joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d7a1e
sub esp, 0x44
mov eax, 0
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x48]
movzx ecx, byte [eax + 0x50]
mov byte [esp + 0x12], cl
test cl, cl
je 0x4d7945
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea eax, [0x543839]
mov dword [esp], eax
mov dword [esp + 4], 7
call sym.runtime.convTstring
mov eax, dword [esp + 8]
lea ecx, [0x526ec0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
lea eax, [0x5752e8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
lea ecx, [esp + 0x24]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call sym.go_parser._parser_.printTrace
mov eax, dword [esp + 0x48]
inc dword [eax + 0x54]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ecx, [sym.go_parser._parser_.parseElement.deferwrap1]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], 1
mov dword [esp], eax
call sym.go_parser._parser_.parseValue
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x48]
cmp dword [edx + 0x7c], 0x3a
jne 0x4d79f0
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov eax, dword [edx + 0x78]
mov dword [esp + 0x18], eax
mov dword [esp], edx
call sym.go_parser._parser_.next
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sym.go_parser._parser_.parseValue
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x34], ecx
lea edx, [0x530ec0]
mov dword [esp], edx
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [0x673320]
test ecx, ecx
jne 0x4d79c2
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x34]
jmp 0x4d79d4
call sym.runtime.gcWriteBarrier2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov ebx, dword [esp + 0x34]
mov dword [edi + 4], ebx
mov dword [eax + 4], ecx
mov ebp, dword [esp + 0x18]
mov dword [eax + 8], ebp
mov ebp, dword [esp + 0x1c]
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebx
mov ecx, eax
lea eax, [0x576048]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
movzx eax, byte [esp + 0x12]
test al, 1
je 0x4d7a11
and eax, 0xfffffffe
mov byte [esp + 0x13], al
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
call eax
add esp, 0x44
ret
call sym.runtime.morestack_noctxt
jmp sym.go_parser._parser_.parseElement
Function at 0x4da450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4da630
sub esp, 0x40
mov eax, 0
mov dword [esp + 0x3c], eax
mov byte [esp + 0x13], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x44]
movzx ecx, byte [eax + 0x50]
mov byte [esp + 0x12], cl
test cl, cl
je 0x4da53d
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
lea eax, [0x5440d3]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call sym.runtime.convTstring
mov eax, dword [esp + 8]
lea ecx, [0x526ec0]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
lea eax, [0x5752e8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
lea ecx, [esp + 0x2c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call sym.go_parser._parser_.printTrace
mov eax, dword [esp + 0x44]
