joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417b10
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5976b8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x417b55
push 0x53f268
push 4
push eax
call fcn.00515853
push eax
call fcn.004014c0
add esp, 0x10
jmp 0x417b6b
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x417beb
push edi
call fcn.005167a2
mov edi, dword [eax]
call fcn.005167a2
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00515c6f
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.005167a2
cmp dword [eax], 0
je 0x417bbf
call fcn.005167a2
push dword [eax]
call fcn.00415a68
pop ecx
jmp 0x417bc6
call fcn.005167a2
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x417beb
cmp dword [ebp - 0x234], esi
jae 0x417beb
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x417bed
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00514990
leave
ret
Function at 0x41812c
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5976b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.0041808d
pop ecx
cmp eax, esi
je 0x418216
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x418216
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.005149a0
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x418216
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x418216
cmp esi, 0x14
jge 0x418216
push 0x10
push 0
push edi
call fcn.00514e0b
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x418205
call fcn.005167a2
cmp dword [eax], 0x22
je 0x418205
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.00516fb2
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x4181db
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x598cdc], 0
jne 0x4182a1
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x4182ca
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.00417b10
pop ecx
pop ecx
test eax, eax
jne 0x4182cc
inc edi
cmp edi, esi
jl 0x4182a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00514990
leave
ret 8
Function at 0x41aecf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41af17
call fcn.00417a8d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41af17
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41af5a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41af43
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41af43
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41af57
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x423cef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x423d36
call fcn.00417a8d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x423d36
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x423d52
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004237ef
mov esi, eax
test edi, edi
je 0x423d50
test ebx, ebx
je 0x423d50
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42494a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x530c2e
call fcn.00516e7e
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x42496f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4249c1
call fcn.004170fe
push eax
lea ecx, [ebp - 0x10]
call fcn.00403680
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00516051
push eax
call fcn.004014c0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401760
mov eax, esi
call fcn.00516f56
ret 8
Function at 0x425d56
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004259fa
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x425da0
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416c42
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040f130
jmp 0x425dab
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042b67d
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x425db1
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0042423c
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x425dee
call fcn.004259fa
mov dword [esi + 0xc], 1
jmp 0x425df3
call fcn.004259fa
cmp dword [esi], 0
je 0x425e3c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x425e14
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00416c42
jmp 0x425e26
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00403810
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040f130
jmp 0x425e60
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x425e60
push dword [esi]
push dword [ebp + 8]
call fcn.0042b67d
pop esi
pop ebp
ret 0xc

Function at 0x4268cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00417a8d
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x426905
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00426509
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x426963
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x426987
cmp dword [edi + 0x74], 0
jne 0x426987
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00417a8d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00426924
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x429c02
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5976b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x429c37
xor eax, eax
jmp 0x429c8a
lea eax, [ebp - 0x210]
push eax
call fcn.00516fb2
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x429c68
push 0x53ddc4
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005164d9
add esp, 0xc
test eax, eax
jne 0x429c33
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005164d9
add esp, 0xc
test eax, eax
jne 0x429c33
lea eax, [ebp - 0x210]
push eax
call fcn.0041808d
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00514990
leave
ret

Function at 0x4a1d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4a1d5a
call fcn.00417a8d
mov esi, dword [eax + 0xc]
push dword [0x59cb44]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4a1d78
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4a1d70
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4a1da5
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4a1d72
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004a1c6e
mov esi, eax
jmp 0x4a1d97

