joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7083bc
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
cmp eax, 1
jne 0x7083d9
xor eax, eax
add esp, 0xc
ret
add esp, 0xc
jmp fcn.00707714

Function at 0x709778
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
call fcn.007070c8
test bh, 0xc0
jne 0x7060c3
mov eax, dword [0x7239a0]
mov ecx, 0xc000
and ecx, dword [eax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
mov ecx, eax
shr ecx, 8
mov esi, 3
cmp ecx, 6
ja 0x7060e7
sar eax, 6
mov esi, dword [eax + 0x7233e0]
mov eax, dword [esp + 0x40]
test bh, 1
je 0x70610f
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov al, byte [0x72341c]
and al, byte [esp + 0x48]
mov ebp, 0x80
js 0x706123
mov ebp, 1
jmp 0x706123
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
xor ebp, ebp
cmp eax, 0xffffffff
je 0x706123
mov ebp, eax
mov eax, ebx
and al, 3
je 0x70613c
cmp al, 2
je 0x706143
cmp al, 1
jne 0x70623f
mov edi, 0x40000000
jmp 0x706148
mov edi, 0x80000000
jmp 0x706148
mov edi, 0xc0000000
mov edx, ebx
and edx, 0x70
add edx, 0xfffffff0
shr edx, 4
cmp edx, 3
jb 0x70615d
mov edx, 3
xor ecx, ecx
cmp edi, 0x80000000
sete al
test bl, 4
je 0x706171
mov cl, al
mov edx, ecx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x70621c
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov dword [esp], esi
call fcn.00705ff8
test eax, eax
je 0x7061e5
or edi, 0x2000
and edi, 0xfffff8ff
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.00707288
mov edi, eax
cmp edi, 0xffffffff
jne 0x70624d
mov dword [esp], 4
call fcn.00707674
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov edi, 0xffffffff
jmp 0x70624d
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
test bh, 1
mov ecx, 0x50
jne 0x706233
mov ecx, 2
cmp eax, 0x6e
je 0x70623a
mov ecx, eax
mov dword [esp], ecx
jmp 0x706246
mov dword [esp], 1
call fcn.00707674
mov edi, eax
call fcn.00707118
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x7060a0
Function at 0x709790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
call fcn.007070c8
test bh, 0xc0
jne 0x70645b
mov eax, dword [0x7239a0]
mov ecx, 0xc000
and ecx, dword [eax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
mov ecx, eax
shr ecx, 8
mov esi, 3
cmp ecx, 6
ja 0x70647f
sar eax, 6
mov esi, dword [eax + 0x7233fc]
mov eax, dword [esp + 0x40]
test bh, 1
je 0x7064a7
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov al, byte [0x72341c]
and al, byte [esp + 0x48]
mov ebp, 0x80
js 0x7064bb
mov ebp, 1
jmp 0x7064bb
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesW
sub esp, 4
xor ebp, ebp
cmp eax, 0xffffffff
je 0x7064bb
mov ebp, eax
mov eax, ebx
and al, 3
je 0x7064d4
cmp al, 2
je 0x7064db
cmp al, 1
jne 0x7065d7
mov edi, 0x40000000
jmp 0x7064e0
mov edi, 0x80000000
jmp 0x7064e0
mov edi, 0xc0000000
mov edx, ebx
and edx, 0x70
add edx, 0xfffffff0
shr edx, 4
cmp edx, 3
jb 0x7064f5
mov edx, 3
xor ecx, ecx
cmp edi, 0x80000000
sete al
test bl, 4
je 0x706509
mov cl, al
mov edx, ecx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
lea eax, [esp + 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileW
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x7065b4
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov dword [esp], esi
call fcn.00705ff8
test eax, eax
je 0x70657d
or edi, 0x2000
and edi, 0xfffff8ff
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.00707288
mov edi, eax
cmp edi, 0xffffffff
jne 0x7065e5
mov dword [esp], 4
call fcn.00707674
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov edi, 0xffffffff
jmp 0x7065e5
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
test bh, 1
mov ecx, 0x50
jne 0x7065cb
mov ecx, 2
cmp eax, 0x6e
je 0x7065d2
mov ecx, eax
mov dword [esp], ecx
jmp 0x7065de
mov dword [esp], 1
call fcn.00707674
mov edi, eax
call fcn.00707118
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x706438
Function at 0x70ad74
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov dword [esp + 0x18], edx
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], 0x1001
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.00705c10
mov word [esp + eax + 0x1c], 0x5f
mov edi, dword [esi + 4]
mov dword [esp], ebp
call fcn.00705c10
lea ecx, [esp + eax + 0x1c]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], 0x1002
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.00705c10
mov word [esp + eax + 0x1c], 0x2e
mov edi, dword [esi]
mov dword [esp], ebp
call fcn.00705c10
lea eax, [esp + eax + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0xa
call fcn.0070e174
mov edi, dword [esi + 0x24]
test edi, edi
je 0x70ae68
mov dword [esp], edi
call fcn.00705c10
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00705c10
mov ecx, ebp
mov ebp, eax
mov dword [esp], ecx
call fcn.00705c10
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00705010
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x70aebd
jmp 0x70af05
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00705c10
mov ebx, eax
mov edi, ebp
mov dword [esp], ebp
call fcn.00705c10
mov ebp, eax
lea eax, [ebx + ebp + 3]
mov dword [esp], eax
call fcn.00704ff8
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x70af05
