joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x6d791f94
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x7e006b8c
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401f2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x401f47
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x401f6a
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x401f6f
inc edi
cmp edi, dword [ebp - 4]
jb 0x401f61
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x402067
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x401fc6
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x401f9a
cmp cl, 0xff
jne 0x401ff1
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x401fff
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x402006
dec ecx
shl edx, cl
and edx, 7
je 0x401f8b
movzx ecx, byte [edx + 0x1506294]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x150628c], 0
mov cl, byte [ebx + 4]
je 0x401fee
test cl, cl
je 0x401fee
cmp cl, 0xff
jne 0x401f8b
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x401f5c
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x40203a
movzx esi, byte [edx + 0x1506294]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x402025
cmp al, 0xff
jne 0x402037
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x401fb8
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x401f5c
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x99768c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9976b3
call fcn.00939c18
mov dword [eax], esi
call fcn.00939c05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093a85a
mov eax, esi
jmp 0x997708
test dword [ebp + 0xc], 0xfffffff9
jne 0x997699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9976e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00939c2b
pop ecx
call fcn.00939c05
mov eax, dword [eax]
jmp 0x997708
test al, 0x10
jne 0x997706
test al, 1
je 0x997706
test byte [ebp + 0xc], 2
je 0x997706
call fcn.00939c18
mov dword [eax], 5
call fcn.00939c05
mov dword [eax], 0xd
jmp 0x9976d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x9e6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9e61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9e607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e606a
add dl, dl
jne 0x9e6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e60dc
xor eax, eax
add dl, dl
jne 0x9e6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e617d
add dl, dl
jne 0x9e60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9e60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9e6075
mov eax, 1
add dl, dl
jne 0x9e60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e60e1
sub eax, ebx
mov ebx, 1
jne 0x9e6128
mov ecx, 1
add dl, dl
jne 0x9e610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9e6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9e613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9e614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e6136
cmp eax, 0x7d00
jae 0x9e616d
cmp eax, 0x500
jb 0x9e6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e6075
cmp eax, 0x7f
ja 0x9e6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9e619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9e6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401782
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x401795
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401791
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x4017c2
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x401801
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4017f7
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x401803
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4017e7
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403a25
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 2
mov dword [ebp - 4], ecx
lea esi, [edi + 2]
pop ecx
mov ebx, dword [0x22371478]
movzx eax, word [edi]
test ax, ax
jne 0x403a54
mov edx, dword [ebp + 0xc]
cmp word [edx], ax
je 0x403b14
cmp ax, 0x2a
je 0x403a99
movzx eax, ax
cmp eax, 0x3f
je 0x403a93
cmp eax, 0x5c
jne 0x403a6b
add edi, ecx
add esi, ecx
movzx eax, word [edi]
push eax
call ebx
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx]
push ecx
mov word [ebp + 0xa], ax
call ebx
pop ecx
pop ecx
mov cx, word [ebp + 0xa]
cmp cx, ax
jne 0x403b10
inc edi
inc edi
inc esi
inc esi
jmp 0x403af3
add edi, ecx
add esi, ecx
jmp 0x403af3
movzx eax, word [esi]
test eax, eax
je 0x403b14
cmp eax, 0x2a
je 0x403b07
cmp eax, 0x3f
je 0x403ab5
cmp eax, 0x5c
jne 0x403ac5
add edi, ecx
add esi, ecx
jmp 0x403ac5
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push esi
call fcn.00403a25
test al, al
jne 0x403b14
movzx eax, word [esi]
aaa
sahf
jbe 0x403b1f
or ebx, dword [edi + 0x3c0004]
add byte [eax], al
cmp al, 0
add byte [eax], al
retf 0x5494
test al, 0x49
or al, cl
test eax, 0x1a046af5
add byte [eax - 0x23], dl
invalid
adc ch, bh
xchg ebx, eax
xor al, 0x72
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
aaa
sahf
jbe 0x403b6b
out 0xff, al
push es
add dl, ch
add eax, 0x5ea0000
add byte [eax], al
add byte [eax], ah
add dl, ch
add eax, 0x20000000
sbb bl, ch
retf 0xca49
pop ecx
mov cx, word [ebp + 0xa]
cmp cx, ax
jne 0x403b85
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push esi
call 0x403ab7
test al, al
jne 0x403ba6
mov eax, dword [ebp + 0xc]
cmp word [eax], 0
je 0x403ba2
push 2
pop ecx
add dword [ebp + 0xc], ecx
jmp 0x403acc
xor al, al
jmp 0x403ba8
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4a14f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a15cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a15e8
push ebx
push 0x4a15f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1576
mov ax, 0x83
call fcn.004a1118
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a14c8
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a157f
call fcn.004a14c8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15d4
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax

Function at 0x4a16e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
jmp 0x4a17a5
cmp dword [esi + 0x10], 0x1000
jne 0x4a1793
test byte [esi + 0x15], 1
jne 0x4a1793
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1744
cmp ebp, 2
je 0x4a1744
cmp ebp, 0x10
je 0x4a1744
cmp ebp, 0x20
jne 0x4a1760
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1760
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1771
mov eax, dword [esi]
add eax, ebx
call fcn.004a16e0
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1764
cmp byte [esp + 4], 0
je 0x4a1793
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1719
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x710c84
Capabilities:
Encode data using xor

Disassembly:
push 0x7109ec
pop edi
add ebx, 0x5f9b1e88
add ebx, ebx
call fcn.00710cc7
mov ebx, ebx
sub ecx, 0x34484d7
xor dword [esi], edi
add ecx, 0x5a0dde1e
dec ebx
sub ecx, 0x7642ea62
add esi, 1
add ecx, ecx
add ebx, ebx
cmp esi, edx
jne fcn.00710c84
inc ebx
ret
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x60a93c33
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x85a25a1
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x9c15593
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x287b96
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x53a053b
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x53205ba5
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x401380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4139f0
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00402d10
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push 0
push 0
push 0x23
push 0
call esi
test eax, eax
je 0x4013ff
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x23
push 0
call esi
test eax, eax
je 0x4013ff
xor al, al
jmp 0x4014dd
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00402d10
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00402d10
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
add esp, 0xc
push str.SGAIAssistantBrowser
push eax
lea eax, [ebp - 0x628]
push eax
call esi
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00402d10
add esp, 0xc
lea eax, [ebp - 0x420]
push str.browser_host.dll
push eax
lea eax, [ebp - 0x830]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
lea eax, [ebp - 0x628]
push eax
call esi
push 8
push 0
lea eax, [ebp - 0x830]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebx], eax
test eax, eax
je 0x4014d1
push str.GetBrowserManagerInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
call eax
add esp, 4
cmp dword [edi], 0
push 0
setne bl
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004017cf
mov esp, ebp
pop ebp
ret

Function at 0x402165
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4021a4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4021a4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4021a4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4021a4
cmp dword [ecx + 0x74], 0xe
jbe 0x4021a4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40afc2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040b5c6
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40b031
cmp esi, dword [ebp - 4]
je 0x40b02c
cmp dword [ebp + 0xc], 0
je 0x40b02c
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40b009
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0040ab14
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x40b033
xor eax, eax
inc eax
jmp 0x40b033
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40b098
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0040b5c6
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040b5c6
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x40b10f
cmp word [ecx], dx
je 0x40b10f
mov eax, dword [0x416224]
push edi
dec eax
push eax
push 0x416110
call fcn.0040b037
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x40b182
cmp word [eax], dx
je 0x40b182
mov eax, dword [edi]
test eax, eax
je 0x40b133
cmp word [eax], dx
je 0x40b133
lea eax, [ebp - 0x10]
push eax
call fcn.0040aa1a
jmp 0x40b13c
lea eax, [ebp - 0x10]
push eax
call fcn.0040aab5
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x40b1ac
mov eax, dword [0x41610c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x415e00
call fcn.0040b037
add esp, 0xc
test al, al
je 0x40b1ac
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x40b177
cmp word [eax], di
je 0x40b177
lea eax, [ebp - 0x10]
push eax
call fcn.0040aa1a
pop ecx
jmp 0x40b1ae
lea eax, [ebp - 0x10]
push eax
call fcn.0040aab5
jmp 0x40b174
mov eax, dword [edi]
test eax, eax
je 0x40b199
cmp word [eax], dx
je 0x40b199
lea eax, [ebp - 0x10]
push eax
call fcn.0040a9cf
pop ecx
jmp 0x40b1ac
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x40b277
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0040aebc
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40b277
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x40b277
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x40b277
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40b204
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0040bf0c
test ebx, ebx
je 0x40b272
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0040bf0c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40b277
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40b277
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0040e096
add esp, 0x10
xor eax, eax
inc eax
jmp 0x40b279
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004017cf
leave
ret