joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003423f
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
push edi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10034277
push 1
push 0x19ad
call fcn.10034407
pop ecx
pop ecx
jmp 0x100343f7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100342bd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfab
push 0x1e40
push 0x1675
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x100343f7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
push 2
lea ecx, [ebp - 0x40]
call fcn.10001a5a
and dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x56915a13
mov dword [ebp - 0x28], 0xf47a6d
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x24], 0x4709
lea eax, [ebp - 0x10]
push eax
push 0x6511
push 1
push 0
push 0x7b34
push 0xca1
lea eax, [ebp - 0x40]
push eax
push 0x7237
call fcn.1002be2a
add esp, 0x20
mov dword [ebp - 0x10], 0
jmp 0x1003432b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1003433e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], 0x336fde00
jmp 0x10034324
push 0
push 0x66b9
push 0x5893
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2eac
push 1
push 0x6d9e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x7df3
lea eax, [ebp - 0x2c]
push eax
push 0x1671
push 0x4f24
push 0x695
push 0
call fcn.10035fd7
add esp, 0x40
push 0x4f08
push 0x2104
push 0x6ece
push 0x4772
push 0x6230
push 0
push 0x7bd0
push 0x4ccd
push 0x3cdc
push 0
push 0x4f81
call fcn.10031bda
add esp, 0x2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10001abc
lea eax, [ebp - 0x58]
push eax
call fcn.1002a086
pop ecx
mov esi, eax
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call fcn.1002bb66
shl eax, 1
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + eax*4 + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003d030
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062d1d
call fcn.10061518
sub esp, 0x14
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
mov byte [ebp - 0x14], cl
je 0x1003d175
cmp byte [ebp + 0x1c], 0
je 0x1003d124
mov dword [ebp - 0x1c], 0x5535
cmp dword [ebp - 0x1c], 0x57be
jle 0x1003d0c9
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp + 0x10], ebx
and dword [ebp - 0x20], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x20]
mov ebx, edx
mov eax, ebx
mov ecx, 0x1007d858
xor eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb8e
inc esi
cmp esi, 0x5d8
jl 0x1003d086
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp + 0x10], ebx
cmp ebx, 0x57bd
jl 0x1003d078
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5a10
jl 0x1003d073
inc edi
cmp edi, 0x24e5
jl 0x1003d06e
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003d0e9
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 1
jl 0x1003d0da
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5510
jge 0x1003d105
mov edx, str.gxut_vwj_siyeugmme_jymhampi_tjervov
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x1003d25f
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
jmp 0x1003d16b
push 1
push 0x2dad
push 0xdf5
push 0x3bc6
push edi
push 0
push esi
push 0x68bd
push dword [ebp + 0x20]
xor dl, dl
mov ecx, 0x6d28
push 0x6ef9
call fcn.1003cdaa
add esp, 0x28
cmp dword [esi], 0
jne 0x1003d25f
inc dword [esi]
cmp dword [esi], 2
jle 0x1003d12f
jmp 0x1003d25f
test cl, cl
je 0x1003d250
mov dword [ebp - 0x18], 0x603a
cmp dword [ebp - 0x18], 0x6357
jle 0x1003d1f2
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp + 0x10], edi
mov ecx, edi
mov dword [ebp - 0x20], esi
xor ebx, ebx
sar esi, cl
xor edi, edi
mov eax, esi
mov ecx, 0x1007d858
or eax, edi
or eax, ebx
cdq
push edx
push eax
call fcn.1000bb8e
inc edi
cmp edi, 0x24f4
jl 0x1003d1a2
inc ebx
cmp ebx, 0x34ec
jl 0x1003d1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp + 0x10], edi
cmp edi, 0x5b98
jl 0x1003d197
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2913
jl 0x1003d192
push 0x12d9
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x5cd3
jge 0x1003d211
mov edx, str.xizrbk_yrgrxuqvg_adlkqvw_moc_ehwjxxb_rvvwlpebi
mov ecx, 0x1007d858
call fcn.1000dfd7
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003d25f
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x677b568b
inc dword [edx]
cmp dword [edx], 2
jl 0x1003d222
jmp 0x1003d25f
push 0
push 0x1cf
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d4d2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp byte [ebp + 8], 0
push esi
push edi
mov byte [esp + 0xc], cl
je 0x1003d510
cmp byte [ebp + 0xc], 0
je 0x1003d4fe
cmp byte [edx], 0
je 0x1003d56c
xor edx, edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x1003d56c
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1003d56c
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1003d56c
test cl, cl
je 0x1003d54f
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1003d56c
push 0x3aa0
push 0x34cc
push 1
push 0x6d65
push 0x7404
push 0
push 0x7c8
push 0x7007
mov edx, 0x7b7f
xor cl, cl
call fcn.1003d030
add esp, 0x20
jmp 0x1003d56c
mov esi, dword [ebp + 0x10]
xor edx, edx
mov dword [esi], edx
cmp dword [esi], 2
jge 0x1003d56c
mov edi, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], edx
inc dword [esi]
cmp dword [esi], 2
jl 0x1003d55e
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003de51
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x100e0ba4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100e0ba4], ecx
inc edx
cmp edx, esi
jl 0x1003de66
mov dword [0x100e0ba0], esi
pop esi
pop ebp
ret 8

Function at 0x1003de8c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100e0ba4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100e0f30
jl 0x1003de9a
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100e11d4
jl 0x1003deda
mov ecx, dword [0x100e1f20]
xor ecx, dword [0x100e0ba4]
and ecx, edi
xor ecx, dword [0x100e1f20]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100e0ba0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100e11d4]
mov dword [0x100e1560], eax
pop esi
ret
Function at 0x1003df69
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10062d9d
call fcn.10061518
sub esp, 0x24
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push ebx
push esi
push edi
push fcn.1000bd03
push fcn.1000bccb
xor edi, edi
mov ebx, ecx
inc edi
mov dword [ebp - 0x14], ebx
push edi
push 0x18
push eax
mov esi, edx
call fcn.1004afa0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], edi
push eax
push edi
push 0x39fc
push 0x3028
push 0
push dword [ebp + 8]
mov edx, 0x3736
mov ecx, 0x1d1e
push esi
call fcn.1003e33b
mov dword [ebp - 0x10], 0x1a3c
add esp, 0x1c
cmp dword [ebp - 0x10], 0x1d25
jle 0x1003e02d
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor esi, esi
mov dword [ebp - 0x10], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x1007d858
and eax, ebx
cdq
push edx
push eax
call fcn.1000bb8e
inc ebx
cmp ebx, 0x3604
jl 0x1003dfed
mov esi, dword [ebp - 0x10]
inc edi
cmp edi, 0x6074
jl 0x1003dfe4
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x18aa
jl 0x1003dfe2
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [ebp - 0x14]
xor edi, edi
inc edi
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.1000bca3
push fcn.1000bd03
push edi
push 0x18
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], edi
push eax
mov byte [ebp - 4], 0
call fcn.1004abfd
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f14c
Capabilities:
Delete file

Disassembly:
mov eax, 0x10062e4d
call fcn.10061518
sub esp, 0x1c
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003f24c
test dl, dl
je 0x1003f188
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1003f289
push ecx
call fcn.100401c3
pop ecx
jmp 0x1003f289
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], esi
mov dword [esi], 0
cmp dword [esi], 3
jg 0x1003f289
mov dword [ebp - 0x20], 0x26d1
cmp dword [ebp - 0x20], 0x2a65
jle 0x1003f1fa
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov eax, edi
xor esi, esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x1007d858
xor eax, esi
cdq
push edx
push eax
call fcn.1000bb8e
inc esi
cmp esi, 0x1a35
jl 0x1003f1bd
mov edi, dword [ebp - 0x1c]
inc ebx
cmp ebx, 0x2c2f
jl 0x1003f1b4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x279f
jl 0x1003f1b2
mov esi, dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi], 0
jne 0x1003f289
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x25eb
jge 0x1003f241
mov edx, str.bbqyzs_sfxpwrjlb_nmgtrk_dngnpkcez
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x1003f241
or dword [ebp - 4], 0xffffffff
inc dword [esi]
jmp 0x1003f194
cmp byte [ebp + 0x18], 0
je 0x1003f277
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003f289
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x677b568b
inc dword [edx]
cmp dword [edx], 2
jl 0x1003f263
jmp 0x1003f289
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1003f289
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040e5b
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x10062fde
call fcn.10061518
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
je 0x10040e90
mov eax, dword [ebp + 0x18]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [ebp - 0x24], edi
mov dword [edi], esi
cmp dword [edi], 0xffffffef
jl 0x10040e7f
push 2
lea ecx, [ebp - 0x30]
call fcn.10001a5a
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0xaad8530d
mov dword [ebp - 0x14], esi
jmp 0x10040ec5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov dword [eax + ecx*4], 0x29bf39
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10040eb5
mov ecx, dword [ebp - 0x30]
add ecx, 4
mov dword [ecx], esi
cmp dword [ecx], 0x10
jne 0x10040fa6
mov dword [ebp - 0x18], 0x7e31
cmp dword [ebp - 0x18], 0x81d8
jle 0x10040f3e
push 1
push 0x2419
push 0x1c81
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x14], 0x66c2
mov dword [ebp - 0x20], esi
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x1007d858
cdq
push edx
push eax
call fcn.1000bb8e
inc esi
cmp esi, 0x4890
jl 0x10040f0c
add edi, ebx
dec dword [ebp - 0x14]
push 0
pop esi
jne 0x10040f09
inc ebx
cmp ebx, 0x5589
jl 0x10040f00
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0x7cab
jge 0x10040f85
mov edx, str.vjr_phlzuy_nvxcvt_aud_kmpaw_zfchhl_zqwismlcv_yojx
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10040f85
mov dword [ebp - 4], esi
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 4
cmp dword [ecx], 1
setne al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
inc dword [ecx]
mov dword [ebp - 0x20], eax
jmp 0x10040ed3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10001abc
dec dword [edi]
jmp 0x10040e97
Function at 0x10041082
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10063000
push eax
mov dword fs:[0], esp
mov eax, ecx
sub esp, 0x70
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
je 0x100411b6
cmp byte [ebp + 0x1c], 0
je 0x100411a7
mov dword [esp + 0x18], 0x1a90
cmp dword [esp + 0x18], 0x1da2
jle 0x10041179
xor ebx, ebx
push ebx
push 0x11fc
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov esi, ebx
mov dword [esp + 0x14], ebx
mov edi, ebx
mov dword [esp + 0x10], ebx
mov eax, ebx
mov dword [esp + 0xc], ebx
and eax, edi
mov edi, ebx
xor eax, esi
mov dword [esp + 0x1c], eax
mov esi, eax
mov eax, esi
lea ecx, [esp + 0x48]
or eax, edi
cdq
push edx
push eax
call fcn.1000260d
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10041124
mov eax, dword [eax]
push eax
call fcn.1004ae5e
pop ecx
push ebx
push 1
lea ecx, [esp + 0x50]
call fcn.1000c17a
inc edi
cmp edi, 0xfa1
jl 0x1004110a
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
inc eax
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], eax
cmp eax, 0x126
jl 0x100410fe
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x7406
jl 0x100410f8
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x4d5c
jl 0x100410f2
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10023dc7
cmp dword [esp + 0x18], 0x1a21
jge 0x1004128d
push str.tchvt_epeo_jeggfl_aqst_cwlgagr_yfrh_lhlghwm_poseg
call fcn.1004ae5e
pop ecx
jmp 0x1004128d
mov eax, dword [ebp + 0x30]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x24]
mov dword [eax], ecx
jmp 0x1004128d
cmp byte [ebp + 0x2c], 0
je 0x10041254
sub esp, 0x18
mov ecx, esp
push eax
call fcn.1000bca3
lea ecx, [esp + 0x3c]
call fcn.100406a5
add esp, 0x18
mov dword [esp + 0x84], 2
xor ebx, ebx
