]
mov eax, dword [esp + 0xe]
pop dword [esp + 7]
jmp 0xce1f80
pop dword [esp + 7]
mov ah, 0xe7
push esi
jmp 0xce1f83
xor ebp, 0x4b3ee4dc
mov eax, dword [esp]
mov dx, word [esp]
bswap eax
jmp 0xce1fc1
mov ah, 0xe7
push esi
lea esp, [esp + 0x1c]
jmp 0xce1f67
mov bx, 0xa46f
jmp 0xce1fa3
mov bx, 0xa46f
call 0xce1faa
ret 0xe87d
add ebp, dword [edi]
mov ax, dx
rcl al, cl
jns 0xce1f9f
js 0xce1f89
Function at 0xce2353
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xe0ab3f7f
jmp 0xce407a
push word [esp + 3]
jmp 0xce23a0
ja 0xce23b6
lea esp, [esp + 2]
jmp 0xce23ba
lea esp, [esp + 2]
lea esp, [esp + 4]
neg bl
jmp 0xce23c6
xchg dh, al
lea edx, [edi*4]
sbb edx, esp
jg 0xce2408
setl ah
setl dh
jmp 0xce2484
setl ah
call 0xce2411
pop edx
not edx
mov dx, word [esp]
cmc
mov dx, 0x8737
not ah
jmp 0xce2474
mov word [esp], si
xchg dword [esp + 4], ebp
cmp edx, ecx
xchg dx, ax
jmp 0xce249d
lea esp, [esp + 2]
lea ebp, [ebp - 0x1e]
not eax
push ecx
bswap eax
xchg edx, eax
jmp 0xce243a
xchg dword [esp], ebp
bts eax, esp
xchg dh, al
push si
rdtsc
rdtsc
jmp 0xce2450
mov edx, esi
mov eax, 0x4387e3e7
jmp 0xce24af
bsr dx, dx
sub esp, 2
lea esp, [esp + 2]
push dword [esp + 4]
ret 8
xor bl, 0xc6
mov ax, 0x9173
xchg edx, eax
mov edx, ebx
jmp 0xce24e0
and ax, bp
jae 0xce28fb
pushal
bt ax, dx
jmp 0xce2906
pushal
bt ax, dx
jmp 0xce2906
shl edx, 2
mov ax, 0x44a2
mov eax, dword [esp]
jmp 0xce0a7e
call 0xce2cea

Function at 0xce2411
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xe0ab3f7f
jmp 0xce407a
push word [esp + 3]
jmp 0xce23a0
ja 0xce23b6
lea esp, [esp + 2]
jmp 0xce23ba
lea esp, [esp + 2]
lea esp, [esp + 4]
neg bl
jmp 0xce23c6
xchg dh, al
lea edx, [edi*4]
sbb edx, esp
jg 0xce2408
setl ah
setl dh
jmp 0xce2484
setl ah
call 0xce2411
pop edx
not edx
mov dx, word [esp]
cmc
mov dx, 0x8737
not ah
jmp 0xce2474
mov word [esp], si
xchg dword [esp + 4], ebp
cmp edx, ecx
xchg dx, ax
jmp 0xce249d
lea esp, [esp + 2]
lea ebp, [ebp - 0x1e]
not eax
push ecx
bswap eax
xchg edx, eax
jmp 0xce243a
xchg dword [esp], ebp
bts eax, esp
xchg dh, al
push si
rdtsc
rdtsc
jmp 0xce2450
mov edx, esi
mov eax, 0x4387e3e7
jmp 0xce24af
bsr dx, dx
sub esp, 2
lea esp, [esp + 2]
push dword [esp + 4]
ret 8
xor bl, 0xc6
mov ax, 0x9173
xchg edx, eax
mov edx, ebx
jmp 0xce24e0
and ax, bp
jae 0xce28fb
pushal
bt ax, dx
jmp 0xce2906
pushal
bt ax, dx
jmp 0xce2906
shl edx, 2
mov ax, 0x44a2
mov eax, dword [esp]
jmp 0xce0a7e
call 0xce2cea
Function at 0xcf4da7
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg al
call fcn.00cf4d4c
setns al
mov ax, word [esp]
jmp 0xcf4e2a
bsf eax, edi
jb 0xcf4e14
jae 0xcf4e14
Function at 0xd0421c
Capabilities:
Execute anti-debugging instructions

Disassembly:
invalid
mov byte [edi], bl
sub esp, 0xc
pop word [esp + 3]
call fcn.00d032ba
movsw word es:[edi], word [esi]
jmp 0xd5018f
jmp 0xd0338d
out 0x69, al
cmp ecx, 0x3e
jmp 0xd0343f
cmp edx, 0x34
call fcn.00d03350
add eax, dword [eax]
inc esi
