joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ac50
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1824
call fcn.10039730
mov eax, dword [0x100664a0]
xor eax, ebp
mov dword [ebp - 0x1010], eax
mov ax, word [0x10057950]
mov word [ebp - 0x1810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x180e]
push ecx
call fcn.10035ff0
add esp, 0xc
mov dword [ebp - 0x1004], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1818]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1004adee
mov edx, dword [ebp - 0x1818]
shr edx, 2
mov dword [ebp - 0x1814], edx
mov dword [ebp - 0x181c], 0
jmp 0x1004acf5
mov eax, dword [ebp - 0x181c]
add eax, 1
mov dword [ebp - 0x181c], eax
mov ecx, dword [ebp - 0x181c]
cmp ecx, dword [ebp - 0x1814]
jae 0x1004adee
mov edx, dword [ebp - 0x181c]
mov eax, dword [ebp + edx*4 - 0x1000]
push eax
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0
je 0x1004ade9
push 0x400
lea ecx, [ebp - 0x1810]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov dword [ebp - 0x1820], eax
cmp dword [ebp - 0x1820], 0
jbe 0x1004add2
xor eax, eax
mov ecx, dword [ebp - 0x1820]
mov word [ebp + ecx*2 - 0x1810], ax
push 0x5c
lea edx, [ebp - 0x1810]
push edx
call fcn.100059d0
add esp, 8
mov dword [ebp - 0x1824], eax
cmp dword [ebp - 0x1824], 0
jne 0x1004ad9a
lea eax, [ebp - 0x1810]
mov dword [ebp - 0x1824], eax
jmp 0x1004ada9
mov ecx, dword [ebp - 0x1824]
add ecx, 2
mov dword [ebp - 0x1824], ecx
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x1824]
push eax
call fcn.10037c10
add esp, 8
test eax, eax
jne 0x1004add2
push 0
mov ecx, dword [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1004], 0
jmp 0x1004ace6
mov eax, dword [ebp - 0x1008]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b40
xor eax, eax
mov ecx, dword [ebp - 0x1010]
xor ecx, ebp
call fcn.100350e4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004ae20
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x182c
call fcn.10039730
mov eax, dword [0x100664a0]
xor eax, ebp
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x100c], 0xffffffff
mov ax, word [0x100578e8]
mov word [ebp - 0x1818], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x1816]
push ecx
call fcn.10035ff0
add esp, 0xc
mov dword [ebp - 0x1004], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1820]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1004afce
mov edx, dword [ebp - 0x1820]
shr edx, 2
mov dword [ebp - 0x181c], edx
mov dword [ebp - 0x1824], 0
jmp 0x1004aecf
mov eax, dword [ebp - 0x1824]
add eax, 1
mov dword [ebp - 0x1824], eax
mov ecx, dword [ebp - 0x1824]
cmp ecx, dword [ebp - 0x181c]
jae 0x1004afce
mov edx, dword [ebp - 0x1824]
mov eax, dword [ebp + edx*4 - 0x1000]
push eax
push 0
push 0x100410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0
je 0x1004afc9
push 0x400
lea ecx, [ebp - 0x1818]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov dword [ebp - 0x1828], eax
cmp dword [ebp - 0x1828], 0
jbe 0x1004afb2
xor eax, eax
mov ecx, dword [ebp - 0x1828]
mov word [ebp + ecx*2 - 0x1818], ax
push 0x5c
lea edx, [ebp - 0x1818]
push edx
call fcn.100059d0
add esp, 8
mov dword [ebp - 0x182c], eax
cmp dword [ebp - 0x182c], 0
jne 0x1004af74
lea eax, [ebp - 0x1818]
mov dword [ebp - 0x182c], eax
jmp 0x1004af83
mov ecx, dword [ebp - 0x182c]
add ecx, 2
mov dword [ebp - 0x182c], ecx
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x182c]
push eax
call fcn.10037c10
add esp, 8
test eax, eax
jne 0x1004afb2
mov ecx, dword [ebp - 0x1824]
mov edx, dword [ebp + ecx*4 - 0x1000]
mov dword [ebp - 0x100c], edx
jmp 0x1004afce
mov eax, dword [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1004], 0
jmp 0x1004aec0
mov ecx, dword [ebp - 0x1008]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 0x1014]
xor ecx, ebp
call fcn.100350e4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004b520
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0xc], eax
push 2
push 4
lea edx, [ebp + 0x18]
push edx
push 4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
test eax, eax
sete dl
mov byte [ebp - 5], dl
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1004b5a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0xd], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x14], eax
push 0
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.100353e8
add esp, 4
mov dword [ebp - 4], eax
push 2
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
test eax, eax
sete dl
mov byte [ebp - 0xd], dl
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1004b830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x203c
call fcn.10039730
mov eax, dword [0x100664a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2018], 0
mov dword [ebp - 0x2010], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x2020], eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x201c], eax
mov dword [ebp - 0x2014], 0x2000
mov dword [ebp - 0x200c], 0
xor edx, edx
mov word [ebp - 0x2008], dx
push 0
push 0x10057960
push 0
lea eax, [ebp - 0x2014]
push eax
lea ecx, [ebp - 0x2008]
push ecx
lea edx, [ebp - 0x200c]
push edx
mov eax, dword [ebp - 0x201c]
push eax
mov ecx, dword [ebp - 0x2020]
push ecx
call sub.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jl 0x1004ba41
cmp dword [ebp - 0x200c], 7
jne 0x1004ba41
mov dword [ebp - 0x2028], 0
mov dword [ebp - 0x2034], 0
jmp 0x1004b90b
mov edx, dword [ebp - 0x2034]
add edx, 1
mov dword [ebp - 0x2034], edx
mov eax, dword [ebp - 0x2014]
shr eax, 1
sub eax, 1
cmp dword [ebp - 0x2034], eax
jae 0x1004b941
mov ecx, dword [ebp - 0x2034]
movzx edx, word [ebp + ecx*2 - 0x2008]
test edx, edx
jne 0x1004b93f
mov eax, dword [ebp - 0x2028]
add eax, 1
mov dword [ebp - 0x2028], eax
jmp 0x1004b8fc
push str.java_lang_String
mov ecx, dword [ebp + 8]
call fcn.10002fe0
mov dword [ebp - 0x2030], eax
push 0
mov ecx, dword [ebp - 0x2030]
push ecx
mov edx, dword [ebp - 0x2028]
push edx
mov ecx, dword [ebp + 8]
call fcn.100030e0
mov dword [ebp - 0x2018], eax
mov dword [ebp - 0x202c], 0
mov dword [ebp - 0x2024], 0
mov dword [ebp - 0x2038], 0
jmp 0x1004b9a1
mov eax, dword [ebp - 0x2038]
add eax, 1
mov dword [ebp - 0x2038], eax
mov ecx, dword [ebp - 0x2014]
shr ecx, 1
sub ecx, 1
cmp dword [ebp - 0x2038], ecx
jae 0x1004ba41
mov edx, dword [ebp - 0x202c]
cmp edx, dword [ebp - 0x2028]
jge 0x1004ba41
mov eax, dword [ebp - 0x2038]
movzx ecx, word [ebp + eax*2 - 0x2008]
test ecx, ecx
jne 0x1004ba3c
mov edx, dword [ebp - 0x2038]
sub edx, dword [ebp - 0x2024]
push edx
mov eax, dword [ebp - 0x2024]
lea ecx, [ebp + eax*2 - 0x2008]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100030b0
mov dword [ebp - 0x203c], eax
mov edx, dword [ebp - 0x203c]
push edx
mov eax, dword [ebp - 0x202c]
push eax
mov ecx, dword [ebp - 0x2018]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10003110
mov edx, dword [ebp - 0x2038]
add edx, 1
mov dword [ebp - 0x2024], edx
mov eax, dword [ebp - 0x202c]
add eax, 1
mov dword [ebp - 0x202c], eax
jmp 0x1004b992
mov ecx, dword [ebp - 0x201c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov eax, dword [ebp - 0x2020]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov eax, dword [ebp - 0x2018]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100350e4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004ba80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x100664a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x81c], eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b10
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x80c], 0
xor edx, edx
mov word [ebp - 0x808], dx
push 0
push 0x10057954
push 0
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x808]
push ecx
lea edx, [ebp - 0x80c]
push edx
mov eax, dword [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x81c]
push ecx
call sub.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jl 0x1004bbed
mov edx, dword [ebp - 0x80c]
mov dword [ebp - 0x824], edx
cmp dword [ebp - 0x824], 1
je 0x1004bb4c
cmp dword [ebp - 0x824], 2
je 0x1004bb6f
cmp dword [ebp - 0x824], 4
je 0x1004bb94
jmp 0x1004bbed
mov eax, dword [ebp - 0x814]
shr eax, 1
sub eax, 1
push eax
lea ecx, [ebp - 0x808]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100030b0
mov dword [ebp - 0x810], eax
jmp 0x1004bbed
mov edx, dword [ebp - 0x814]
shr edx, 1
sub edx, 1
push edx
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp + 8]
call fcn.100030b0
mov dword [ebp - 0x810], eax
jmp 0x1004bbed
push 4
lea ecx, [ebp - 0x808]
push ecx
lea edx, [ebp - 0x820]
push edx
call fcn.10035c10
add esp, 0xc
mov eax, dword [ebp - 0x820]
push eax
push 0x10057958
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
call fcn.100353e8
add esp, 4
push eax
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp + 8]
call fcn.100030b0
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x818]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov eax, dword [ebp - 0x81c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002b40
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100350e4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004c310
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1004c333
xor al, al
jmp 0x1004c41d
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 0x24
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x24]
push ecx
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov byte [ebp - 0x3d], 1
mov dword [ebp - 0x44], 0x1e
mov dword [ebp - 0x3c], 0x1e
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0
je 0x1004c3a7
cmp dword [ebp - 0x48], 1
je 0x1004c3c3
cmp dword [ebp - 0x48], 2
je 0x1004c3df
jmp 0x1004c3fe
mov eax, dword [ebp - 0x2c]
add eax, 0x21
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp + 0xc]
sub edx, 0x21
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], edx
jmp 0x1004c41b
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp + 8]
sub ecx, 0x21
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp - 0x28]
add eax, 0x21
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
jmp 0x1004c41b
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp + 8]
sub edx, 0x21
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp + 0xc]
add ecx, 0x1b
mov edx, dword [ebp + 0x10]
mov dword [edx + 4], ecx
jmp 0x1004c41b
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp + 8]
sub eax, 0x21
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp + 0xc]
sub edx, 0x1f
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1004ccf0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004f225
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100664a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
cmp dword [0x1006b5f4], 0
je 0x1004cd68
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x1006b5f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1004cd52
cmp dword [ebp - 0x18], 0x103
jne 0x1004cd52
push 0
mov edx, dword [0x1006b5f4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x1006b5f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1006b5f4], 0
push 0x58
call fcn.10016371
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1004cd88
mov ecx, dword [ebp - 0x20]
call fcn.10001200
mov dword [ebp - 0x24], eax
jmp 0x1004cd8f
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
push str._main
mov ecx, dword [ebp - 0x14]
call fcn.10001320
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.10001300
lea ecx, [ebp + 0x24]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
call fcn.10001300
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x54], 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x1004cbc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1006b5f4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.100012e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.100012e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004cf60
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 0xff
mov dword [ebp - 4], eax
jle 0x1004cfb9
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x10067984]
jge 0x1004cfb9
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x10067988]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.100353e8
add esp, 4
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.100030b0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x1004cfd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100664a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1004d04b
xor eax, eax
mov word [ebp - 0x210], ax
push 0
push 0x200
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jle 0x1004d04b
mov ecx, dword [ebp - 0x214]
sub ecx, 1
push ecx
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.100030b0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100350e4
mov esp, ebp
pop ebp
ret
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x131322d2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42f314
nop
mov ecx, 0x62dd5eb3
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x43db30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x25000]
lea eax, [edi + 0x2ba54]
push dword [eax]
mov dword [eax], 0xd3b9b310
push eax
push edi
jmp 0x43db5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43db61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43db50
mov eax, 1
add ebx, ebx
jne 0x43db73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43db68
jne 0x43db84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43db68
xor ecx, ecx
sub eax, 3
jb 0x43db98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43dc0a
mov ebp, eax
add ebx, ebx
jne 0x43dba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43dbb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43dbd4
inc ecx
add ebx, ebx
jne 0x43dbc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43dbb5
jne 0x43dbd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43dbb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43dbf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43dbe5
jmp 0x43db56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43dbf4
add edi, ecx
jmp 0x43db56
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xb28
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43dc16
cmp byte [edi], 0xa
jne 0x43dc16
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43dc1b
lea edi, [esi + 0x3a000]
mov eax, dword [edi]
or eax, eax
je 0x43dc93
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x421a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x42274]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43dc48
mov ecx, edi
jns 0x43dc77
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4227c]
or eax, eax
je 0x43dc8d
mov dword [ebx], eax
add ebx, 4
jmp 0x43dc65
call dword [esi + 0x42278]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x43dcc4
cmp al, 0xef
ja 0x43dcb7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x43dc99
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x43dca6
mov ebp, dword [esi + 0x42280]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43dcf8
sub esp, 0xffffff80
jmp 0x401020
Function at 0xdca324
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdca32e
pushal
call 0xdca334
pop ebp
sub ebp, 0x10
sub ebp, 0x9ca324
jmp 0xdca34a
mov eax, 0x9ca324
add eax, ebp
add eax, 0x4c
mov ecx, 0x57d
mov edx, 0x15eac013
xor byte [eax], dl
inc eax
dec ecx
jne 0xdca361
jmp 0xdca374
cwde
ficomp word [eax + 0x13132f9a]
adc edx, dword [edx + 0x1313ebd2]
adc edx, dword [eax]
fisubr word [ebx + 0x13131319]
test eax, 0x1313133b
in al, 0xf1
adc bl, bl
cwde
xchg edx, eax
pop ds
adc edx, dword [ebx]
adc edx, dword [eax]
salc
inc ebx
inc ebx
jnp 0xdca415
sub eax, 0xd37b130c
ja 0xdca413
adc edx, dword [edx]
aas
aaa
jnp 0xdca3fb
mov al, byte [0x16fbca89]
adc edx, dword [ebx]
adc edi, edx
cmp edx, dword [ebx]
adc edx, dword [ebx]
inc esi
cwde
call [eax + 0x13131b96]
adc ebx, dword [eax + 0x13131f86]
adc ebx, dword [eax + 0x1313039e]
adc edx, edx
cli
adc dword [edx], esp
adc dword [eax + 0x1c5a17d1], edx
xchg esi, eax
out 0xec, eax
in al, dx
in al, dx
dec esi
rcr dword [edi], 1
adc ebx, dword [eax + 0x1317379f]
adc edx, dword [ebx]
jnp 0xdca460
sub eax, 0xd37b130c
ja 0xdca45e
adc edx, dword [edx]
aas
aaa
inc edx
sti
push ss
adc edx, dword [ebx]
adc edi, edx
push edx
adc dword [ebx], edx
adc eax, dword [esi - 0x62]
jg 0xdca43a
adc ebp, esp
pop ds
in al, dx
sbb di, bx
sti
popal
adc edx, dword [ebx]
adc ebx, dword [eax + 0x13131bae]
adc edx, dword [edx + 0x2beaf2e2]
push ebp
xchg edx, eax
loop 0xdca410
scasb al, byte es:[edi]
sbb edx, dword [ebx]
adc edx, dword [ebx]
xchg edx, eax
loop 0xdca40a
ljmp 0xeaf2:0xe292552b
ljmp 0xc120:0xda20552b
call 0xa73c13a
adc edx, dword [ebx]
adc edx, dword [ebx - 0x68e30518]
add dl, byte [ebx]
adc edx, dword [ebx]
jne 0xdca3df
call 0x97f8db3e
push es
adc edx, dword [ebx]
adc edx, dword [edx - 6]
fucompi st(4)
in al, dx
in al, dx
cmp bl, byte [edi + 0x2a]
adc dl, byte [eax - 0x46fe92e]
sub dl, byte [edx]
nop
rcl byte [esi], cl
nop
sti
pop ss
cli
scasb al, byte es:[edi]
in al, dx
in al, dx
in al, dx
cmp al, byte [edi + 0x2a]
adc dword [eax - 0x66fea2e], edx
pop ss
nop
sti
push ss
cli
mov eax, 0x4eececec
rcr dword [edi], 1
adc eax, dword [esi - 0x68]
inc dword [ebp + 0x44]
inc esi
cwde
pop ds
cwde
outsb dx, byte [esi]
sbb ebp, edi
mov eax, dword [0x92159993]
aad 0x12
adc edx, dword [ebx]
adc ebx, dword [ebx + 0x12d49214]
adc edx, dword [ebx]
adc ebp, dword [eax + 0x13131311]
adc ecx, eax
sbb al, 0x96
push ss
adc edx, dword [ebx]
adc ebx, dword [ecx - 0x3efeaafb]
sbb al, 0x90
retf