inc dword [eax + 0x54]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [sym.go_parser._parser_.parseReturnStmt.deferwrap1]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x13], 1
mov ecx, dword [eax + 0x78]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x50
call sym.go_parser._parser_.expect
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x7c]
cmp ecx, 0x39
je 0x4da5a8
cmp ecx, 0x38
jne 0x4da56d
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x4da5ae
movzx ecx, byte [eax + 0x94]
mov byte [esp + 0x11], cl
mov byte [eax + 0x94], 1
mov dword [esp], eax
call sym.go_parser._parser_.parseExprList
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
movzx ebx, byte [esp + 0x11]
mov ebp, dword [esp + 0x44]
mov byte [ebp + 0x94], bl
mov ebx, eax
mov eax, ebp
jmp 0x4da5ae
xor ecx, ecx
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sym.go_parser._parser_.expectSemi
lea eax, [0x52d580]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x673320]
test ecx, ecx
jne 0x4da5f8
mov ecx, dword [esp + 0x20]
jmp 0x4da603
call sym.runtime.gcWriteBarrier1
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x48], eax
movzx eax, byte [esp + 0x12]
test al, 1
je 0x4da623
and eax, 0xfffffffe
mov byte [esp + 0x13], al
mov edx, dword [esp + 0x3c]
mov eax, dword [edx]
call eax
add esp, 0x40
ret
call sym.runtime.morestack_noctxt
jmp sym.go_parser._parser_.parseReturnStmt
Function at 0x4fb360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fb525
sub esp, 0x30
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x28]
test cl, cl
je 0x4fb3b5
movzx ecx, byte [esp + 0x38]
cmp cl, 0xa
ja 0x4fb399
cmp cl, 9
je 0x4fb39e
cmp cl, 0xa
je 0x4fb3aa
jmp 0x4fb3ba
cmp cl, 0xb
jne 0x4fb3a5
mov ecx, 0x20
jmp 0x4fb3ba
cmp cl, 0xc
jne 0x4fb3ba
mov byte [eax + 0x28], 0
mov ecx, 0xc
jmp 0x4fb3ba
movzx ecx, byte [esp + 0x38]
mov byte [esp + 0x23], cl
cmp dword [eax + 0x7c], 1
jne 0x4fb3d5
mov edx, dword [eax + 8]
add edx, dword [eax + 0x1c]
mov dword [esp + 0x24], edx
mov ebx, edx
jmp 0x4fb49a
mov edx, dword [esp + 0x3c]
mov ebx, edx
jmp 0x4fb3e5
mov dword [eax + 0x14], esi
mov byte [esi + edi - 1], cl
dec edx
test edx, edx
jle 0x4fb462
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
inc esi
mov edi, dword [eax + 0x10]
cmp ebp, esi
jae 0x4fb3dd
mov dword [esp + 0x2c], edx
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 1
lea eax, [0x526f40]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [0x673320]
test eax, eax
je 0x4fb447
call sym.runtime.gcWriteBarrier2
mov dword [edi], ecx
mov eax, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov dword [ebx + 0x10], ecx
mov eax, ebx
mov ebx, dword [esp + 0x3c]
mov esi, edx
mov edi, ecx
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x2c]
jmp 0x4fb3dd
add dword [eax + 0x60], ebx
cmp cl, 0xa
je 0x4fb46f
cmp cl, 0xc
jne 0x4fb487
add dword [eax + 0x64], ebx
add dword [eax + 0x78], ebx
mov dword [eax + 0x68], 1
mov dword [eax + 0x7c], 1
add esp, 0x30
ret
add dword [eax + 0x68], ebx
add dword [eax + 0x7c], ebx
