joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6a80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x4c6ac8
mov eax, dword [0x5400d0]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x164]
cmp eax, dword [edx + 0x28]
jne 0x4c6ac8
mov eax, dword [0x5400d0]
cmp byte [eax + 0x110], 0
jne 0x4c6ac8
mov eax, dword [0x5404a0]
mov edx, dword [0x5404a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x5404a0]
mov edx, dword [0x5404a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x4c6bbe
mov eax, dword [0x5400d0]
cmp byte [eax + 0x110], 0
jne 0x4c6bbe
mov eax, dword [0x5404a0]
mov edx, dword [0x5404a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00526450
mov eax, dword [0x5400d0]
cmp dword [eax + 0x164], 0
je 0x4c6b83
push 0x10
push 0
mov eax, dword [0x5400d0]
mov eax, dword [eax + 0x164]
push dword [eax + 0x240]
mov eax, dword [0x5400d0]
mov eax, dword [eax + 0x164]
push dword [eax + 0x234]
mov eax, dword [0x5400d0]
mov eax, dword [eax + 0x164]
push dword [eax + 0x12c]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5400d0]
mov eax, dword [eax + 0x164]
call fcn.004e4520
test al, al
je 0x4c6b83
push 0
mov eax, dword [0x5400d0]
call fcn.0041e6a0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5400d0]
call fcn.00421450
jmp 0x4c6c55
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4c6c13
mov eax, dword [ebp - 4]
mov edx, dword [0x5400d0]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x164]
jne 0x4c6c13
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5400d0]
call fcn.00421450
jmp 0x4c6c55
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4c6c55
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x460], 8
je 0x4c6c55
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5404a0]
mov edx, dword [0x5404a0]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
leave
ret
Function at 0x4cba90
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.004ca4b0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.004122d0
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x5a42b0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4cbae6
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4cbb5e
or dword [ebp - 0x30], 0x800
cmp dword [0x557830], 6
jb 0x4cbb38
or dword [ebp - 0x30], 0x20000
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret

Function at 0x4cca90
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4ccb3d
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4ccb3d
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x4ccb1f
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040d760
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4ccb39
call fcn.0040d890
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4cd200
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x4cd36b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4cd306
lea eax, [ebp - 0x40]
call fcn.00403a50
lea eax, [ebp - 0x44]
call fcn.00403a50
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.00464480
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
call fcn.00408a00
lea eax, [ebp - 0x44]
call fcn.00403a50
lea eax, [ebp - 0x54]
call fcn.00403a50
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.00464430
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
call fcn.00408a00
call fcn.00471d00
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.00472fe0
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4cd36b
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x4cd349
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040d760
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4cd360
call fcn.0040d890
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040d760
lea eax, [ebp - 0x54]
call fcn.00403a50
lea eax, [ebp - 0x44]
call fcn.00403a50
lea eax, [ebp - 0x40]
call fcn.00403a50
pop eax
test eax, eax
je 0x4cd392
call fcn.0040d890
pop ebx
leave
ret
Function at 0x526830
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x5268c1
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a700
cmp dword [ebp - 0xc], 0
jbe 0x5268a0
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x526894
mov eax, 0x5a42e0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a700