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00705c10
lea eax, [eax + ebp + 3]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.00705aab
mov ebp, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00705ac4
mov edi, dword [esi + 0x24]
mov dword [esp], edi
call fcn.00705c10
mov word [edi + eax], 0x3d
mov eax, dword [esi + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00705ac4
mov esi, dword [esi + 0x24]
mov dword [esp], esi
call fcn.00705c10
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x70af07
xor eax, eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x70c990
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00704ff8
add esp, 0x10
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00704ff8
add esp, 0x10
mov dword [edi], eax
test edi, edi
je 0x70ca03
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x70ca12
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
xor ecx, ecx
and ecx, ebx
mov dword [esp + 8], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00704ff8
add esp, 0x10
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00704ff8
add esp, 0x10
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00704ff8
add esp, 0x10
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp + 8]
sub esp, 0xc
push 4
call fcn.00704ff8
add esp, 0x10
mov esi, eax
test esi, esi
je 0x70cafc
push 4
push esi
push 0x11
push dword [esp + 0x2c]
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0xc
test eax, eax
je 0x70cb0b
push esi
call fcn.0070db4c
add esp, 0x10
mov word [edi + 0x14], ax
sub esp, 0xc
push esi
call fcn.00705008
add esp, 0x10
mov eax, 1
jmp 0x70cb16
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
jmp 0x70cb14
push esi
call fcn.00705008
add esp, 0x10
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7107bc
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov edi, eax
test edi, edi
je 0x710882
sub esp, 0xc
lea eax, [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
add esp, 0xc
movzx eax, word [esp + 0xa]
mov dword [esp + 0x18], eax
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 8]
movzx ebp, word [esp + 0x10]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x14]
movzx ebx, word [esp + 0x16]
sub esp, 0xc
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x3c]
push str._02d__02d__04d__02d:_02d:_02d._03d
push 0x740f04
call fcn.00717232
add esp, 0x24
push 0x740f04
call fcn.00705c10
add esp, 4
push 0
lea ebx, [esp + 0x18]
push ebx
push eax
push 0x740f04
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x40]
push esi
call fcn.00705c10
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x7108b4
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa0]
mov eax, dword [0x740f24]
test eax, eax
mov ecx, dword [0x740f20]
jne 0x710978
test ecx, ecx
jne 0x710978
cmp dword [0x724d78], 0
je 0x7109ae
sub esp, 4
lea esi, [esp + 0x14]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 4
push 0x5c
push esi
call fcn.00710030
add esp, 0x10
test eax, eax
jne 0x710924
sub esp, 8
push 0x3a
push esi
call fcn.00710030
add esp, 0x10
test eax, eax
je 0x710927
inc eax
mov esi, eax
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x710969
call sub.KERNEL32.DLL_GetCurrentThreadId
sub esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0x710a44
push eax
call fcn.00716e48
add esp, 4
cmp dword [esp + 0xc], 0
mov ecx, 0x11010
je 0x710969
mov ecx, 0x12010
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x7109fb
cmp ecx, 0xffffffff
je 0x7109fb
test ecx, ecx
je 0x71098f
sub esp, 0xc
push edi
call ecx
add esp, 0x10
mov eax, dword [0x740f24]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x7109fb
cmp byte [eax], 0
je 0x7109fb
sub esp, 8
push edi
push eax
call fcn.007107bc
add esp, 0xa0
jmp 0x710a01
sub esp, 0xc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea ebx, [esp + 0x1c]
push 0
push ebx
push 2
push 0x724ad8
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.00705c10
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x724ad8
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x711af4
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x744f5c]
test eax, eax
je 0x711b29
mov ecx, dword [eax]
test ecx, ecx
je 0x711b8c
add eax, 4
xor edi, edi
nop
cmp byte [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x711b14
jmp 0x711bb8
mov esi, dword [0x744fa8]
test esi, esi
jne 0x711b56
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x744fa8], esi
test esi, esi
jne 0x711b56
mov dword [esp], 0x724c14
call fcn.00710a24
mov esi, dword [0x744fa8]
mov dword [esp], esi
call fcn.00705c10
test eax, eax
je 0x711b90
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
call fcn.00705c10
test eax, eax
jne 0x711b74
inc ebx
jmp 0x711b97
xor edi, edi
jmp 0x711bb8
mov ebx, 1
xor edi, edi
mov dword [esp], ebx
call fcn.00704ff8
mov dword [0x744f58], eax
test eax, eax
je 0x711c11
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.007058e0
lea eax, [edi + 4]
mov dword [0x744f60], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.00704fdc
mov esi, eax
test esi, esi
je 0x711c11
mov edi, dword [0x744f5c]
test edi, edi
je 0x711c15
mov edx, dword [edi]
test edx, edx
je 0x711c4e
lea eax, [edi + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
cmp byte [edx], 0
je 0x711c04
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x711c05
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x711bf4
jmp 0x711c4a
xor eax, eax
jmp 0x711c61
mov ebx, dword [0x744f58]
mov dword [esp], ebx
call fcn.00705c10
test eax, eax
je 0x711c56
mov ebp, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp], ebx
lea ebx, [ebx + eax + 1]
mov dword [esp], ebx
call fcn.00705c10
add ebp, 4
test eax, eax
jne 0x711c34
test edi, edi
je 0x711c56
mov dword [esp], edi
call fcn.00705008
mov dword [0x744f5c], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x711d44
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x744f70]
test eax, eax
je 0x711d7a
mov ecx, dword [eax]
test ecx, ecx
je 0x711ddf
add eax, 4
xor edi, edi
nop
cmp word [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x711d64
jmp 0x711e0b
mov esi, dword [0x744fac]
test esi, esi
jne 0x711da7
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov esi, eax
mov dword [0x744fac], esi
test esi, esi
jne 0x711da7
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.00710a24
mov esi, dword [0x744fac]
mov dword [esp], esi
call fcn.007057c8
test eax, eax
je 0x711de3
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax*2 + 2]
mov dword [esp], ebp
call fcn.007057c8
test eax, eax
jne 0x711dc4
lea ebx, [ebx + ebx + 2]
jmp 0x711dea
xor edi, edi
jmp 0x711e0b
mov ebx, 2
xor edi, edi
mov dword [esp], ebx
call fcn.00704ff8
mov dword [0x744f6c], eax
test eax, eax
je 0x711e61
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.007058e0
lea eax, [edi + 4]
mov dword [0x744f74], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.00704fdc
mov esi, eax
test esi, esi
je 0x711e61
mov edi, dword [0x744f70]
test edi, edi
je 0x711e65
mov edx, dword [edi]
test edx, edx
je 0x711e9e
lea eax, [edi + 4]
xor ecx, ecx
nop
nop
nop
cmp word [edx], 0
je 0x711e54
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x711e55
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x711e44
jmp 0x711e9a
xor eax, eax
jmp 0x711eb1
mov ebx, dword [0x744f6c]
mov dword [esp], ebx
call fcn.007057c8
test eax, eax
je 0x711ea6
mov ebp, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp], ebx
lea ebx, [ebx + eax*2 + 2]
mov dword [esp], ebx
call fcn.007057c8
add ebp, 4
test eax, eax
jne 0x711e84
test edi, edi
je 0x711ea6
mov dword [esp], edi
call fcn.00705008
mov dword [0x744f70], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x712ad8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x64
mov esi, dword [esp + 0x70]
mov dword [esp], 0x744ff4
call sub.KERNEL32.DLL_EnterCriticalSection
sub esp, 4
mov eax, dword [0x7484a4]
cmp eax, 0x232
jl 0x712b42
mov eax, dword [esp + 0x74]
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0x20726f72
mov dword [esp + 0x1c], 0x72652065
mov dword [esp + 0x18], 0x726f6870
mov dword [esp + 0x14], 0x616d6553
mov dword [esp + 4], eax
lea edi, [esp + 0x14]
mov dword [esp], edi
call fcn.00705ac4
mov dword [esp], edi
call fcn.00710a24
mov eax, dword [0x7484a4]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x744ff4]
mov dword [esp], eax
call sub.KERNEL32.DLL_InitializeCriticalSection
sub esp, 4
mov eax, dword [0x7484a4]
lea ecx, [eax + 1]
mov dword [0x7484a4], ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x744ff4]
mov dword [esi], eax
mov dword [esp], 0x744ff4
call sub.KERNEL32.DLL_LeaveCriticalSection
add esp, 0x60
pop esi
pop edi
ret
Function at 0x712b88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x58
mov eax, dword [esp + 0x60]
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], 0x20726f72
mov dword [esp + 0x10], 0x72652065
mov dword [esp + 0xc], 0x726f6870
mov dword [esp + 8], 0x616d6553
mov dword [esp + 4], eax
lea esi, [esp + 8]
mov dword [esp], esi
call fcn.00705ac4
mov dword [esp], esi
call fcn.00710a24
add esp, 0x58
pop esi
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x6c557c82
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x66680c92
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x503722a7
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4e1e54c2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x778ebac0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x778ebafe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x778ebaf6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x778ebb00
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x778ebae6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x778ebbd0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x778ebbe6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x778ebc01
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x77916372
Capabilities:
Encode data using xor

Disassembly:
call 0x779162eb
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x7791631b
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x77916337
xor edx, 0
jmp 0x77916342
xor edx, edx
jmp 0x77916359
jmp 0x77916365
xor eax, eax
push 0x8427d7c0
call 0x77916372
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x779163ae
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x77916387
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x779163c5
add eax, 0
jno 0x779163ca
add esi, 0
ret 0x10