add esp, 0x30
ret
mov dword [eax + 0x14], esi
mov byte [esi + edi - 1], 9
dec edx
test edx, edx
jle 0x4fb517
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
inc esi
mov edi, dword [eax + 0x10]
cmp ebp, esi
jae 0x4fb491
mov dword [esp + 0x28], edx
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 1
lea eax, [0x526f40]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [0x673320]
test eax, eax
je 0x4fb4fc
call sym.runtime.gcWriteBarrier2
mov dword [edi], ecx
mov eax, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov dword [ebx + 0x10], ecx
mov eax, ebx
mov ebx, dword [esp + 0x24]
mov esi, edx
mov edi, ecx
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
jmp 0x4fb491
add dword [eax + 0x60], ebx
add dword [eax + 0x68], ebx
add dword [eax + 0x7c], ebx
jmp 0x4fb3d5
call sym.runtime.morestack_noctxt
jmp sym.go_printer._printer_.writeByte
Function at 0x502fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x673268]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5030aa
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x502ff0
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x503029
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x502fe3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x503033
inc eax
cmp eax, 4
jge 0x503049
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x5030a3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x50306c
jmp 0x503032
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x4010b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
call fcn.00401338
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.00401230
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0x452528
mov byte [ebp - 0x14], 0xad
mov byte [ebp - 0x13], 0x90
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0xd
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x5c
mov byte [ebp - 0xc], 0xf2
mov byte [ebp - 0xb], 0xf3
mov byte [ebp - 0xa], 0x3b
mov byte [ebp - 9], 0xd7
mov byte [ebp - 8], 0xc9
mov byte [ebp - 7], 0xd3
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0xe8
mov byte [ebp - 4], 0x6a
mov byte [ebp - 3], 0xfc
mov byte [ebp - 2], 0xee
mov byte [ebp - 1], 0xde
mov dword [ebp - 0x18], ebx
call fcn.00401332
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
call fcn.00401a80
push esi
push edi
lea ecx, [ebp - 0x94]
call fcn.00401ac0
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x94]
call fcn.00401b70
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x401177
push ebx
push 0x8a
push 0x4524f0
push eax
call fcn.00401326
mov ebx, dword [fcn.0044a0c4]
mov ecx, 5
lea edi, [ebp - 0x34]
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
mov edi, dword [fcn.0044a0c8]
jne 0x4011b6
push 0x452528
call edi
mov esi, eax
test esi, esi
je 0x4011b6
push 0x4524dc
push esi
call ebx
test eax, eax
je 0x4011af
call eax
push esi
call dword [fcn.0044a0b0]
push 0x4524d0
call edi
mov esi, eax
test esi, esi
jne 0x4011e2
push 0x10
push 0x4524c8
push 0x4524b0