and dword [ebx + esi*4 - reloc.MSVCRT.dll_strncpy], ebp
jle 0xccd06c
cmp byte [ebp - 0x34], dl
dec ecx
pop ds
out dx, al
pop edi
inc esi
jno 0xccd0db
push edi
out 1, eax
add byte [edi + 7], bh
je 0xccd0bd
jg 0xccd101
sbb byte [ecx], 0xab
adc eax, 0x4a4d586
jo 0xccd179
aad 0xa4
add al, 0x70
jae 0xccd171
push 0xffffffffffffffe8
fbld tbyte [edx + 3]
add byte [ebp + 0x114e2734], al
sbb ah, byte [ebx + 0x780d8b6a]
call 0xd033eb
test dword [edi], esi
dec esi
adc dword [edx], ebx
mov dword [reloc.MSVCRT.dll_strncpy], eax
sbb byte [ebx], dh
cmp byte [0x4ae89f0c], 0x62
add eax, dword [eax]
fnstcw word [eax]
sbb esi, dword [edx - 0xa]
pop esp
out dx, eax
cld
push 0xb761e74e
bound ebx, qword [ebp - 0x9a10014]
xlatb
pop esi
not bh
not bl
jmp 0xd040b3
pushal
jmp 0xd03420
jmp 0xd03452
adc byte [ebx - 0x11165af6], dl
bound eax, qword [ebx]
jmp 0xd03468
add byte [ebp - 0x3c], dl
ja 0xccd1dc
mov ch, 0xd1
jmp 0xccd1d7
jmp 0xd0340a
adc ecx, dword [edx + reloc.MSVCRT.dll_strncpy]
dec esp
int3
lea esp, [esp + 2]
jmp 0xd032c4
lea esp, [esp + 0xc]
cmp edx, 0x1a
pushfd
jmp 0xd032ff
lea ebx, [ebx*4 + 0x2b]
jmp 0xccd06e
lea ecx, [edx + 0x41]
jmp 0xccd18d
lea esp, [esp + 4]
jae 0xccd0d5
mov ecx, ebx
not cx
bswap ecx
jmp 0xd032e9
push di
mov word [esp], si
lea esp, [esp + 2]
setne bl
jmp 0xd032dd
xor ebx, ebx
stc
clc
cmp ecx, 0x3e
jmp 0xd03322
cmp esi, 0x1a
jae 0xccd149
lea ecx, [edx*4]
mov cx, bx
jmp 0xd03418
push ecx
mov word [esp], cx
lea esp, [esp + 4]
mov byte [edi + 1], cl
jmp 0xd033f0
lea ecx, [esi + 0x41]
jmp 0xccd133
lea esp, [esp + 0x20]
cmp esi, 0x34
jae 0xccd175
bswap ecx
jmp 0xd03489
jae 0xccd09d
mov bx, ax
mov bh, 0x8d
lea ebx, [ecx - 4]
jmp 0xccd06e
xor ecx, ecx
jmp 0xd0349c
cmp esi, 0x3e
jae 0xccd15f
lea ecx, [esi - 4]
jmp 0xccd133
mov cx, word [esp]
mov ecx, 0xaa70f8d
bswap ecx
lea ecx, [esi + 0x47]
jmp 0xccd133
cmp esi, 0x3e
call 0xd034a5
xor byte [ecx + 0x648d242c], cl
and al, 4
setne cl
jmp 0xd045d5
mov byte [edi + 2], cl
bt ebx, ecx
btr bx, bp
call fcn.00d04057
mov edx, dword [esp]
call fcn.00d040f8
call fcn.00d0410b
cmp dl, al
push cs
inc esp
int1
mov eax, dword [reloc.MSVCRT.dll_strncpy]
push eax
salc
add byte [edi - 0x1f14a632], dh
cmc
mov ebx, 0xef460202
jmp 0xd0419a
sub edi, 8
mov bx, 0xb8ba
push bx
neg bx
jmp 0xd042b8
lea esp, [esp + 2]
mov dword [edi], edx
push eax
jmp 0xd04239
pushal
jmp 0xd04212
bt ebx, esi
jo 0xd041eb
pushal
jmp 0xd04212
bswap edx
xchg ah, dl
call 0xd0421c
xor ebp, ebx
push 0x870ff83b
std
add bh, bh
jmp dword [esi - 0x79]
mov dl, bh
pop word [esp]
lea ebx, [eax + ebx]
lea esp, [esp + 2]
mov dword [edi + 4], eax
jmp 0xd04206
jle 0xd041c2
lea esp, [esp + 2]
jmp 0xd041c6
lea ecx, [ecx*4 + 0x2b]
jmp 0xccd133
push 0xcbb3fa6a
call fcn.00cda955
or al, 0x9f
out 0x11, al
invalid
Function at 0xd7e875
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, dl
pop dword [esp + 0xa]
mov cx, word [esp + 9]
mov bx, word [esp + 0x13]
jmp 0xd7e87b
mov dx, cx
mov dword [esp + 0xf], edi
pop dword [esp + 7]
