joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407444
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 6], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x40762a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x42db58
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [0x42db70]
cmp ax, word [ebp - 2]
jne 0x40749c
mov eax, dword [ebp - 6]
mov edx, 0x42db74
mov ecx, 0x55
call fcn.004060f8
push 0x42db58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x407614
push 0x42db58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [ebp - 6]
xor edx, edx
call fcn.00405f10
push 2
movzx eax, word [ebp - 2]
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4075dc
cmp byte [0x42db54], 0
je 0x407592
call dword [0x42db4c]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 2]
push eax
call dword [0x42db50]
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x40758b
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x42db48]
test al, al
je 0x407564
mov eax, dword [ebp - 0xc]
add eax, eax
call fcn.004040e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x42db48]
mov edx, dword [ebp - 0xc]
sub edx, 2
test edx, edx
jb 0x407559
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
jne 0x407555
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2], 0x2c
inc eax
dec edx
jne 0x407542
mov eax, dword [ebp - 6]
mov edx, dword [ebp - 0x10]
call fcn.004060bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4075dc
movzx eax, word [ebp - 0x16]
push eax
call dword [0x42db50]
cmp dword [ebp - 0x10], 0
je 0x40758a
mov eax, dword [ebp - 0x10]
call fcn.00404104
ret
mov edx, dword [ebp - 6]
movzx eax, word [ebp - 2]
call fcn.004072ac
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp ax, word [ebp - 2]
je 0x4075dc
mov eax, dword [ebp - 6]
cmp dword [eax], 0
je 0x4075c1
mov eax, dword [ebp - 6]
mov edx, 0x407644
call fcn.00406240
mov eax, dword [ebp - 6]
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x1c]
call fcn.004072ac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 6]
call fcn.00406240
mov eax, dword [ebp - 6]
push 0x42db58
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [ebp - 2]
mov word [0x42db70], ax
push 0xaa
mov eax, dword [ebp - 6]
mov eax, dword [eax]
call fcn.00405f9c
push eax
push 0x42db74
call sub.kernel32.dll_lstrcpynW
push 0x42db58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407631
lea eax, [ebp - 0x1c]
call fcn.00405f00
ret
Function at 0x407868
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ef8
xor eax, eax
push ebp
push 0x407a4d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4078a8
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x4078c2
push 0x105
mov eax, dword [ebp - 4]
call fcn.00405f9c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x407a37
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a5c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407951
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407951
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a90
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407951
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407ac4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x407a37
xor eax, eax
push ebp
push 0x407a30
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040766c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4079c0
mov eax, dword [ebp - 0x10]
call fcn.004040e8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004060bc
jmp 0x407a0b
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x407b04
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x407a0b
mov eax, dword [ebp - 0x10]
call fcn.004040e8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x407b04
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004060bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a37
cmp dword [ebp - 8], 0
je 0x407a26
mov eax, dword [ebp - 8]
call fcn.00404104
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a54
lea eax, [ebp - 4]
call fcn.00405f00
ret
Function at 0x407d18
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00405ef8
mov eax, dword [ebp - 0x21c]
call fcn.00405ef8
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x407eb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00405f10
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00405f9c
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x407db8
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x407dca
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x407db5
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x407e83
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x407df3
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00407868
cmp dword [ebp - 0x220], 0
je 0x407e2b
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00407c0c
pop ecx
mov ebx, eax
jmp 0x407e83
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.00407444
mov eax, dword [ebp - 0x224]
call fcn.00407c0c
pop ecx
mov ebx, eax
test bl, bl
jne 0x407e76
cmp byte [0x42db54], 0
jne 0x407e76
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.00407444
mov eax, dword [ebp - 0x228]
call fcn.00407c0c
pop ecx
mov ebx, eax
test bl, bl
jne 0x407e83
push ebp
call fcn.00407cbc
pop ecx
mov ebx, eax
test bl, bl
je 0x407e99
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004060f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ebe
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00405f08
ret

Function at 0x4082f4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40f844
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40f87d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040604c
jmp 0x40f886
mov eax, ebx
mov edx, esi
call fcn.00405f10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40f890
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40f8b2
movzx eax, word [esp]
jmp 0x40f8b4
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x410044
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x410169
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0040fe54
mov esi, eax
mov eax, dword [0x42aed0]
cmp byte [eax], 0
je 0x410111
mov eax, dword [0x42adf4]
call fcn.00404404
call fcn.00404230
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41001c]
call fcn.00406d10
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x410184
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41014d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x42add4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42dc3c]
call fcn.00406dc8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410170
lea eax, [ebp - 4]
mov edx, dword [0x41001c]
call fcn.00406d1c
ret

Function at 0x411d04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405b64
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x411cae
mov eax, edi
add eax, eax
call fcn.004040e8
mov esi, eax
jmp 0x411cb0
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x411ce9
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x411cd3
mov eax, esp
cmp esi, eax
je 0x411cf6
mov eax, esi
call fcn.00404104
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x411d30
cmp bl, 0
je 0x411d2c
cmp bl, 0x41
jl 0x411d27
cmp bl, 0x5a
jg 0x411d27
or bl, 0x20
xor al, bl
inc esi
jmp 0x411d0b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x411c70
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x42e000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x28c65c52
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x600c7fa3
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x417e3c
Capabilities:
Query or enumerate registry value