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040ae90
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.00428b00
call fcn.0040d760
lea eax, [ebp - 0x3c]
call fcn.0040ac70
lea eax, [ebp - 0x10]
call fcn.0040a160
pop eax
test eax, eax
je 0x5268e0
call fcn.0040d890
leave
ret
Function at 0x53e9a0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1408]
mov dword [esp + 0x40c], eax
push eax
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x140c], 0
mov dword [ebp - 0x1408], 0
mov dword [ebp - 0x1404], 0
mov dword [ebp - 0x1400], 0
mov dword [ebp - 0x13fc], 0
mov dword [ebp - 0x13f8], 0
mov eax, 1
lea edx, [ebp - 0x13c8]
lea ecx, [ebp - 0x13b0]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x53eb77
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.00408a00
mov eax, 1
lea edx, [ebp - 0x13f0]
lea ecx, [ebp - 0x13d8]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x53eb4e
push 0
push 0
push 0
push 0
push dword [ebp - 4]
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0x80000000
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
lea esi, [esi]
lea eax, [ebp - 0x13a4]
push eax
push 0x1389
lea eax, [ebp - 0x13a0]
push eax
push dword [ebp - 0x14]
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x53eb72
lea eax, [ebp - 0x13fc]
call fcn.0040ac70
lea eax, [ebp - 0x1404]
push eax
push 1
lea eax, [ebp - 0x1408]
push eax
lea eax, [ebp - 0x13a0]
mov cx, 0
mov edx, 0x1388
call fcn.004093c0
mov eax, dword [ebp - 0x1408]
mov ecx, dword [ebp - 0x13a4]
mov edx, 1
call fcn.004097f0
mov eax, dword [ebp - 0x1404]
lea edx, [ebp - 0x1400]
call fcn.0040c200
mov ebx, dword [ebp - 0x1400]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
lea edx, [ebp - 0x140c]
call fcn.0040adf0
mov edx, dword [ebp - 0x140c]
lea eax, [ebp - 0x13fc]
mov ecx, ebx
call fcn.0040af60
mov eax, dword [ebp - 0x13fc]
lea ecx, [ebp - 0x13f8]
mov dx, 0
call fcn.0040ad80
mov edx, dword [ebp - 0x13f8]
mov eax, dword [ebp - 0xc]
call fcn.00408a00
cmp dword [ebp - 0x13a4], 0
jne 0x53ea7c
call fcn.0040d760
push dword [ebp - 0x10]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 0x14]
call sub.wininet.dll_InternetCloseHandle
pop eax
test eax, eax
je 0x53eb77
cmp eax, 2
je 0x53eb77
call fcn.0040d890
pop eax
push 2
jmp 0x53eb4e
call fcn.0040d760
lea eax, [ebp - 0x140c]
call fcn.0040ac70
lea eax, [ebp - 0x1408]
call fcn.00403a50
lea eax, [ebp - 0x1404]
call fcn.00403a50
lea eax, [ebp - 0x1400]
call fcn.0040ac70
lea eax, [ebp - 0x13fc]
call fcn.0040ac70
lea eax, [ebp - 0x13f8]
call fcn.00403a50
pop eax
test eax, eax
je 0x53ebc8
call fcn.0040d890
pop ebx
leave
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4490629f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..reloc
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x41ac392f
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x11b13a6d
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x6d8813bb
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x30b46701
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x536f1e89
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x296f04f6
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x400a4e66
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000711b
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100208bc
call fcn.1001fbd0
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov esi, 0x400
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.1001fe60
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cdq
mov dword [ebp - 0x1c], eax
sub ecx, eax
mov eax, edi
push ebx
sbb eax, edx
push esi
push eax
push ecx
mov dword [ebp - 0x18], edx
call fcn.1001fdb0
cdq
mov ecx, esi
push ebx
idiv ecx
mov ecx, dword [ebp + 8]
push 0x100000
mov eax, edx
mov dword [ebp - 0x14], eax
shl eax, 0xa
cdq
sub ecx, eax
mov eax, edi
sbb eax, edx
sub ecx, dword [ebp - 0x1c]
sbb eax, dword [ebp - 0x18]
push eax
push ecx
call fcn.1001fdb0
cdq
mov ecx, esi
push ebx
idiv ecx
push 0x40000000
push edi
push dword [ebp + 8]
mov dword [ebp - 0x18], edx
call fcn.1001fdb0
mov edi, eax
lea eax, [ebp + 0xc]
push 3
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x100071c8
lea eax, [ebp + 0xc]
push 0x1002a564
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp edi, ebx
jne 0x1000728e
mov eax, 0x3e7
cmp dword [ebp - 0x18], eax
jg 0x1000728e
cmp dword [ebp - 0x18], ebx
jne 0x10007256
cmp dword [ebp - 0x14], eax
jg 0x10007256
cmp dword [ebp - 0x14], ebx
je 0x10007228
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x3e8
cdq
idiv esi
cmp byte [0x1002c5ec], bl
mov esi, eax
jne 0x1000720d
mov ecx, 0x1002c4c0
call fcn.10006a28
push dword [0x1002c56c]
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x14]
jmp 0x100072c2
cmp byte [0x1002c5ec], bl
jne 0x1000723a
mov ecx, 0x1002c4c0
call fcn.10006a28
push dword [0x1002c578]
push dword [ebp - 0x20]
push str._d___s
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x100072d3
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x3e8
cdq
idiv esi
cmp byte [0x1002c5ec], bl
mov esi, eax
jne 0x10007276
mov ecx, 0x1002c4c0
call fcn.10006a28
push dword [0x1002c560]
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x18]
jmp 0x100072c2
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x3e8
cdq
idiv esi
cmp byte [0x1002c5ec], bl
mov esi, eax
jne 0x100072ae
mov ecx, 0x1002c4c0
call fcn.10006a28
push dword [0x1002c554]
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push str._d_s_02d___s
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10008a73
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x10020b81
call fcn.1001fbd0
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [edi + 0x48]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0xb
call esi
push dword [edi + 0x40]
call esi
lea ecx, [edi + 0x30]
call fcn.100024c3
push dword [edi + 0x2c]
call esi
push dword [edi + 0x28]
call esi
push dword [edi + 0x24]
call esi
push dword [edi + 0x20]
call esi
push dword [edi + 0x1c]
call esi
push dword [edi + 0x18]
call esi
push dword [edi + 0x14]
call esi
push dword [edi + 0x10]
call esi
push dword [edi + 0xc]
call esi
push dword [edi + 8]
call esi
push dword [edi + 4]
call esi
push dword [edi]
call esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10008c01
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
call fcn.10008b77
test eax, eax
je 0x10008c6e
lea eax, [ebp - 0x108]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
mov byte [ebp - 5], bl
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x10008c5b
inc eax
push str.explorer.exe
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x10008c6e
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x10008c71
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebx
leave
ret
Function at 0x10008f28
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x10020ba4
call fcn.1001fbd0
sub esp, 0x7e8
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 9
mov esi, ecx
push ebx
push str.SoftwareDownloadManagerDwnlSelPanel
push SysReAllocString
mov byte [esi + 0x10], 1
mov dword [ebp - 4], ebx
mov dword [esi + 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009062
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push str.PanelMode
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10008f98
mov eax, dword [ebp - 0x24]
mov dword [esi + 4], eax
cmp dword [esi + 4], 3
jne 0x10009059
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10009059
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10009059
mov dword [esi + 0xc], eax
shl eax, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [esi + 8], eax
je 0x10009059
xor eax, eax
cmp eax, dword [esi + 0xc]
jge 0x10008ff0
mov ecx, dword [esi + 8]
mov dword [ecx + eax*4], ebx
inc eax
jmp 0x10008fe2
xor edi, edi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jne 0x10009059
cmp edi, dword [esi + 0xc]
je 0x10009059
lea eax, [ebp - 0x7f4]
push 0x7d0
push eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x10009050
lea eax, [ebp - 0x7f4]
push eax
call sub.MSVCRT.dll_strlen
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
pop ecx
mov ecx, dword [esi + 8]
mov dword [ecx + edi*4], eax
mov eax, dword [esi + 8]
mov eax, dword [eax + edi*4]
cmp eax, ebx
je 0x10009050
lea ecx, [ebp - 0x7f4]
push ecx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
inc edi
jmp 0x10008ff5
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret