joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f0c0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0x2c
cmp dword [ecx + 0x50], eax
jne 0x100f11d
push esi
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0x20]
sub esi, dword [ebp - 0x24]
push 4
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
call sub.ESENT.dll_JetGetSystemParameterW
xor edx, edx
lea eax, [esi - 0x20000000]
div dword [ebp - 4]
push 0
lea ecx, [ebp - 8]
push eax
push 0x17
push 0xffffffffffffffff
push ecx
call sub.ESENT.dll_JetSetSystemParameterW
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100fdc0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x10034f4
mov ebx, eax
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100fe70
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, 0xfffffffe
je 0x100fe19
push 0xa
push 0x10034d0
push 0x100a05c
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0xc
mov eax, 0xfffffbf8
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x78
jne 0x100fe8c
test bl, 1
je 0x100fe2a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x100fe70
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x11
jne 0x100fe6c
push 0x10034b8
push 0x100a054
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 8
not ebx
and ebx, 1
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100fe70
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100fdfa
push 0xa
push 0x10034e4
push 0x100a05c
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x11
jne 0x100fe6c
push 0x100a048
push 0x100a038
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0xffffffff
test eax, eax
je 0x100feed
not ebx
and ebx, 1
push ebx
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0x100fc10
push esi
push edi
call eax
test eax, eax
je 0x100feed
mov eax, 1
neg eax
sbb eax, eax
and eax, 0x408
add eax, 0xfffffbf8
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
neg eax
sbb eax, eax
and eax, 0x408
add eax, 0xfffffbf8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10119d0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x101cdb0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
test byte [ebx + 0x28], 0x20
je 0x10119ff
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010140f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx]
push esi
lea eax, [ebp - 0x878]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebx]
mov esi, eax
cmp esi, 0xffffffff
je 0x1011a86
push 0
push 0
push 0
push 0
push 0x105
lea edx, [ebp - 0x41c]
push edx
push 0x105
lea eax, [ebp - 0x628]
push eax
push ecx
call fcn.01014519
push 0
push 0
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x210]
push 0x105
push ecx
call fcn.010143f0
add esp, 0x3c
lea edx, [ebp - 0x84c]
push edx
push 0x20a
lea eax, [ebp - 0x210]
push eax
call fcn.0100e050
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1011a98
push ecx
push 0x20a
lea edx, [ebp - 0x210]
push edx
call fcn.0100dfc0
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x1011ae3
xor eax, eax
lea edi, [ebp - 0x210]
call fcn.0100fdc0
mov edi, eax
test edi, edi
jge 0x1011ae3
mov eax, dword [ebx + 0x10]
mov esi, dword [sym.imp.msvcrt.dll_wprintf]
push eax
push 0x1003458
call esi
push 0xa
push 0xa
push 0x1009d48
call esi
add esp, 0x14
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010140f3
mov esp, ebp
pop ebp
ret
test byte [ebx + 0x28], 4
jne 0x1011b43
mov edi, dword [ebx + 0xc]
mov eax, 1
lea esi, [ebp - 0x210]
call fcn.0100fdc0
mov edi, eax
test edi, edi
jge 0x1011b39
mov edx, dword [ebx + 0xc]
mov ecx, esi
push ecx
push edx
mov eax, esi
mov esi, dword [sym.imp.msvcrt.dll_wprintf]
push eax
push 0x10032f0
call esi
push 0xa
push 0xa
push 0x1009d48
call esi
add esp, 0x1c
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010140f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop esi
mov eax, edi
xor ecx, ebp
pop edi
call fcn.010140f3
mov esp, ebp
pop ebp
ret
Function at 0x1013efe
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x101b230
call fcn.01014ce4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1037828
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1013d13
cmp eax, esi
jne 0x1013d06
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1013d16
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1013ced
xor esi, esi
inc esi
mov eax, dword [0x1037824]
cmp eax, esi
jne 0x1013d29
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1013d64
mov eax, dword [0x1037824]
test eax, eax
jne 0x1013d5e
mov dword [0x1037824], esi
push 0x1001250
push 0x1001244
call fcn.01013c6a
pop ecx
pop ecx
test eax, eax
je 0x1013d64
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1013e2e
mov dword [0x101d4a4], esi
mov eax, dword [0x1037824]
cmp eax, esi
jne 0x1013d88
push 0x1001240
push 0x1001234
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1037824], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1013d95
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1037838], ebx
je 0x1013db6
push 0x1037838
call fcn.01014c59
pop ecx
test eax, eax
je 0x1013db6
push ebx
push 2
push ebx
call dword [0x1037838]
push dword [0x101d48c]
push dword [0x101d490]
push dword [0x101d488]
call fcn.01011df0
add esp, 0xc
mov dword [0x101d4a0], eax
cmp dword [0x101d494], ebx
jne 0x1013e14
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x101d4a4], ebx
jne 0x1013e22
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101d4a0]
call fcn.01014d29
ret
call fcn.01014e31
jmp 0x1013ccb
Function at 0x10172a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x10172d4
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.010141e1
add esp, 0x14
jmp 0x10173b2
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x10173b2
test al, 0x40
jne 0x10173b2
test al, 2
je 0x10172f6
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x10173b2
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x10172b6
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x10173a2
cmp eax, 0xffffffff
je 0x10173a2
test byte [esi + 0xc], 0x82
jne 0x1017377
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x1017362
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x1017362
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x1017367
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x1017377
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x1017395
mov eax, dword [esi + 0xc]
test al, 8
je 0x1017395
test eax, 0x400
jne 0x1017395
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x10173b5
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1018bd5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x1018c04
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.010141e1
add esp, 0x14
jmp 0x1018cee
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x1018cee
test al, 0x40
jne 0x1018cee
test al, 2
je 0x1018c26
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x1018cee
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x1018be6
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x1018cde
cmp eax, 1
je 0x1018cde
cmp eax, 0xffffffff
je 0x1018cde
test byte [esi + 0xc], 0x82
jne 0x1018cb0
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x1018c9b
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x1018c9b
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x1018ca0
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x1018cb0
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x1018cce
mov eax, dword [esi + 0xc]
test al, 8
je 0x1018cce
test eax, 0x400
jne 0x1018cce
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x1018cf3
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1018d90
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax + 0x1cc]
push esi
mov esi, dword [eax + 0x1d4]
add ecx, 0xfff
shr ecx, 0xc
mov dword [eax + 0x1e4], esi
mov esi, dword [eax + 0x1d8]
shl ecx, 0xc
mov dword [eax + 0x1e8], esi
mov dword [ebp - 4], 0
mov dword [eax + 0x1d0], ecx
pop esi
test ecx, ecx
jne 0x1018de2
mov dword [edx], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
lea ecx, [eax + 0x1dc]
push ecx
mov ecx, dword [eax + 0x1d0]
lea edx, [ebp - 4]
push edx
mov edx, dword [eax + 0x1f0]
mov eax, dword [eax + 0x1c4]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1018dd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1018dd9
push 0x100b494
call fcn.0101a030
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1019040
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
cmp dword [edi + 0x1c8], ebx
push esi
jle 0x1019093
lea esi, [edi + 0x18]
mov eax, dword [esi - 4]
mov edx, dword [esi]
add eax, 0xfff
lea ecx, [esi - 0x18]
push ecx
shr eax, 0xc
push 0
shl eax, 0xc
push eax
mov eax, dword [edi + 0x1c0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1019087
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x101909b
inc ebx
add esi, 0x1c
cmp ebx, dword [edi + 0x1c8]
jl 0x1019051
pop esi
mov eax, 1
pop ebx
ret
push 0x100b5a0
call fcn.0101a030
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1019790
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push edi
push 0x101d7d8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, eax
dec edi
cmp edi, dword [0x1037818]
jge 0x1019853
mov ecx, dword [0x103781c]
test ecx, ecx
je 0x10197cf
xor edx, edx
lea eax, [edi + 1]
div ecx
test edx, edx
jne 0x10197cf
mov ecx, dword [0x101d810]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x101d804]
mov eax, dword [0x101d808]
mov edx, ecx
imul edx, edi
sub eax, edx
cmp ecx, eax
jge 0x10197e7
mov eax, ecx
mov dword [esi + 0x1c], eax
mov ecx, dword [0x101d804]
imul ecx, edi
mov dword [esi + 0x20], ecx
imul eax, dword [0x101d814]
mov dword [esi + 0x18], eax
mov eax, ecx
mov ecx, dword [0x101d7e0]
mov edx, eax
shl edx, cl
mov dword [esi + 8], edx
mov ecx, dword [0x101d7dc]
shr eax, cl
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x64]
push esi
push 0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x18]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101986b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x101986b
push 0x100b5a0
call fcn.0101a030
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x101986b
push 0x100ba80
call fcn.0101a030
pop edi
ret
Function at 0x10001070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
jmp 0x1000113c
lea eax, [ebp - 0x104]
push eax
call 0x100012e8
push 0x1000107e
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x10001209
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push 0x10001112
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x1000126e
mov dword [ebp - 0x10c], 0x103
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x10001102
push dword [ebp - 0x108]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x108]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x1000126e
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x100011ee
mov word [ebx], 0x5c
push 0x10001132
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x1000126e
mov dword [0x1000300c], eax
push 0x10001107
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x10001263
push eax
push 0x3ea
call eax
pop edx
test eax, eax
je 0x10001263
mov dword [0x10003008], eax
push 0x3eb
mov ebx, section..data
call edx
test eax, eax
je 0x10001263
mov dword [section..data], edx
call 0x1000124a
add dword [esp], 0x4db6
call eax
mov dword [0x10003004], eax
sub esp, 4
pop dword [0x10003010]
leave
ret
push dword [0x1000300c]
call sub.KERNEL32.dll_FreeLibrary
mov dword [0x1000300c], 0
mov dword [section..data], 0xffffffff
mov dword [0x10003010], 0
mov dword [0x10003004], 0
mov dword [0x10003008], 0
push 0x10
push 0x1000112c
push 0x10001088
push 0
call sub.USER32.dll_MessageBoxA
push 0xffffffffffffffff
call sub.KERNEL32.dll_ExitProcess
leave
ret

Function at 0x1000d130
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5e1e
jmp fcn.10001058

Function at 0x1000d13a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5eb2
jmp fcn.10001058

Function at 0x1000d144
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5e06
jmp fcn.10001058

Function at 0x1000d14e
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5de5
jmp fcn.10001058

Function at 0x1000d158
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5e12
jmp fcn.10001058
Function at 0x431000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x595d36b3
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x5802432d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4024ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x49a040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x4f2bd4]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x402512
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00402907
lea ecx, [esp + 0x1c]
call fcn.004022db
cmp eax, dword [esp + 0x14]
je 0x40252a
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00402a0b
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x4024e2
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042eafb
add esp, 0x2c
ret
mov edx, str.QwruxAA
call fcn.00402cdb
push eax
call fcn.00402f54
mov eax, dword [ebp + 0x24]
pop ecx
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00402a0b
jmp 0x402514
Function at 0x402606
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x49a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub cx, 0x1f9
mul edi
dec cx
mul di
mul ebx
sub ax, 0x22b
or edi, ebx
shr cx, 2
rcl eax, 0x6e
rol ax, 0x19
rcl cx, 0xcb
mul si
mov si, 0x1b0
rcr esi, 0xed
inc si
dec dx
movsx ebx, dh
movsx ecx, si
rcl cx, 0x33
mov edx, esi
shr ax, 0xb9
dec cx
ja 0x40266c
test edx, 0x43
ja 0x40268d
dec bx
imul eax
jmp 0x40267c
rol bx, 0x64
sub di, cx
ror esi, 0x18
ror ecx, 0xef
movsx ebx, bx
rcl eax, 0x5b
mul esi
jae 0x40268d
inc ax
movsx ecx, si
rcr ebx, 0x8e
jmp 0x4026a8
and ecx, 0x33b
ror edx, 0x56
rcr di, 0xc6
or esi, 0x389
movzx edi, al
movsx edi, si
imul edx
mul cx
ror ax, 0x4e
sub ebx, 0xb9
rcl cx, 0x60
jb 0x4026c7
imul si
mul eax
inc esi
xor bx, dx
inc ebx
jmp 0x4026d9
mul eax
add eax, edi
mov ax, 0x2a4
mul ebx
ror edi, 0xfc
xor di, 0xdb
movsx ecx, bh
dec bx
push str.IOanz_UZA891nNAIUsy_U_Ahy8_
lea ecx, [ebp - 0x1c]
call fcn.00402907
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040257a
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4f2bd4], eax
push 0x27
mov esi, 0x4eff30
mov edx, 0x547
push 0x49ab00
mov ecx, esi
call fcn.00402093
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.004024ab
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x402784
push 0x13
mov esi, 0x49ab30
mov edx, 0x55400
push 0x4f0480
mov ecx, esi
call fcn.00402093
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push esi
push 0x4f00b8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x34]
call fcn.00402a0b
lea ecx, [ebp - 0x1c]
call fcn.00402a0b
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042eafb
leave
ret 0x10
Function at 0x4060c3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x4060e4
jl 0x4060db
test edi, edi
jne 0x4060e4
xor eax, eax
xor edx, edx
jmp 0x4061a5
cmp dword [ebx + 0x38], 0
je 0x4060f9
push eax
push edi
push dword [ebp + 8]
call fcn.004061ab
jmp 0x4061a5
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x406140
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x406140
cmp eax, edi
jb 0x40611a
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00430770
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x406146
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40619a
mov ecx, ebx
call fcn.00405726
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x406185
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004588cd
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40619a
jmp 0x406158
test edx, edx
je 0x40619a
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004588cd
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x41ea7d
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x41eaa0
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x41ea8e
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x42e558
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0045b673
mov eax, dword [eax + 0x14]
test eax, eax
je 0x42e59b
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x42e59b
sub eax, 1
je 0x42e596
sub eax, 1
je 0x42e592
xor eax, eax
leave
ret
push 3
jmp 0x42e59d
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x42feb6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42fef5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42fef5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42fef5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42fef5
cmp dword [ecx + 0x74], 0xe
jbe 0x42fef5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x46bbd4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x48e9ec
push 0x48e9e4
push str.FlsAlloc
push 0x1e
call fcn.0046b8a4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46bc08
push dword [ebp + 8]
mov ecx, esi
call dword [0x489168]
call esi
jmp 0x46bc0e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x46bc52
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x48e9fc
push 0x48e9f4
push str.FlsGetValue
push 0x20
call fcn.0046b8a4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46bc89
push dword [ebp + 8]
mov ecx, esi
call dword [0x489168]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]