Disassembly:
inc esp
xor byte [eax + eax - 0x77], cl
adc eax, 0x4c3038
dec esp
invalid

Function at 0x417e44
Capabilities:
Query or enumerate registry value

Disassembly:
inc esp
xor byte [eax + eax - 0x77], cl
adc eax, 0x4c3038
dec esp
invalid

Function at 0x417e64
Capabilities:
Query or enumerate registry value

Disassembly:
and al, 4
xor esi, esi
push edx
push 0x20019
add al, byte [eax]
push esi
push str.CLSIDA80DB8A6_D8FF_11CF_9377_A00103B70AA1InprocServer32

Function at 0x417e6c
Capabilities:
Query or enumerate registry value

Disassembly:
push SysReAllocStringLen
mov dword [0x4c303c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417e89
xor eax, eax
pop esi
add esp, 8
ret 4
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov dword [0x4c6abc], eax

Function at 0x417e9c
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417ec0
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x4661fc
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
push edx
dec ecx
dec edx
dec eax
mov dword [ebx - 6], esi
call 0x9e15f6c9
or eax, 0xf290f28
sbb cl, bh
les ebp, [ecx - 0x5695cd5e]
movsb byte es:[edi], byte [esi]
push ecx
sub al, 0xda
dec esp
sbb ecx, esi
pop esp
cmp ah, cl
cmp bh, bh
leave
ror byte [esi + 0x43dac582], 0x8f
add byte [edx + 0x8e02084], 0x70
stc
aad 0x99
enter 0xf9f, 0xffffffffffffff9f
and bl, byte [ebx - 0x7fd6a54a]
invalid

Function at 0x47d2d8
Capabilities:
Encode data using xor

Disassembly:
xor edi, dword [edi]
aam 0xbd
test byte [ebp - 0x18], ch
xchg edi, eax
aas
push esp
cmp esi, eax
not byte [ebp + edx + 0x3c94d577]
pop ds
xor byte [esi + 0x30fd60a5], dh
loope 0x47d2f9
aad 0x93
pop ebp
rol dword [ebp + 0x44a88c88], 0x3b
add ah, ch
ret
push ecx
cli
cmpsb byte [esi], byte es:[edi]
mov ah, byte [ecx]
mov ch, 0x5d
in al, 0x31
xor dword [eax + 0x3df2e03e], ebp
cmpsb byte [esi], byte es:[edi]
xor eax, 0x9589c839
sub byte [ebp + 0x641922bb], ah
pop ds
mov bh, 0x7e
jno 0x47d328
xor eax, 0xf7a33531
cdq
add ebp, esp
xor dword [0xf399f7a3], esi
add ebp, esp
or edi, dword [edx + edx*4]
jle 0x47d2ab
imul ecx, dword [ecx + 0x38], 0xb28ac2b8
cmp esi, dword [ebp + ebx*4 + 0x65c77e38]
and ch, byte [ecx + 0x4ad4a464]
mov bh, 0x46
lea ebp, [eax + 0x1e]
mov dword [0x1c37376c], eax
mov dword [0xb5e315e2], eax
pop edx
mov ch, 0x5a
push ebp
lodsd eax, dword [esi]
invalid
Function at 0x4abfe8
Capabilities:
Encode data using xor

Disassembly:
int3
mov bl, 0x2a
dec ebp
add dl, byte [edi + 0x330676de]
adc ecx, dword [ebp - 0x28206b2f]
add dword [0x42d98381], esi
mov eax, dword [0x52a18514]
xor dword [ebp + edx - 0x56d20fa5], edx
and dword [ebx + 0x73b77038], esp
sbb dword [edi + eax*8 + 0x62], 0x32077e22
jne 0x4abfd2
pop edi
and byte [esi + edi*8 + 0x2bb7b0d2], 0x5f
inc edx
xor esp, dword [ecx - 0x5564d885]
rcl dword [esi + 0x14], cl
lds edx, [ebx - 0x69]
xor dl, byte [edx + 0x2b]
xor byte [edi], bh
xor ebp, dword [esi + eax + 0x60]
dec ebp
xor cl, al
fdivr qword [edx]
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
rol dword [ecx], cl
rcl byte [edi + ecx*8 + 0xe72587e]
pop esp
rol byte [ecx - 0xd], cl
div esi
add eax, 0x36b1ea59
mov dword [0x156356bf], eax
mov bl, 0x31
test byte [ecx + 0x6340c1fd], 0xb4
shr ebx, 0x56
and ch, byte [0xd8bcd7b4]
mov byte [0xd3a74322], al
cwde
inc esi
invalid

Function at 0x4af384
Capabilities:
Encode data using xor

Disassembly:
bnd ja 0x4af3dc
jne 0x4af3b2
movsb byte es:[edi], byte [esi]
mov dl, 0xd6
ljmp 0xfc29
pushfd
inc ecx
shl dh, 1
mov al, byte [0x1445093]
xchg esp, eax
and bl, byte [ebx - 0x63eb01ec]
inc esp
add dword [edx - 0x1ebe2e4], edx
adc al, 0x9c
push cs
int3
xor byte [ecx + 2], 0x52
push edx
xchg esp, eax
mov al, 0x90
add dword [edx - 4], 0x3e
cld
lodsb al, byte [esi]
pop esp
sbb byte [esi - 0x66], cl
pop ebp
out dx, eax
push 0x44633d81
adc byte [ebx - 2], dl
xchg ebx, eax
leave
push ss
sbb ah, byte [ecx - 0x771f4ff3]
fiadd dword [0x1bb3c0c9]
adc ebx, dword [ebx]
inc ebp
xor dh, byte [ebx + 0x5e40c0dc]
inc esi
loop 0x4af3df
mov word [esi - 0x4d], ds
inc eax
leave
popfd
push es
loopne 0x4af47a
loopne 0x4af3ab
adc esp, dword [ebp + 0x1d]
inc ecx
sub al, 0xee
sbb al, 0xa6
invalid
lodsb al, byte [esi]
std
xchg ecx, eax
jge 0x4af4b5
mov ebp, 0x88110674
jmp 0x4af3e3
jge 0x4af4c8
or eax, 0xdc1efe11
jno 0x4af450
push ds
fdiv qword [ecx - 0x2e]
loop 0x4af475
sbb dword [ebx + 0x39cc4303], 0x8ed1f75b
xor edx, dword [edx - 0x2d5e1675]
cmp al, 0xa4
xchg ebp, eax
xor al, 0x5c
int3
or al, 0xb1
cmpsd dword [esi], dword es:[edi]
sbb al, 0x45
add dh, cl
adc eax, 0x8105be59
adc dword [esi + 0x4d1842c1], 0xffffff9d
std
xchg ecx, eax
int3
Function at 0x4bb541
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3378
cmp edx, dword [eax]
je 0x4bb563
add eax, 8
inc ecx
cmp eax, 0x4c3408
jl 0x4bb554
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3378]
jne 0x4bb691
mov eax, dword [0x4c7d00]
cmp eax, 1
je 0x4bb66b
test eax, eax
jne 0x4bb594
cmp dword [0x4c32a0], 1
je 0x4bb66b
cmp edx, 0xfc
je 0x4bb691
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb5cb
lea eax, [ebp - 0x1a4]
push 0x4c0980
push eax
call fcn.004bbf20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc3b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb60e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc3b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c097c
push edi
call fcn.004be280
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0960
push eax
call fcn.004bbf20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbf30
lea eax, [ebp - 0xa0]
push 0x4c095c
push eax
call fcn.004bbf30
push dword [esi + 0x4c337c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbf30
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0934
push eax
call fcn.004be1f4
add esp, 0x2c
pop edi
jmp 0x4bb691
lea eax, [ebp + 8]
lea esi, [esi + 0x4c337c]
push 0
push eax
push dword [esi]
call fcn.004bc3b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4011a2
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x41ae67
call fcn.00418d60
sub esp, 0x40
mov eax, dword [0x428480]
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
xor eax, ebp
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [ebp - 4], edi
lea ecx, [esi + 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x4c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x68]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [ebp - 4], 3
lea ecx, [esi + 0x84]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [ebp - 4], 4
lea eax, [ebp - 0x4c]
push eax
call fcn.0040cc15
mov byte [ebp - 4], 5
mov dword [esp], str.XLBugHandler.dll
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00401149
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x401294
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._XL_SetBugReportRootDir_4
push ebx
call edi
push str._XL_InitBugHandler_20
push ebx
mov dword [esi], eax
call edi
push str._XL_SetPeerID_4
push ebx
mov dword [esi + 4], eax
call edi
push str._XL_SetReportShowMode_4
push ebx
mov dword [esi + 8], eax
call edi
push str._XL_SetAlwaysSendReport_4
push ebx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418e11
leave
ret
Function at 0x401dc3
Capabilities:
Execute shellcode via indirect call
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x4284e4], 0
push esi
push edi
je 0x401e49
and dword [ebp - 8], 0
push eax
mov eax, dword fs:[0x18]
mov eax, dword ds:[eax + 0x30]
mov eax, dword ds:[eax + 0x2c]
mov dword [ebp - 8], eax
pop eax
mov eax, dword [0x4284e8]
and dword [ebp - 4], 0
cmp eax, 1
je 0x401dfd
cmp eax, 2
jne 0x401e01
push 0x42
jmp 0x401e08
cmp eax, 3
jne 0x401e49
push 0x41
mov ecx, dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop eax
lea esi, [ecx + eax*4]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
je 0x401e49
push str._A360__Begin_to_unhook
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4284e4]
mov dword [esi], eax
and dword [0x4284e4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call edi
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0x401f4e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Print debug messages

Disassembly:
push 0x41e888
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp fcn.00401dc3