push eax
call dword [0x44a464]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4524a4
push esi
call ebx
test eax, eax
jne 0x401216
push 0x10
push 0x4524c8
push 0x45248c
push eax
call dword [0x44a464]
mov edi, dword [ebp - 0x1c]
push esi
call dword [fcn.0044a0b0]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call eax
push esi
mov edi, eax
call dword [fcn.0044a0b0]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401a80
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
ret

Function at 0x412bd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45c240]
test eax, eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
je 0x412cd5
mov ecx, dword [0x45c230]
call fcn.0042f5b0
test eax, eax
je 0x412cd5
mov ecx, dword [eax + 0x14]
test ecx, ecx
mov ebx, dword [eax + 0x1818]
je 0x412cd5
mov edx, dword [0x45317c]
test edx, edx
je 0x412cd5
mov edx, dword [eax + 0x10]
test edx, edx
je 0x412cd5
mov edx, dword [ecx + 0xc]
mov eax, edx
xor eax, esi
and eax, 0xff
mov eax, dword [eax*4 + 0x44b2a0]
shr edx, 8
xor eax, edx
mov edx, esi
mov esi, eax
shr edx, 8
xor esi, edx
shr eax, 8
and esi, 0xff
mov esi, dword [esi*4 + 0x44b2a0]
xor esi, eax
shr edx, 8
mov eax, esi
xor eax, edx
and eax, 0xff
push edi
mov edi, dword [eax*4 + 0x44b2a0]
xor eax, eax
mov al, dh
shr esi, 8
xor edi, esi
mov edx, edi
and edx, 0xff
shr edi, 8
or bl, 0x80
xor eax, edx
mov eax, dword [eax*4 + 0x44b2a0]
mov edx, dword [ecx + 0x4524]
xor eax, edi
mov dword [ecx + 0xc], eax
mov eax, edx
and eax, 0xff
inc edx
mov dword [ecx + 0x4524], edx
lea edx, [ecx + eax*4]
lea eax, [eax + edx + 0x4020]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov byte [eax + 4], bl
mov eax, dword [ecx + 0x4520]
mov esi, dword [ecx + 0x4524]
lea edx, [eax + 0x101]
cmp esi, edx
pop edi
jne 0x412cd5
inc eax
mov dword [ecx + 0x4520], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45e900]
test eax, eax
push ebx
push edi
mov edi, edx
mov ebx, ecx
je 0x446d5a
push esi
lea esi, [eax - 1]
xor esi, eax
and esi, eax
call sym.War3.exe_G0
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push edi
mov edx, esi
mov ecx, ebx
call fcn.00447250
mov eax, dword [0x45e900]
test eax, eax
jne 0x446d33
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x401990
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b130
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
mov eax, dword [0x48d870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x15], 0
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 0x15], al
movsx eax, byte [ebp - 0x15]
test eax, eax
je 0x4019e7
mov byte [ebp - 0x16], 1
jmp 0x4019eb
mov byte [ebp - 0x16], 0
mov al, byte [ebp - 0x16]
jmp 0x401a1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004136b5
mov esp, ebp
pop ebp
ret
Function at 0x401f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
push str.C:WINDOWS_system32drivers_vmmouse.sys
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401f61
mov al, 1
jmp 0x401fa1
push str.C:WINDOWS_system32drivers_vmhgfs.sys
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401f87
mov dword [ebp - 0xc], str.1HFa2oS1DoH7k6g2BNEMIXwKFesf6h2rzYWxfuuj4SHRTKzVtWd2C83qqYfEub173rzQFsDJcb6uD53iqib1lrBjL7gSeQxTlcWpPnO4LnipxEkTlOkbNNr9an5bpnOjTCOdvpzsulvenxIvDNNy55V23f8WUjFKykcRDIyt2JPCAl2E8K5PvdtsM2BIgMtvBetDnrs47e2J4UrvC63Bbn8dVr5NujP5AwXeEiH30WpgMgaxajzm1aYJtkpk0VevB8prHMwdu15r1JXfcoPcwzHy86vmtYRL31uJwaehjXiqMzo372MSS9tnM0XFYHrf9kgdYKXE0er5HyNNyh4mdxPP56tH7XxJqwoa02dKM34UR6uMpwUNHsIyphTz0bEzFoe6wsRSJrOcT9EM6gl7TusmsOekIYjvUQPIO2nQ1q8sQInsbtgq9dfofFS8RhKbDaEcEElx4XIRQeQqJqo4lVsphgIAODym3ufKNFNp5gMh5gaiFnfqIL1TpEyEKImjMbCjfD3SsfnT8I6YYdOsrj7H6aelcaB6IfklMDDHh3B50rghNBFFwwcXugzL6wxGNrmVa7qUd2ze4eXJrROcSV09aWmCwmaDoRceO3W3M5Gmsv5kLAQRWxnkbWwCh2IulKe4yUiRHGb276Pg1FgSn7XS8Ca00wv8k1vwQjWN9u3skUWAWW21saVSLGrrkXBQ4jtSgUJUKlWQryTvSQROdDf02C29OYmeYpDqJnh5dO3YG7pvO5wR3oDMXB7WTBoe6nvyDiV0rb4dd5trjvLQJgBBLtofSkA5dDm8afSUkTa9T6ABFjy15XNOwKzg3noccrMOqQcArOAYfyOyKdIQAyk0WoOST05mvNWWF7xRmMhtRYkgguQ9Rb7LNChLQ4HtR0ErVabMJWo7L78xHwgoEuL7jsmJjyn152fQcECLRF4viAW4IoLCBAcil6rD7l1i8AyegFAuHurlb4kj6TKug2wXpXWtqiet65WhTIa0jaHIcKrpkBwDKmsL0VX2Rj79s35fBo3MBpfxXCQOxfstlXemJBU9Xmv69wYG6BzsXmrx0oSnn01bLt0wXjcuYHne5wwD8noQPKYsSmKM6BSz7Bg19GTSPoLcipwKRVwmbERHnOP6VBBE8A4paGrLDtN1InHQc3ximjphu3xN5iwwia1enryeL0H5hkyQFXDQeiiQppmIf5hcYKKAL1uepyDMuyj2AfjBS2ERpTKWbudbbKJiHkooH2ho3UBhYXhJWlSOQIvw7bHMowR6IjhFbG64PRYqeUFYCbiuYsWtkMPEPrS23xVgIiJmtOi5i8nefCbMaeFVfWISEEmmC8GfDR9sKasg3m8uQhqucrvExmzSW4Go6FsBKFCbGlulk8uWcgvgkKF24HHvNk6Dyp1hONdx8jBTFm9kY3BDoHJVYiCT8l6CuR6vu5KmOgTTIMO2BfkTJjhjRvo9QoH10olWpGb6yECLaOH7Jk4kxrIkPzo8Dy6mnI5I7BlmehskOU9KfYcfi0jF7X8A1XNFA3fQz6pnSS9KtnnjHqHQX5CC8g9Ewvc7h6mgdGR2PhxBPdnfop7hW9B9x04PARqYP7vJTazQRJKmDQFvuAHzUaERswSfcabg4xBVRNqiNe0PMqLqVbqoJymFaz4wvEiSLFTtR4TwTCX7qRu7p1XRaViaDLaePXLG2WvLiEffrFkMoLNFo1YpVxya287oiQf7Xk6pSGWqU8MPuxro9DBhiTAaFGVsRO8KpfROQARA1OaDsj3FyTCCUL7k5uIez9IlRICoPYbWAwjW1Y45sxz43IHmlMmC6Vg10FabkuTiF2AbF4MuOXINEdwA5kC1wcMo9xCqtguDSJXU4fzFmgbatjmb1oPTYinCUt40w3PsYgtp8lFelGJUFT6pLPGytTKb7hV83EnROKddYI6fA84fKdgIWAfhGvMg1mDvTec9gsJNtx2vo0IRsNXKaHYg8ruJsGoidd3MdEWDdMOvAk9SKy4m
mov al, 1
jmp 0x401fa1
push str.C:WINDOWS_system32driversVBoxMouse.sys
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401f9f
mov al, 1
jmp 0x401fa1
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x401fb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x48d870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], str.E5FlG8IMvoaiDmk0WjSAo1PpvfV6qiYyUJmQ13wvbJCBX9e1GfJgAStArfP5EQvlfTqCm64F297CvzJGiyXyDTOxpunacuHvhBvERRRUIGmMSstPgGgKrwmDGd4RbCRmTgR4I7UQCgcfaeTInqUnUg1cjsArecbDixne5Cv2VzDQ1So7GTW
mov dword [ebp - 8], 0
rdtsc
mov dword [ebp - 0xc], eax
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], str.Omyz2mUa1pr7l5Cl1MN1P20fryWiTHH1AJgCEOVHrJRNz2sJzGIUaC64PUT2aavURwenPq70qVh9RbAouxDRbctQettlv9cPHkq7QNlYx2QsE1jedJi5S0blhMofQw2fmMUtSjpJ1BmVNghMjDzab18rjWXBwrwhgxQy55PtML8FCWrgBGn7Y44anx5fmgzG6hqLz33wv87DVm5t7jHl5DvHeHcOBGnQIEVXoQgqwMMJV3PS1VEBh3Snk4mSWCtPcpLnzVvLSpeGkPDCL0n6knpDOLaVAiIiMdlC4uHmm96b