rdtsc
pop word [esp + 0x14]
jmp 0xd7e846
push dword [esp]
clc
jmp 0xd7e85c
btr di, bx
sete bl
mov cl, 0xa7
mov byte [esp + 8], dl
xchg byte [esp + 1], bh
mov bl, al
jmp 0xd7e905
cmc
rcr ecx, cl
rcl dx, cl
xchg bl, dh
pop word [esp + 6]
push dword [esp + 0xd]
jmp 0xd7e8b7
mov cx, word [esp + 3]
cpuid
mov dl, dh
mov eax, dword [esp + 0xe]
mov ecx, 0xcd5ad424
mov cx, word [esp + 0x13]
jmp 0xd7e8cd

Function at 0xd7ebf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not edi
rol ebp, cl
cmp bx, bp
pop dword [esp + 3]
inc ecx
rdtsc
jmp 0xd7ebf4
jmp 0xd7ebdc
add esp, 7
pop edi
mov cl, byte [esp]
cmc
rdtsc
sub esp, 1
jmp 0xd7ec50
mov eax, 0xca20749f
cpuid
pop bp
lea ebx, [edi*4]
xchg si, ax
dec eax
jmp 0xd7ec7a
push word [esp + 1]
bswap eax
cpuid
xchg word [esp], cx
mov dword [esp], ebp
xchg ah, al
jmp 0xd7ec2f
mov si, 0xf046
lea esp, [esp + 1]
xchg bl, al
sub esp, 5
xchg byte [esp], dh
jmp 0xd7ec92
std
lea ecx, [edi*4]
neg dh
bsr edi, eax
bsf esi, ebx
lea esi, reloc.MSVCRT.dll_strncpy
jmp 0xd7ec64
mov edx, ecx
mov dword [esp], esp
pop ecx
mov word [esp], bx
lea ecx, [edx*4]
bswap esi
jmp 0xd7fa60
push word [esp + 1]
stc
std
lea esp, [esp]
push dword [esp + 2]
jmp 0xd7ecfd
xchg word [esp + 3], si
rol bx, 6
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
push cx
jmp 0xd7ecbb
lea esp, [esp + 8]
popfd
jmp 0xd7ed71
bt edi, esi
lea esp, [esp]
cpuid
mov si, 0xbe38
bsr si, cx
sub esp, 5
jmp 0xd7ecd1
not bh
lea ebp, [edi + ebp]
mov ch, 0x96
mov ah, ch
call fcn.00d7ed3a
fst qword [edi - 0x39]
mov byte [0xc845b451], al
pop esi
cmp eax, ecx
sub esi, ebp
cmc
pushfd
outsd dx, dword [esi]
invalid
push 0x5f8206ed
add dword [esp], reloc.MSVCRT.dll_strncpy
pushal
setbe al
rdtsc
jmp 0xd7ed50
btr bx, cx
add esp, 0
mov byte [esp], bh
xchg cx, si
add esp, 0
xchg ecx, edi
jmp 0xd7ed25
mov edi, dword [esp]
mov dh, bl
lea ebx, [esp + 0x1c]
cpuid
xchg byte [esp], cl
xchg edx, ebp
jmp 0xd7ee52
bswap edx
cpuid
bswap ecx
btc dx, dx
add esp, 1
mov byte [esp], cl
jmp 0xd7f025
mov di, word [esp]
push dword [esp + 3]
mov bx, word [esp + 3]
pop ebp
not cx
pop dx
jmp 0xd7f066
clc
xchg ch, al
push sp
bswap esi
rdtsc
inc bl
jmp 0xd7f1d3
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x100020c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x10011050]
xor eax, esp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x14]
push esi
push edi
mov ecx, eax
mov edi, vtable.ShareRestrictedSD.0
push ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
call fcn.10001190
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1000211f
push eax
push eax
call fcn.100056fb
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.GlobalGarena_CTSYS_STATUS
push 0x204
push 0
push 4
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
call esi
mov dword [0x10023808], eax
test eax, eax
je 0x1000226d
cmp eax, 0xffffffff
je 0x1000226d
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x204
push 0
push 0
push 0xf001f
push eax