Function at 0x4f1dc7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00422282
call fcn.00418113
cmp eax, esi
pop esi
jne 0x4f1de3
mov ecx, 0x59aa68
jmp fcn.0042a8a9
ret
Function at 0x4f56dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4f56f5
mov edi, dword [esi + 0xc]
jmp 0x4f5735
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4f570e
call fcn.0041c597
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4f5723
call fcn.0041c597
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4f5735
call fcn.0041c597
call fcn.00417a8d
cmp dword [eax + 0x3c], 0
je 0x4f574a
push edi
mov ecx, ebx
call fcn.004f4591
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004f55f7
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4f5768
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f5774
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x514990
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5976b8]
jne 0x51499a
repz ret
jmp fcn.0051bfd8
Function at 0x5269b8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5976b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0051b8fb
and dword [ebp - 0x14], 0
cmp dword [0x59f178], 0
mov dword [ebp - 0x18], eax
jne 0x526a6b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x526b13
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x566ba8
push ebx
call edi
test eax, eax
je 0x526b13
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x566b98
push ebx
mov dword [0x59f178], eax
call edi
push eax
call esi
push 0x566b84
push ebx
mov dword [0x59f17c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x59f180], eax
call edi
push eax
call esi
mov dword [0x59f188], eax
test eax, eax
je 0x526a6b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x59f184], eax
mov eax, dword [0x59f184]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x526ac4
cmp dword [0x59f188], ecx
je 0x526ac4
push eax
call esi
push dword [0x59f188]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x526ac4
test ebx, ebx
je 0x526ac4
call edi
test eax, eax
je 0x526abb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x526abb
test byte [ebp - 8], 1
jne 0x526ac4
or dword [ebp + 0x10], 0x200000
jmp 0x526af7
mov eax, dword [0x59f17c]
cmp eax, dword [ebp - 0x18]
je 0x526af7
push eax
call esi
test eax, eax
je 0x526af7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x526af7
mov eax, dword [0x59f180]
cmp eax, dword [ebp - 0x18]
je 0x526af7
push eax
call esi
test eax, eax
je 0x526af7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x59f178]
call esi
test eax, eax
je 0x526b13
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x526b15
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00514990
leave
ret
Function at 0x1002fab
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10012b0
call fcn.01003148
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002fe6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002fe6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002ffe
cmp eax, 0x20b
je 0x1002feb
mov dword [ebp - 0x1c], edi
jmp 0x1003012
cmp dword [ecx + 0x84], 0xe
jbe 0x1002fe6
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100300c
cmp dword [ecx + 0x74], 0xe
jbe 0x1002fe6
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004034], 0xffffffff
or dword [0x1004038], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004030]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100402c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100403c], eax
call fcn.01003144
cmp dword [0x100401c], edi
jne 0x100306d
push fcn.01003144
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003132
push 0x10011a8
push 0x10011a4
call sub.msvcrt.dll__initterm
mov eax, dword [0x1004028]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1004024]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10011a0
push 0x100119c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002f3c
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x10030e4
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1003119
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003181
ret
Function at 0x415520
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xca
or dword [edx - 0x22d172e8], edi
idiv dword [edi + 0x78]
or dh, ch
mov dl, 0xd3
xchg dword [ecx + edi*2], edi
add dh, byte [ecx - 0x45]
ret 0x2795
lodsb al, byte [esi]
mov cl, 0x37
rcl edx, 0x8b
leave
or eax, 0xe34b82ce
adc eax, 0xf01afabf
cli
sbb dh, al
mov edi, 0x65f01afa
inc esi
cli
sbb dh, al
inc esi
aas
jns 0x4154e7
test dword [edx - 0x18d10037], esp
jbe 0x41559c
xchg esp, eax
push cs
mov edi, 0xd17b6e92
sub byte [esi + 5], dl
lock sbb dword [esi + esi*8 - 5], esi
mov cs, edi
cli
pop ds
mov edx, 0xdde81294
lock adc byte [eax - 0x6c4ef6e0], 0
scasb al, byte es:[edi]
jecxz 0x415512
dec esi
jecxz 0x41551f
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
mov esp, dword [esi - 2]
pop esp
pop eax
into
lodsd eax, dword [esi]
xchg edi, eax
inc ebx
ljmp 0x86d9
or dword [esi - 0xe1b0ea5], 0xa61f02ca
imul eax, dword [esi + 0x6e58d8df], 0xe02eebc3
sti
ret
loopne 0x415582
sub al, 0xbe
mov byte [0xb10da5ab], al
pop ecx
xchg esp, eax
int1
mov eax, dword [0xe7dcdfbe]
lahf
insd dword es:[edi], dx
dec ebp
dec eax
lcall 0x95a9, 0xe5e365d7
aas
stc
mul bl
xor dword [edi + ebp], eax
jecxz 0x415584
test eax, 0xf6f93f95
jecxz 0x4155d7
add al, 0x2f
sbb byte [edx], 0x74
cmp dword [edx], ecx
and al, 0x1b
xor bh, ah
stosb byte es:[edi], al
daa
mov esi, 0x5b3c4c30
dec ecx
xor dword [ebx + 0x7d], edx
mov byte [0xb3714ab8], al
insd dword es:[edi], dx
retf 0xdccb
sahf
shl edx, 5
loop 0x4155e0
je 0x415572
and ebp, dword [ecx]
jbe 0x4155f5
adc al, 0x2c
cdq
sub al, 0x99
xor byte [edx], dl
mov ebx, 0x1b6a6516
insd dword es:[edi], dx
add ebx, dword ss:[edx]
jecxz 0x4155d9
xor ecx, ebp
cmp dh, byte [eax + 0x3c]
mov dword [0x873a3d79], eax
adc eax, 0x7ca39ec
outsd dx, dword [esi]
pushal
fiadd word cs:[eax + 0x71]
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
loop 0x4155e3
mov dword [ecx - 0x61a963ac], ebx
sahf
lds ecx, [edi + ecx - 0x2f]
scasd eax, dword es:[edi]
lds ebx, [eax + 0x34423415]
push ds
je 0x41564e
jno 0x415699
pop ebp
pop ds
inc ecx
jmp 0x41560e
and byte [esi + 0x77], cl
or eax, 0x58fc9ebe
cmp ecx, dword [ebx - 0x16]
invalid
pop edx
int 0xe4
out 0xd5, eax
insb byte es:[edi], dx
outsd dx, dword [esi]
clc
out 0xe9, al
aaa
vdivps ymm6, ymm5, ymm5
mov cl, 0x96
mov byte [0xa2b20af1], al
fmul st(1)
pop edi
imul esp, dword [ebx + 0x7a], 0xffffffeb
inc eax
cwde
call 0xa3ed3dcb
out dx, eax
jmp 0x415672
Function at 0x419b88
Capabilities:
Encode data using xor

Disassembly:
and byte [ebx - 0x6be2a20b], cl
lea eax, [ecx + 5]
xchg edi, eax
dec ebp
and dword [esi + esi], 0xdf9557ed
jno 0x419abf
mov edx, 0x7e695f2b
insb byte es:[edi], dx
bound eax, qword [ecx]
int1
or bh, byte [edi - 0x2be91bde]
mov cl, 5
sub dl, ah
nop
test cl, ch
je sym.C12VENTW.dll__MnuArcRub_qqsv
lds edi, [edx + 0x375c2747]
adc eax, 0x75cc46eb
fxch st(1)
xor eax, 0xf259f505
inc edi
cmp ebp, dword [ebp + 0x51eb4f94]
pop dword [ecx - 0x35]
lahf
out dx, al
invalid
stc
jnp 0x419bf1
push es
mov byte [0x58917bfb], al
pop eax
pop esi
not byte [eax]
dec edi
add al, ch
pushal
cmp edx, dword [ebp + 0x5f]
lodsb al, byte [esi]
bound edx, qword [ebx + 0x3b]
jns 0x419b21
pop ds
cmc
cli
sub ebx, 0x9d9df872
or edx, dword [edx]
push ss
test dword [ebp + 0x36e779c1], edi
mov byte [0x7e40dab7], al
out dx, eax
salc
cmp al, 0x56
sbb bl, ah
and eax, 0x65b851af
popfd
mov ebx, 0x7f87ca90
xor byte [ecx + 0x22], dl
adc ch, cl
je 0x419bc2
imul esp, dword [ebx + ebp], 0x978937
les ebx, [eax + ecx*4 - 0x17f935f2]
invalid

Function at 0x4205e0
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
std
fdivr st(5)
in eax, dx
jecxz 0x4205df
add dword [ebx + 0x41], ebx
stosd dword es:[edi], eax
pushal
int3
Function at 0xf4bb6c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xf4bb72
ret

Function at 0xf5b264
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x437015
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00f29440
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43702c
call fcn.00f2909c
mov eax, ebx
call fcn.00f499d0
mov edi, eax
dec edi
test edi, edi
jl 0xf5b31c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00f499a4
mov edx, dword [0x466454]
call fcn.00f2816c
test al, al
je 0xf5b318
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00f499a4
lea edx, [ebp - 0x14]
call fcn.00f9677c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00f29440
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00f29110
inc esi
dec edi
jne 0xf5b2ca
mov al, byte [0x437030]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43703c
mov eax, dword [ebp - 0xc]
call fcn.00f327b0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00f28e28
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00f9677c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00f9677c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x437048
call fcn.00f2e820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43701c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00f28db4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00f28db4
lea eax, [ebp - 0x14]
call fcn.00f28d90
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00f28db4
ret