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
cmp eax, 0x64
jbe 0x401ffd
mov dword [ebp - 0x10], 1
jmp 0x402004
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004136b5
mov esp, ebp
pop ebp
ret
Function at 0x402220
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], str.XmxUPmdRe8sTorFj8Mcf8EdRIjApYmOtpFwiVkbGQCNUQgcLllDmKPbPqs5BkjR0MGbuJHhFt01OJrqNxtvmfOHjOy440Hgv8VWfG01zM2ESlHEao2TW4lhVXptO281ni42KMEirM6wo065nrYxmgYMDisrWyC5MXThMDWwxMdBF65UJ2sWlsgAyxPjuLAnFEliAo5wrd2BQR7Ypu7Ln6NHBHsn6Dntuui0iNpOHS41ArMNvWPhh2uYb2X42HsNGQLllXxifx9lmpt27mstn0XtcfjwXmMx7bvdtP0yOrXViibvNAJ2uNIyRec9c7dWqH44pWT9ryJJp4aoPHtJNf2pvxPTXVTBVSXsgNargycfDbVd5YsoR3V5CtWlncgrAjK2zSqABNyxKtjL5AzWjfa6xFIfjx3amvLthqxUVgcv1WJQ1fVPsc4oGaUvbegjSsbQOs8dj6DUxkMC6AhQKamYOn3YEAsqhuaO0XXoEyaJTpF1s7lBAVdoHbP8pXFz4fi6JdQq9q5i0PSjN70pPMAxrMDC9KmHAbg5o5uHfNj5PhgGxJhgUFqPlIskAsiMTBVST0u7D9pRnw6lVUmRJ3u61Pe1fhUR5VHyNfqcE6qE9Vfax1bUSLMRfIkjKHw1vg8Yxpu6i8NhupKPavVbiX13lmJ1CQ9JfgurdPXtFc0PB5VesV8SjfXkMrnADxnSVYxv1qGtL4smYgI5DbJSAKErQoF7u56DPH1Oy1i2Ih7r0JpwxoN7axN31kzdLdpwTUG7Np9WM3qgUJuWFUkzsDVzR4z7U8HlEVji549piDoumKHyMQ5L0oyjhhQooPiT2mPiYTlRArYwjQnxV8md0Xb3AyUbn9KUxPsV8AK9Su3ryAdXl3BiMjy4zyQyID3ulhE5RarVqowqQ9UImMznVBqm4TFWbokA8C12tri29gXypWwlyx9aXLk3BJVAUH1PQQdsbX1pIKvLTHo1IwiLkwEqsJNCA9TrAVXqc59avI59dRTvpNxuXyMyG5Fm9o7zrR957mMfARuf38LLtBhQn8BdnKrFJpXnt9zXyrgUtFnx7DoHFX7YdDoGKU8pszlNY1rq2V9s2oph2sx8rTpAoD6qtIH9ncbiG5aaEkeJ0vhNQCMGl63XJ3QdNt5tYybauEByrwzXJFGwY7qO5WqYWj9aHFf78QLxpKbthXvEdKnVfTxPvPqPRi4T7QSf4chFtRHkxjksDXAmFn1ATGWTh4tDOH4erELuiFFvwH8gUz9K9lANcbjLlDnkXWMEGpGCQeKisiabHHyD09Q4cfCJ3JJGtV5E5NSjMDR7Om6qfCs2Mm6SHD6QRCpSukGEVaDLvP55BItC7S7a4E3FeY7NMd8vr6UdxYB9dAy3kMJQ6psvoMOO6Gb4lVyD0YBRA8R92WToLAY1T6aQioqWGeaqOPsAWVSM2o7GhNd95AIElxJYLTFOIg9awUE4yKDJfj4e3USgV3MQL9aH6CgFGORP6fWB9Wil5lUeyFLj0MYXW22odt0GiH6z3Rr1JN9j2su3sI0sbzdLz8MDJ0aUFWS87OixdmgvmaaWQ06zxeqqj8F5YbHinQDWfbKKvqAXWtQ3i9MTjWGoV3TwsYHmjkBn3svqJuIuWiSBYbPELIKJJUm4IwEOopOt17cnvV9zTvHkTkXH9YJ79S0SbGR4H3A7KVnaGVc2bm387EXV7W6LEorWUL6B7qdGCBSWlNJ7imMaLXbLdhAeq8jgqXMLDrubQiRdd1D6aXxpdJpdU7bofThVwteHpFM8DzGKEhPp6zHFTa0Ry2atziXV2MvCQ9UFaopGJy3SNwBUMJiy6KkB2qLww4pMc1uXmsAXqhTWhkJVjCaYh5KBgThG3Eq1eP6vqkXhCW1wpftEG3wfgt9F4nDw9yijJ87AQKcghOnX1JMeoSmExR8iN8deo7FpnwD5FnmLGJcIYzzwL4p4d8Mgd7yTu4dPENrjwI2YudTbhXEcVI2QWXDBjTpLaztSR
mov dword [ebp - 0x10], str.JITTIyp79Pul165HGcNyitnjbPBvjyk1OagVfCVtiITGOm5eAYMc5JKXdIClLA5t6k4Fa3CC1VbSwPBJxg0zakkqCqbsXpssDrBExbDeaygAWuSi4pVUVcfps28ULlsLTD1fD6FzsbpPyu9Y4OOeX0dfE6BbJU5iJ09EOxTwxP5XseF0NNDoX7qO2BX01Qm0lBDTA03uVY4EmhIz0Fa6JBBAk2Rtr7jXoqRQDDlu3ynTGpB5GBUQigYC7gcYrMYhRr1bKkw7aVj2qCCVlOd2JwjwUF8j8fsbdyYpSDQvvXpHg77BOs6NkBQv648ud2OVbDvS5Q5q9WvUuhoGmAnatmolWHSW6R9TYu0KAWxb3BGX3GOOBhGXIoeoEjnpLIyxcTI2LCYF68jvxaMK
push str.sbiedll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40224f
mov dword [ebp - 4], 1
jmp 0x402256
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret