joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100057a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 0xe], 0
and byte [ebp - 2], 0
lea eax, [ebp - 0x20]
mov byte [ebp - 0x20], 0x50
push eax
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x4d
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x67
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
call fcn.10002820
pop ecx
test eax, eax
pop ecx
je 0x1000584e
push eax
sbb eax, esi
add eax, edx
sbb eax, esi
sbb eax, edx
add eax, esi
nop
pop eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
leave
ret
xor eax, eax
leave
ret

Function at 0x10005852
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and byte [ebp - 0x11], 0
and byte [ebp - 4], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x63
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x43
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x70
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x10], 0x41
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
call fcn.10002820
pop ecx
test eax, eax
pop ecx
je 0x1000591b
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
leave
ret
xor eax, eax
leave
ret
Function at 0x1000591f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
and byte [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], 0x43
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x54
mov byte [ebp - 9], 0x68
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x64
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
call fcn.10002820
pop ecx
test eax, eax
pop ecx
je 0x100059b6
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
leave
ret
xor eax, eax
leave
ret
Function at 0x10005c33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
xor ebx, ebx
cmp byte [0x10021985], bl
push esi
je 0x10005d2f
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x51
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x55
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], bl
call fcn.10002820
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x10005d2f
call fcn.1000d7c4
cmp eax, ebx
jge 0x10005cdc
push 1
pop eax
cmp eax, 0xfffffffc
jge 0x10005ced
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call fcn.10004ba9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x50
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.1000d7f0
add esp, 0xc
push esi
mov esi, 0x63636363
mov esi, 0x68686868
sbb esi, edx
sbb esi, eax
nop
pop esi
lea eax, [ebp - 0x74]
push 0x50
push eax
lea eax, [ebp - 4]
push 4
push eax
push 1
call esi
test eax, eax
je 0x10005d2f
mov eax, dword [ebp - 0x60]
jmp 0x10005d32
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x10006295
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x10018184
call fcn.1000dc34
sub esp, 0xb8
push ebx
push esi
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc4], 0x94
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x30], 0x47
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x56
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 0x69
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x45
mov byte [ebp - 0x25], 0x78
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], bl
call fcn.10002820
pop ecx
pop ecx
push ebp
add ebp, esi
sbb ebp, eax
sbb ebp, edx
add ebp, esp
sbb ebp, esi
sbb ebp, eax
sub ebp, ebx
nop
pop ebp
lea ecx, [ebp - 0xc4]
push ecx
call eax
cmp eax, ebx
je 0x1000636c
cmp dword [ebp - 0xb4], 2
jb 0x1000636c
cmp dword [ebp - 0xc0], 5
jb 0x1000636c
mov byte [0x10021eac], 1
jmp 0x1000637b
cmp byte [0x10021eac], bl
mov byte [0x10021986], 1
je 0x100063a5
cmp dword [ebp - 0xc0], 6
jb 0x1000638b
mov byte [0x10021984], 1
push esi
xor esi, eax
mov esi, 0xf1f1f1f1
nop
pop esi
cmp dword [ebp - 0xc0], 0xa
jb 0x100063a5
mov byte [0x10021987], 1
or dword [ebp - 4], 0xffffffff
mov byte [0x10021988], 1
call fcn.1000d7c4
cmp eax, ebx
jge 0x100063bc
push 1
pop eax
cmp eax, 0xfffffffc
jge 0x100063c6
call fcn.10004ae3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10007268
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1001edec]
test eax, eax
jne 0x1000731e
and byte [ebp - 2], al
and byte [ebp - 0x1c], al
and byte [ebp - 0xe], al
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x4e
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6b
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x78
call fcn.1000d7c4
test eax, eax
jge 0x100072ec
push 1
pop eax
push edx
mov edx, 0x60606060
mov edx, 0x65656565
xor edx, eax
nop
pop edx
cmp eax, 0xffffffff
jle 0x10007304
mov byte [ebp - 0x1c], 0x43
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10002820
pop ecx
mov dword [0x1001edec], eax
test eax, eax
pop ecx
jne 0x1000731e
leave
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
leave
ret

Function at 0x1000732e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1001edf0]
test eax, eax
jne 0x100073d5
and byte [ebp - 2], al
and byte [ebp - 0x10], al
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x1b], 0x49
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x6f
push ecx
add ecx, eax
xor ecx, esp
add ecx, eax
add ecx, esp
xor ecx, eax
pop ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10002820
pop ecx
mov dword [0x1001edf0], eax
test eax, eax
pop ecx
jne 0x100073d5
leave
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
leave
ret
Function at 0x1000902f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [0x10021ef8], ebx
jne 0x100090e5
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x43
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], bl
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], bl
call fcn.10002820
pop ecx
mov dword [ebp - 4], ebx
pop ecx
push edx
mov edx, 0x4e4e4e4e
mov edx, 0x53535353
mov edx, 0x58585858
pop edx
cmp eax, ebx
je 0x100090e5
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
push 0x10009327
push ebx
push ebx
call eax
mov dword [0x10021ef8], eax
pop ebx
leave
ret

Function at 0x10009261
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 5], 0
push esi
push 1
mov byte [ebp - 0x10], 0x47
pop esi
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x41
push edi
mov edi, 0x2f2f2f2f
mov edi, 0x34343434
sub edi, edi
nop
pop edi
and byte [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x20], 0x77
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x76
call fcn.100027be
pop ecx
test eax, eax
pop ecx
je 0x10009322
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 2
push dword [ebp + 8]
call eax
test eax, eax
jne 0x10009322
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
push ebx
xor ebx, edx
sbb ebx, eax
xor ebx, esi
xor ebx, esp
sbb ebx, edx
xor ebx, eax
pop ebx
cmp eax, 0x7a
jne 0x10009322
push 1
pop esi
mov eax, esi
pop esi
leave
ret
Function at 0x10009b3b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
push 0xfffffffffffffffd
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
call fcn.1000d853
cmp eax, 3
pop ecx
jne 0x10009b8c
push 0
push 0
call dword [sym.imp.USER32.dll_GetClientRect]
and byte [ebp - 0x13], 0
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], 0x54
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x51
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x79
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6b
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x6e
push edx
mov edx, 0x71717171
add edx, esi
sbb edx, edx
sbb edx, esi
add edx, edx
pop edx
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10002820
pop ecx
pop ecx
call eax
leave
ret
Function at 0x1000ac75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x10018220
call fcn.1000dc34
sub esp, 0x134
push ebx
push esi
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], 1
xor esi, esi
mov byte [ebp - 0x20], 0x4b
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x34], 0x43
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x74
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x44
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x63
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x79
mov byte [ebp - 0x25], 0x41
mov byte [ebp - 0x24], bl
call fcn.10002820
pop ecx
mov dword [ebp - 0x3c], eax
pop ecx
push eax
xor eax, edx
sbb eax, eax
xor eax, esi
xor eax, esp
sbb eax, edx
xor eax, eax
xor eax, esi
pop eax
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x38], ebx
je 0x1000adb1
mov al, byte [esi + edi]
cmp al, 0x5c
jne 0x1000ad87
push 0xffffffffffffffcc
call fcn.1000d853
cmp eax, 0x17
pop ecx
jne 0x1000ad53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea eax, [ebp - 0x140]
push ebx
push eax
call fcn.1000d7f0
push esi
lea eax, [ebp - 0x140]
push edi
push eax
call fcn.1000dc70
add esp, 0x18
lea eax, [ebp - 0x140]
mov byte [ebp + esi - 0x140], bl
push ebx
push eax
jmp 0x1000ada1
cmp al, bl
jne 0x1000ada4
mov dword [ebp - 0x38], ebx
push edi
mov edi, 0x3d3d3d3d
add edi, eax
add edi, eax
xor edi, eax
add edi, eax
sub edi, ecx
pop edi
push ebx
push edi
call dword [ebp - 0x3c]
inc esi
jmp 0x1000ad34
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1000b28b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e94
call fcn.1000f540
push ebx
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x5f
mov byte [ebp - 8], 0x31
mov byte [ebp - 7], 0x31
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], bl
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6a
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x49
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], bl
call fcn.10002820
mov edi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6a
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x57
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], bl
call fcn.10002820
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], bl
call fcn.10002820
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x1000b3ff
cmp dword [ebp - 0x2c], ebx
je 0x1000b3ff
lea eax, [ebp - 0x4e94]
push eax
call edi
test eax, eax
jne 0x1000b3ff
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov dword [ebp - 0x4e8c], eax
neg edx
mov dword [ebp - 0x4e88], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x4e90], edx
lea edx, [eax + eax*2 + 3]
lea edi, [eax + eax*2]
mov dword [ebp - 0x4e68], eax
mov eax, dword [ebp + 0x1c]
and edx, 0xfffffffc
sub edx, edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x4e44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4e70], eax
mov eax, dword [edi]
mov dword [ebp - 0x4e6c], eax
lea eax, [ebp - 0x4e94]
push 9
push eax
mov dword [ebp - 0x4e84], edx
mov dword [ebp - 0x4e64], ecx
call dword [ebp - 0x2c]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x4e94]
push eax
call esi
cmp dword [ebp + 0xc], ebx
jne 0x1000b3ff
mov eax, dword [ebp - 0x4e6c]
mov dword [edi], eax
mov al, 1
jmp 0x1000b401
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403330
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a94
test esi, esi
jne 0x403366
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b84
jmp 0x403384
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004031d4
mov edi, eax
test esi, esi
je 0x403384
cmp dword [ebx], 0
je 0x403384
dec esi
jmp 0x40336d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403a5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x466020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403af4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ad4
xor eax, eax
push ebp
push 0x403acd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403b10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ad4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x466020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x466020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4048f8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46a04c], 0
je 0x404959
cmp word [0x46a220], 0xd7b2
jne 0x404921
cmp dword [0x46a228], 0
jbe 0x404921
mov eax, 0x46a21c
call dword [0x46a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404980
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46602c], 0
jne 0x404975
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4060dc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40630c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40615f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40630c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40615f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406328
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4061e8
xor eax, eax
push ebp
push 0x4061e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405f18
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4061c6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406348
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4061c6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061e8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406302
cmp byte [ebp - 0xd], 0
jne 0x40622f
cmp byte [ebp - 0x12], 0
je 0x406302
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406248
dec ebx
cmp byte [ebx], 0x2e
je 0x406257
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406247
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406302
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406294
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406302
cmp byte [ebp - 0xd], 0
je 0x406302
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406302
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret