joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008190
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
push esi
add eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push 0x100247e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100081fe
mov eax, dword [esp + 8]
cmp eax, 1
je 0x100081cf
cmp eax, 2
jne 0x100081ea
test esi, esi
mov eax, dword [esp]
je 0x100081f8
test eax, eax
je 0x100081f3
test al, 1
jne 0x100081ea
mov edx, eax
shr edx, 1
cmp word [esi + edx*2 - 2], 0
je 0x100081f8
mov eax, 0xd
pop ecx
ret 4
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 4
Function at 0x100096e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x228
mov eax, dword [0x100280f0]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x1a
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x10009801
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009720
sub eax, edx
push edi
sar eax, 1
push eax
lea ecx, [esp + 0x28]
lea edi, [esp + 0xc]
call fcn.1000b210
mov ecx, dword [esp + 0x20]
lea edx, [ecx + 0x22]
add esp, 4
cmp edx, 0x103
jbe 0x1000977d
cmp dword [esp + 0x20], 0x10
jb 0x10009764
mov eax, dword [esp + 0xc]
push eax
call fcn.1000dcfa
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1000dec6
add esp, 0x228
ret
push ebx
mov ebx, dword [esp + 0x24]
cmp ebx, 0x10
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ebp
jae 0x10009792
lea eax, [esp + 0x14]
push ecx
push eax
push esi
call fcn.100123e0
mov edi, esi
add esp, 0xc
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x100097a2
mov cx, word [0x10024c14]
add esi, 0xffffffff
mov word [edi], cx
mov edi, esi
jmp 0x100097c0
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x100097c0
cmp ebx, 0x10
mov ecx, 8
mov esi, str.yxqxunyoulol_test_speed_list.txt
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jb 0x100097e6
push ebp
call fcn.1000dcfa
add esp, 4
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1000dec6
add esp, 0x228
ret
mov ecx, dword [esp + 0x228]
pop esi
xor ecx, esp
xor al, al
call fcn.1000dec6
add esp, 0x228
ret
Function at 0x1000a5b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [eax]
push ebx
push ebp
push 0
push 0
push 3
push 0
push 0
push connect
xor bl, bl
push eax
mov byte [esp + 0x27], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
test ebp, ebp
je 0x1000a67d
cmp ebp, 0xffffffff
je 0x1000a67d
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000a675
lea ecx, [edi - 1]
cmp ecx, 0x9ffffe
ja 0x1000a675
push esi
lea ebx, [edi + 1]
push 0x100318b9
push ebx
call fcn.1000e61b
mov esi, eax
add esp, 8
test esi, esi
je 0x1000a670
push ebx
push 0
push esi
call fcn.1000f430
add esp, 0xc
push 0
lea edx, [esp + 0x18]
push edx
push edi
push esi
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jle 0x1000a667
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x1000a651
mov eax, dword [eax + 4]
jmp 0x1000a654
add eax, 4
push eax
push esi
call fcn.1000e4d0
add esp, 8
test eax, eax
je 0x1000a667
mov byte [esp + 0x13], 1
push esi
call fcn.1000e356
add esp, 4
mov bl, byte [esp + 0x13]
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x1000b170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
push 0
mov esi, 0x1a
push esi
mov edi, eax
push edi
push ebx
call ebp
cmp eax, esi
jg 0x1000b1a7
jmp 0x1000b190
test eax, eax
jle 0x1000b1a7
sub esi, eax
add edi, eax
test esi, esi
je 0x1000b1a7
push 0
push esi
push edi
push ebx
call ebp
cmp eax, esi
jle 0x1000b190
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebp
ret

Function at 0x1000b1c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor ebx, ebx
push ebx
mov esi, 0x2000
push esi
mov edi, eax
push edi
push ebp
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jg 0x1000b1fd
nop
test eax, eax
jle 0x1000b1fd
sub esi, eax
add edi, eax
add ebx, eax
test esi, esi
je 0x1000b1fd
push 0
push esi
push edi
push ebp
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jle 0x1000b1e0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x1000b480
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100213cb
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x100280f0]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov eax, dword [0x100280f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c8]
mov dword fs:[0], eax
cmp byte [0x100323f9], 0
jne 0x1000b4e0
lea eax, [esp + 0x2c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x100323f9], 1
lea edi, [esp + 0x10]
call fcn.100041c0
mov dword [esp + 0x1d0], 0
cmp dword [esp + 0x28], 0x10
mov esi, dword [esp + 0x14]
jae 0x1000b503
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push ecx
push edi
push ebx
push edx
call fcn.10001240
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add esp, 0x10
push edi
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.10004270
cmp dword [esp + 0x28], 0x10
mov esi, eax
jb 0x1000b548
mov eax, dword [esp + 0x14]
push eax
call fcn.1000dcfa
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.1000dec6
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000b650
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002098b
mov eax, dword fs:[0]
push eax
mov eax, 0x1234
call fcn.1001f5e0
mov eax, dword [0x100280f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x240]
push eax
push 0x1000
lea ecx, [ebp - 0x1240]
push ecx
push esi
mov dword [ebp - 0x238], esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1000b7de
xor eax, eax
test dword [ebp - 0x240], 0xfffffffc
mov dword [ebp - 0x23c], eax
jbe 0x1000b7de
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov eax, dword [ebp + eax*4 - 0x1240]
push 0x208
lea edx, [ebp - 0x218]
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1000b7b8
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jg 0x1000b73c
lea ebx, [eax + eax]
mov eax, ebx
call fcn.10017c20
mov esi, esp
test esi, esi
je 0x1000b73c
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0
push 0x3a8
mov byte [esi], 0
call edi
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000b73e
xor eax, eax
xor ebx, ebx
mov ecx, eax
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
lea esi, [ecx + 1]
jmp 0x1000b760
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x1000b760
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.10001780
mov dword [ebp - 4], ebx
lea ebx, [ebp - 0x234]
call fcn.1000c500
push 0xa
push str.HOOKDISKID
mov eax, ebx
push eax
call fcn.10001570
test eax, eax
jge 0x1000b80c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 0x10
jb 0x1000b7b8
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.1000dcfa
add esp, 4
mov eax, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x240]
mov esi, dword [ebp - 0x238]
add eax, 1
shr edx, 2
cmp eax, edx
mov dword [ebp - 0x23c], eax
jb 0x1000b6d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea esp, [ebp - 0x1250]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000dec6
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x21c], 0x10
jb 0x1000b824
mov eax, dword [ebp - 0x230]
push eax
call fcn.1000dcfa
add esp, 4
xor eax, eax
jmp 0x1000b7ea
Function at 0x1000bc00
Capabilities:
Enumerate process modules
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x10020bc6
mov eax, dword fs:[0]
push eax
sub esp, 0xe50
mov eax, dword [0x100280f0]
xor eax, esp
mov dword [esp + 0xe4c], eax
push ebx
push esi
push edi
mov eax, dword [0x100280f0]
xor eax, esp
push eax
lea eax, [esp + 0xe60]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000bd8b
push 0x424
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x40], 0x428
call fcn.1000f430
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push ebx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1000bd84
cmp dword [esp + 0x3c], 0
jne 0x1000bc94
lea edx, [esp + 0x34]
push edx
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x1000bd84
lea esp, [esp]
push 0x1fe
lea eax, [esp + 0x462]
push 0
push eax
call fcn.1000f430
mov ecx, 0x3f
lea esi, [esp + 0x60]
lea edi, [esp + 0x468]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x468]
add esp, 0xc
push ecx
movsb byte es:[edi], byte [esi]
call fcn.10020440
add esp, 4
lea edx, [esp + 0x45c]
push str.sxin.dll
push edx
call fcn.1000eb41
add esp, 8
test eax, eax
je 0x1000bd0e
lea eax, [esp + 0x45c]
push str.sxin64.dll
push eax
call fcn.1000eb41
add esp, 8
test eax, eax
jne 0x1000bd58
push 0x7fe
lea ecx, [esp + 0x662]
push 0
push ecx
mov word [esp + 0x668], 0
call fcn.1000f430
add esp, 0xc
lea edx, [esp + 0x65c]
push edx
push 0x400
push 0
lea eax, [esp + 0x60]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x65c]
call fcn.1000bbb0
test al, al
jne 0x1000bdb4
lea ecx, [esp + 0x45c]
push str.SbieDll.dll
push ecx
call fcn.1000eb41
add esp, 8
test eax, eax
je 0x1000bdb4
lea edx, [esp + 0x34]
push edx
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1000bca0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0xe60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe4c]
xor ecx, esp
call fcn.1000dec6