call edi
mov dword [0x1002380c], eax
test eax, eax
jne 0x1000218b
mov eax, dword [0x10023808]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 8], vtable.ShareRestrictedSD.0
jmp 0x10002271
mov dword [eax], 0
mov eax, dword [esp + 0xc]
push str.GlobalGarena_REGION_CODE
push 3
neg eax
push 0
sbb eax, eax
lea ecx, [esp + 0x1c]
push 4
and eax, ecx
push eax
push 0xffffffffffffffff
call esi
mov dword [0x10023810], eax
test eax, eax
je 0x1000217e
cmp eax, 0xffffffff
je 0x1000217e
push 3
push 0
push 0
push 0xf001f
push eax
call edi
mov dword [0x10023814], eax
test eax, eax
jne 0x10002200
mov edx, dword [0x10023810]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
call fcn.100012e0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.10004fd7
mov esp, ebp
pop ebp
ret
push 0x1000f0a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.com.garena.data.myinfo
call dword [sym.imp.Garena.exe_Ordinal_28]
add esp, 4
test eax, eax
je 0x1000224e
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x30]
push ecx
mov ecx, eax
call edx
test al, al
je 0x1000224e
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
call fcn.10001130
mov ecx, dword [0x10023814]
mov edx, dword [eax]
push ecx
push esi
call edx
lea ecx, [esp + 8]
call fcn.100012e0
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.10004fd7
mov esp, ebp
pop ebp
ret
mov dword [esp + 8], edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10002289
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x94]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.10004fd7
mov esp, ebp
pop ebp
ret
Function at 0x10002470
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10011050]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x214]
sub eax, 0
push esi
je 0x10002537
sub eax, 1
jne 0x10002589
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.dllsPEngine.dll
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x100237f8], eax
test eax, eax
jne 0x100024eb
mov dword [0x100237fc], eax
mov dword [0x10023800], eax
jmp 0x1000250b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push eax
call esi
mov ecx, dword [0x100237f8]
push 2
push ecx
mov dword [0x10023800], eax
call esi
mov dword [0x100237fc], eax
mov esi, dword [sym.imp.Garena.exe_Ordinal_11]
push 0x10002460
push str.OnAuthOK
call esi
push 0x100022a0
push str.OnBeforeLaunchGame
call esi
push 0x100022d0
push str.OnAfterLaunchGame
call esi
jmp 0x10002589
mov eax, dword [0x10023818]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1002381c], 0
test eax, eax
je 0x1000255f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x10023818]
push edx
call esi
mov eax, dword [0x1002380c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push eax
call edi
mov ecx, dword [0x10023808]
push ecx
call esi
mov edx, dword [0x10023814]
push edx
call edi
mov eax, dword [0x10023810]
push eax
call esi
pop edi
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.10004fd7
add esp, 0x20c
ret 0xc