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x1004124d
push dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x48], 7
push eax
push dword [esp + 0x2c]
mov word [esp + 0x3c], cx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], ebx
call fcn.10023c3e
mov ecx, dword [ebp + 0x34]
lea edx, [esp + 0x30]
mov byte [esp + 0x84], 3
call fcn.10040e3a
lea ecx, [esp + 0x30]
push ebx
push 1
test eax, eax
jns 0x10041248
mov eax, dword [ebp + 0x28]
mov byte [eax], 1
call fcn.1000c4ec
lea ecx, [esp + 0x24]
call fcn.100294a6
jmp 0x1004128d
call fcn.1000c4ec
mov eax, dword [ebp + 0x28]
mov byte [eax], bl
jmp 0x1004123d
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [edx]
sub eax, ecx
push eax
push ecx
mov ecx, dword [ebp + 0x20]
lea eax, [esp + 0x68]
push eax
call fcn.100427dc
mov ecx, dword [ebp + 0x14]
push eax
mov dword [esp + 0x88], 4
call fcn.1004288a
push 0
push 1
lea ecx, [esp + 0x68]
call fcn.1000c4ec
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
mul byte [esi + 4]
mov edi, 0xec6af69e
in eax, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x763aed89]
wait
sahf
sahf
sahf
ja 0xdd0e3f
sahf
sahf
sahf
retf
Function at 0x860000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x39d000]
push edi
jmp 0x86001a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x860021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x860010
mov eax, 1
add ebx, ebx
jne 0x860033
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x860044
jne 0x860063
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x860063
dec eax
add ebx, ebx
jne 0x860050
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x860028
add ebx, ebx
jne 0x86005f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8600b5
xor ecx, ecx
sub eax, 3
jb 0x86007b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8600ea
sar eax, 1
mov ebp, eax
jmp 0x860086
add ebx, ebx
jne 0x860086
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x860054
inc ecx
add ebx, ebx
jne 0x860094
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x860054
add ebx, ebx
jne 0x8600a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x860096
jne 0x8600b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x860096
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8600d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8600c6
jmp 0x860016
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8600d4
add edi, ecx
jmp 0x860016
pop esi
mov edi, esi
mov ecx, 3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8600f2
cmp byte [edi], 8
jne 0x8600f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8600f7
lea edi, [esi + 0x45d000]
mov eax, dword [edi]
or eax, eax
je 0x86016f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x73e5f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x73e6f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x860124
mov ecx, edi
jns 0x860153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x73e6fc]
or eax, eax
je 0x860169
mov dword [ebx], eax
add ebx, 4
jmp 0x860141
call dword [esi + 0x73e70c]
mov ebp, dword [esi + 0x73e700]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8601a3
sub esp, 0xffffff80
jmp 0x4b68b0
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp fcn.00431219
Function at 0x401020
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x40103c
push eax
call fcn.00414c00
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
test edi, edi
jl 0x401051
lea eax, [edi + 2]
push eax
call fcn.004152b9
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], edi
cmp dword [esi + 4], 0
jle 0x40106d
mov ecx, dword [esp + 4]
mov edx, dword [esi]
push ecx
push 1
push edi
push edx
call fcn.00414bb9
add esp, 0x10
ret 4
or eax, 0xffffffff
ret 4

Function at 0x401080
Capabilities:
Read file on windows

Disassembly:
push 0
push eax
push edi
call fcn.00415084
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x4010a8
push eax
call fcn.00414c00
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push 0xbe2
call fcn.004152b9
push edi
push 1
push 0xbe0
push eax
mov dword [esi], eax
mov dword [esi + 4], 0xbe0
call fcn.00414bb9
add esp, 0x14
ret