add esp, 0xe5c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1000bd8d

Function at 0x1000c680
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x100280f0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push esi
push edi
mov edi, ecx
xor ecx, ecx
push eax
mov eax, dword [esp + 0x78]
lea esi, [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.1000c6f0
add esp, 4
mov ecx, esi
call fcn.1000c790
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
call fcn.1000dec6
add esp, 0x64
ret
Function at 0x1000d0b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100280f0]
xor eax, ebp
mov dword [ebp - 4], eax
test ebx, ebx
push esi
push edi
je 0x1000d105
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 1
cmp edi, 0x3fffffff
jg 0x1000d105
lea eax, [edi + edi]
call fcn.10017c20
mov esi, esp
test esi, esi
je 0x1000d105
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0x3a8
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000d107
xor eax, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000d136
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000d136
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dec6
mov esp, ebp
pop ebp
ret
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dec6
mov esp, ebp
pop ebp
ret

Function at 0x1000dec6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100280f0]
jne 0x1000ded0
repz ret
jmp fcn.10012f58
Function at 0x10014af4
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10028508]
je 0x10014b0f
inc edi
cmp edi, 0x17
jb 0x10014b00
cmp edi, 0x17
jae 0x10014c8f
push ebp
push 3
call fcn.1001bffa
cmp eax, 1
pop ecx
je 0x10014c5b
push 3
call fcn.1001bffa
test eax, eax
pop ecx
jne 0x10014b43
cmp dword [0x10031930], 1
je 0x10014c5b
cmp ebx, 0xfc
je 0x10014c8e
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10031ed8
push ebp
call fcn.10012c58
add esp, 0xc
test eax, eax
je 0x10014b79
push esi
push esi
push esi
push esi
push esi
call fcn.1000e0e5
add esp, 0x14
push 0x104
mov esi, 0x10031ef1
push esi
push 0
mov byte [0x10031ff5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10014bbd
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10012c58
add esp, 0xc
test eax, eax
je 0x10014bbd
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000e0e5
add esp, 0x14
push esi
call fcn.1000fa00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10014c02
push esi
call fcn.1000fa00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x100321ec
push 0x10023354
sub ecx, eax
push ecx
push eax
call fcn.10019266
add esp, 0x14
test eax, eax
je 0x10014c02
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000e0e5
add esp, 0x14
jmp 0x10014c04
xor esi, esi
push 0x10023350
push ebx
push ebp
call fcn.100191ad
add esp, 0xc
test eax, eax
je 0x10014c24
push esi
push esi
push esi
push esi
push esi
call fcn.1000e0e5
add esp, 0x14
push dword [edi*8 + 0x1002850c]
push ebx
push ebp
call fcn.100191ad
add esp, 0xc
test eax, eax
je 0x10014c46
push esi
push esi
push esi
push esi
push esi
call fcn.1000e0e5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1001be3d
add esp, 0xc
jmp 0x10014c8e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10014c8e
cmp ebp, 0xffffffff
je 0x10014c8e
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1002850c]
push dword [esi]
call fcn.1000fa00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1001be3d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10013136
xor ebx, ebx
cmp dword [0x100323b8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1001bf13
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001bff3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1001bff3
push eax
call fcn.100130c8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100323b8], eax
call esi
push eax
call fcn.100130c8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100323bc], eax
call esi
push eax
call fcn.100130c8
mov dword [0x100323c0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.100148a1
test eax, eax
pop ecx
pop ecx
je 0x1001bee1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000e0e5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1001bf13
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100130c8
cmp eax, ebx
pop ecx
mov dword [0x100323c8], eax
je 0x1001bf13
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100130c8
pop ecx
mov dword [0x100323c4], eax
mov eax, dword [0x100323c4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001bf98
cmp dword [0x100323c8], ecx
je 0x1001bf98
push eax
call fcn.1001313f
push dword [0x100323c8]
mov esi, eax
call fcn.1001313f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001bf98
cmp edi, ebx
je 0x1001bf98
call esi
cmp eax, ebx
je 0x1001bf65
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001bf65
test byte [ebp - 0x18], 1
jne 0x1001bf98
lea eax, [ebp - 0x10]
push eax
call fcn.100148d8
test eax, eax
pop ecx
je 0x1001bf80
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000e0e5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1001bf8f
or dword [ebp + 0x10], 0x200000
jmp 0x1001bfd3
or dword [ebp + 0x10], 0x40000
jmp 0x1001bfd3
mov eax, dword [0x100323bc]
cmp eax, dword [ebp - 8]
je 0x1001bfd3
push eax
call fcn.1001313f
cmp eax, ebx
pop ecx
je 0x1001bfd3
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1001bfd3
mov eax, dword [0x100323c0]
cmp eax, dword [ebp - 8]
je 0x1001bfd3
push eax
call fcn.1001313f
cmp eax, ebx
pop ecx
je 0x1001bfd3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100323b8]
call fcn.1001313f
cmp eax, ebx
pop ecx
je 0x1001bff3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001bff5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x103a2a9a
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
push ecx
call fcn.1039fb47
mov byte [esp], 0x3d
pushal
lea esp, [esp + 0x24]
jae 0x103a3144
cmc
cmc
mov ebx, eax
sub edi, edi
mov edi, eax
btr cx, 4
mov ecx, 0x104
clc
sub al, al
call fcn.1037050c
inc ebp
test al, 0xef
inc esp
sbb ebp, eax
movsb byte es:[edi], byte [esi]
jp 0x103a2b13
sbb byte [eax + 0x2383acda], bh
lodsd eax, dword [esi]
dec ebx
xor cl, dl
in al, 0x98
sal byte [esi - 0x18], cl
add cl, byte [ebp - 0x11d64561]
push ecx
dec esi
jo 0x103a2a96
xchg esi, eax
add al, 0xbf
cmp ecx, esi
daa
invalid
int 0x38
push eax
lea eax, [ebx - 0x2d60e7de]
xor byte [0xc2e5cca4], ah
outsd dx, dword [esi]
push 0xde063984
cld
sti
push eax
enter 0x3716, 0xffffffffffffff95
add eax, 0x153f7273
or al, 0x49
mov ecx, 0x28a58617
in eax, dx
jnp 0x103a2b9b
and ecx, esp
int 0x20
add dword [ebp + ecx*4 + 0x87e841c], ebp
in eax, 0x1f
inc ecx
xor eax, 0x16c38485
leave
movsb byte es:[edi], byte [esi]
mov ebp, 0x91b6cf5d
invalid
test dword [edi], eax
into
invalid

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x74d80d29
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x18582633
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403304
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x456020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40339c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40337c
xor eax, eax
push ebp
push 0x403375
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40337c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x456020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x456020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404098
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x458048], 0
je 0x4040f9
cmp word [0x45821c], 0xd7b2
jne 0x4040c1
cmp dword [0x458224], 0
jbe 0x4040c1
mov eax, 0x458218
call dword [0x458234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45606c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404120
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x456030], 0
jne 0x404115
push 0
push 0x456064
push 0x45606c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405f02
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040448c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ec8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405eec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f09
lea eax, [ebp - 0x10]
call fcn.0040421c
ret

Function at 0x40b028
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b061
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040430c
jmp 0x40b06a
mov eax, ebx
mov edx, esi
call fcn.00404270
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b074
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b095
mov al, byte [esp]
jmp 0x40b097
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b72c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b594
mov eax, dword [0x45704c]
cmp byte [eax], 0
je 0x40b7a8
mov eax, dword [0x456e7c]
call fcn.00402d34
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408818
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b7f0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b7de
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x456e30]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x458664]
call fcn.00405308
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret