joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10044140
Capabilities:
Get geographical location

Disassembly:
push esi
mov edi, dword [eax + 0x34c]
call 0x1008794d
pop ecx
mov ecx, dword [ebx + 0x64]
mov esi, eax
neg ecx
lea eax, [ebp - 0xf4]
push 0x78
sbb ecx, ecx
and ecx, 0xfffff005
add eax, 0x50fffff0
add ecx, 0x1002
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
invalid
jne 0x10044162
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x54]
call 0x100795c9
and dword [ebp - 0xf8], 0
pop ecx
pop ecx
test eax, eax

Function at 0x1004417c
Capabilities:
Get geographical location

Disassembly:
and dword [edi], 0
xor eax, eax
inc eax
jmp 0x10087898
jne 0x1004422f
push 0x78
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebx + 0x60]
neg eax
sbb eax, eax
and eax, 0xfffff002
add eax, 0x1001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10044157
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1007960f
pop ecx
pop ecx
test eax, eax
mov eax, dword [edi]
mov ecx, 0x300
and eax, ecx

Function at 0x100441bb
Capabilities:
Get geographical location

Disassembly:
jne 0x100441c8
or dword [edi], 0x304
mov dword [edi + 4], esi
jmp 0x1004422c
test byte [edi], 2
jne 0x1004422f
cmp dword [ebx + 0x5c], 0
je 0x10044215
push dword [ebx + 0x5c]
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x10079417
add esp, 0xc
test eax, eax
jne 0x10044215
or dword [edi], 2
mov dword [edi + 8], esi
mov ecx, dword [ebx + 0x50]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xf8]
jne 0x100441f8
sub ecx, edx
sar ecx, 1
cmp ecx, dword [ebx + 0x5c]
jne 0x1004422f
mov dword [edi + 4], esi
jmp 0x1004422f
mov edx, dword [edi]
test dl, 1
jne 0x1004422f
push esi
call 0x10087b77
pop ecx
test eax, eax
je 0x1004422f
or edx, 1
mov dword [edi], edx
mov dword [edi + 8], esi

Function at 0x10044238
Capabilities:
Get geographical location

Disassembly:
cmp eax, ecx
je 0x1004432c
mov ecx, dword [ebx + 0x60]
lea eax, [ebp - 0xf4]
neg ecx
push 0x78
sbb ecx, ecx
and ecx, 0xfffff002
push eax
add ecx, 0x1001
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1004426f
mov dword [edi], eax
jmp 0x100877c9
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x100796d6
pop ecx
pop ecx
test eax, eax
jne 0x100442ec
or dword [edi], 0x200
mov edx, dword [edi]
cmp dword [ebx + 0x60], eax
je 0x100442a1
or edx, 0x100
mov dword [edi], edx
cmp dword [edi + 4], eax
jmp 0x100879c8
cmp dword [ebx + 0x5c], eax
je 0x10044291
mov ecx, dword [ebx + 0x50]
lea eax, [ecx + 2]
mov dword [ebp - 0xfc], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xf8]
jne 0x100442b2
sub ecx, dword [ebp - 0xfc]
sar ecx, 1
cmp ecx, dword [ebx + 0x5c]
jne 0x100442e8
push edi
push 1
push esi
call 0x10087c50
add esp, 0xc
test eax, eax
je 0x1004432c
dec esi
or dword [edi], 0x100
xor eax, eax
jmp 0x10044299
xor eax, eax
jmp 0x10044291
xor eax, eax
mov eax, dword [edi]
shr eax, 2
not eax
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x1006be04
mov esp, ebp
pop ebp
ret 4
Function at 0x10044370
Capabilities:
Get geographical location

Disassembly:
push esi
mov edi, dword [eax + 0x34c]
call 0x10087b9d
pop ecx
mov ecx, dword [ebx + 0x60]
mov esi, eax
neg ecx
lea eax, [ebp - 0xf4]
push 0x78
sbb ecx, ecx
and ecx, 0xfffff002
push eax
add ecx, 0x1001
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x100443ac
and dword [edi], eax
inc eax
jmp 0x1004440e
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x10079813
pop ecx
pop ecx
test eax, eax
jne 0x100443cb
cmp dword [ebx + 0x60], eax
jne 0x100443fb
push edi
push 1
jmp 0x100443ee
cmp dword [ebx + 0x60], 0
jne 0x10044404
cmp dword [ebx + 0x5c], 0
je 0x10044404
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1007983e
pop ecx
pop ecx
test eax, eax
jne 0x10044404
push edi
push eax
push esi
call 0x10087d6d
add esp, 0xc
test eax, eax
je 0x10044404
or dword [edi], 4
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov eax, dword [edi]
shr eax, 2
not eax
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x1006bedc
mov esp, ebp
pop ebp
ret 4

Function at 0x100444d3
Capabilities:
Get geographical location

Disassembly:
mov di, word [edx]
cmp di, word [esi]
jne 0x100444f1
test di, di
je 0x100444f6
mov di, word [edx + 2]
cmp di, word [esi + 2]
jne 0x100444f1
add edx, 4
add esi, 4
test di, di
jne 0x100444cd
jmp 0x100444f6
sbb eax, eax

Function at 0x100444f3
Capabilities:
Get geographical location

Disassembly:
or eax, 1
test eax, eax
jne 0x1004451a
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push 0x2000000b
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1004453e
mov eax, dword [ebp - 4]
jmp 0x1004454f
push ecx
call 0x10078945
pop ecx
jmp 0x1004454f
xor eax, eax
jmp 0x1004454f
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100445a5
Capabilities:
Get geographical location

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x100445b3
xor eax, eax
jmp 0x100445e3
cmp esi, dword [ebp - 4]
je 0x100445e0
cmp dword [ebp + 0xc], 0
je 0x100445e0
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100445c4
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call 0x10087aa8
pop ecx
cmp eax, esi
je 0x100445af
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100446c8
Capabilities:
Get geographical location

Disassembly:
je 0x100446bd
mov eax, dword [0x1006800c]
push edi
dec eax
push eax
push 0x10067ef8
call 0x1008809e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10044734
cmp word [eax], dx

Function at 0x100446c9
Capabilities:
Get geographical location

Disassembly:
je 0x10044734
mov eax, dword [edi]
test eax, eax
je 0x100446e1
cmp word [eax], dx
je 0x100446e1
lea eax, [ebp - 0x10]
push eax
call 0x10087ab0
jmp 0x100446ea
invalid
inc ebp
Function at 0x10044748
Capabilities:
Get geographical location

Disassembly:
pop ecx
jmp 0x1004475e
xor edi, edi
cmp dword [ebp - 0x10], 0
jne 0x1004477b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x1006c236
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call 0x10088003
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10044766
cmp esi, 0xfde8
je 0x10044766
cmp esi, 0xfde9
je 0x10044766
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10044766
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10044766
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100447cf
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call 0x10081b1c
test ebx, ebx
je 0x10044845
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call 0x10081b32
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10044766
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10044766
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call 0x100895ac
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100883b5

Function at 0x100497a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1008c070]
xor eax, ebp
lds ecx, [ecx - 0x72af0fbb]
inc ebp
hlt
mov dword fs:[0], eax
mov eax, 1
imul ecx, eax, 0x35
mov byte [ebp + ecx - 0x64], 0x74
mov edx, 1
imul eax, edx, 0x27
mov byte [ebp + eax - 0x64], 0x6f
mov ecx, 1
shl ecx, 5
mov byte [ebp + ecx - 0x64], 0x6e
mov edx, 1
imul eax, edx, 0x15
mov byte [ebp + eax - 0x64], 0x6e
mov ecx, 1
imul edx, ecx, 0x22
mov byte [ebp + edx - 0x64], 0x56
mov eax, 1
imul ecx, eax, 0x29
mov byte [ebp + ecx - 0x64], 0x5c
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x64], 0x72
mov ecx, 1
imul edx, ecx, 0x2e
mov byte [ebp + edx - 0x64], 0x72
mov eax, 1
imul ecx, eax, 0x18
mov byte [ebp + ecx - 0x64], 0x77
mov edx, 1
add byte [eax], al
imul eax, edx, 0x39
mov byte [ebp + eax - 0x64], 0x67
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x64], 0x53
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x64], 0x66
mov ecx, 1
imul edx, ecx, 3
rol dword [ebx], 1
mov byte [ebp + edx - 0x64], 0x74
mov eax, 1
imul ecx, eax, 0x1b
mov byte [ebp + ecx - 0x64], 0x43
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x64], 0x77
mov eax, 1
imul ecx, eax, 0x23
and eax, esi
inc esp
or eax, 0x1ba659c
add byte [eax], al
add byte [ebx - 0x3e], ch
adc esi, eax
inc esp
add eax, 0x1b9749c
add byte [eax], al
add byte [ebx - 0x2f], ch
xor eax, esi
inc esp
adc eax, 0x1b8539c
add byte [eax], al
add byte [ebx - 0x38], ch
mov byte ss:[ebp + ecx - 0x64], 0x74
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x64], 0x61
mov ecx, 1
imul edx, ecx, 0x1e
Function at 0x10049884
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1008c070]
xor eax, ebp
lds ecx, [ecx - 0x72af0fbb]
inc ebp
hlt
mov dword fs:[0], eax
mov eax, 1
imul ecx, eax, 0x35
mov byte [ebp + ecx - 0x64], 0x74
mov edx, 1
imul eax, edx, 0x27
mov byte [ebp + eax - 0x64], 0x6f
mov ecx, 1
shl ecx, 5
mov byte [ebp + ecx - 0x64], 0x6e
mov edx, 1
imul eax, edx, 0x15
mov byte [ebp + eax - 0x64], 0x6e
mov ecx, 1
imul edx, ecx, 0x22
mov byte [ebp + edx - 0x64], 0x56
mov eax, 1
imul ecx, eax, 0x29
mov byte [ebp + ecx - 0x64], 0x5c
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x64], 0x72
mov ecx, 1
imul edx, ecx, 0x2e
mov byte [ebp + edx - 0x64], 0x72
mov eax, 1
imul ecx, eax, 0x18
mov byte [ebp + ecx - 0x64], 0x77
mov edx, 1
add byte [eax], al
imul eax, edx, 0x39
mov byte [ebp + eax - 0x64], 0x67
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x64], 0x53
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x64], 0x66
mov ecx, 1
imul edx, ecx, 3
rol dword [ebx], 1
mov byte [ebp + edx - 0x64], 0x74
mov eax, 1
imul ecx, eax, 0x1b
mov byte [ebp + ecx - 0x64], 0x43
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x64], 0x77
mov eax, 1
imul ecx, eax, 0x23
and eax, esi
inc esp
or eax, 0x1ba659c
add byte [eax], al
add byte [ebx - 0x3e], ch
adc esi, eax
inc esp
add eax, 0x1b9749c
add byte [eax], al
add byte [ebx - 0x2f], ch
xor eax, esi
inc esp
adc eax, 0x1b8539c
add byte [eax], al
add byte [ebx - 0x38], ch
mov byte ss:[ebp + ecx - 0x64], 0x74
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x64], 0x61
mov ecx, 1
imul edx, ecx, 0x1e

Function at 0x100498c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp + edx - 0x64], 0x72
mov eax, 1
imul ecx, eax, 0x2c
mov byte [ebp + ecx - 0x64], 0x74
mov edx, 1
imul eax, edx, 0x19
mov byte [ebp + eax - 0x64], 0x73
mov ecx, 1
add byte [eax], al
add cl, al
loope 0x100498f0

Function at 0x100498e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add cl, al
loope 0x100498f0
mov byte [ebp + ecx - 0x64], 0x5c
pushfd
pop esp
mov edx, 1
imul eax, edx, 0x31
mov byte [ebp + eax - 0x64], 0x74
mov ecx, 1
imul edx, ecx, 0x1f
mov byte [ebp + edx - 0x64], 0x65
mov eax, 1
add byte [ebx - 0x38], ch
adc al, dh
inc esp
or eax, 0x1ba5c9c
add byte [eax], al
invalid
invalid

Function at 0x10049935
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [ebx - 0x38], ch
enter 0xffffffffffffc63a, 0x44

Function at 0x10049939
Capabilities:
Contain obfuscated stackstrings

Disassembly:
enter 0xffffffffffffc63a, 0x44
or eax, 0x1ba739c
add byte [eax], al
add byte [ebx - 0x3e], ch
and al, 0xc6
inc esp
add eax, 0x1b9729c
add byte [eax], al
add byte [ebx - 0x2f], ch
mov byte es:[ebp + edx - 0x64], 0x69
mov eax, 1
imul ecx, eax, 0x2a
mov byte [ebp + ecx - 0x64], 0x49
mov edx, 1
imul eax, edx, 0x2d
mov byte [ebp + eax - 0x64], 0x65
mov ecx, 1
imul edx, ecx, 0x34
mov byte [ebp + edx - 0x64], 0x65
mov eax, 1
imul ecx, eax, 0x37
mov byte [ebp + ecx - 0x64], 0x69
mov edx, 1
imul eax, edx, 0x16
Function at 0x100499b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
or eax, 0x1ba699c
add byte [eax], al
add byte [ebx - 0x3e], ch
push ss
mov byte [ebp + eax - 0x64], 0x64
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x64], 0x6f
mov edx, 1
imul eax, edx, 0x17
mov byte [ebp + eax - 0x64], 0x6f
mov ecx, 1
add byte [ebx - 0x2f], ch
xor al, dh
inc esp
adc eax, 0x1b8209c
add byte [eax], al
add byte [ebx - 0x38], ch
sbb eax, 0x9c0d44c6
jb 0x1004998a
add dword [eax], eax
add byte [eax], al
add byte [ebx - 0x2f], ch
xor al, dh
inc esp
adc eax, 0x1b8209c
add byte [eax], al
add byte [ebx - 0x38], ch
sbb eax, 0x9c0d44c6
jb 0x1004998a
add dword [eax], eax
add byte [eax], al
imul eax, edx, 0x21
mov byte [ebp + eax - 0x64], 0x74
mov ecx, 1
add byte [eax], al
add byte [ebx - 0x2f], ch
das

Function at 0x100499de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [ebx - 0x2f], ch
das
mov byte [ebp + edx - 0x64], 0x6e
mov eax, 1
add dword [eax], eax
add byte [eax], al
imul ecx, eax, 0x25
mov byte [ebp + ecx - 0x64], 0x73
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x64], 0x6f
mov ecx, 1
imul edx, ecx, 0x38
mov byte [ebp + edx - 0x64], 0x6e
mov eax, 1
imul ecx, eax, 0xf
Function at 0x10049ab8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x64], 0x4d
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x64], 0x69
mov edx, 1
imul eax, edx, 0x2b
mov byte [ebp + eax - 0x64], 0x6e
pushfd
outsb dx, byte [esi]
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x64], 0x69
mov eax, 1
imul ecx, eax, 0x3b
mov dword [ebp - 0x8c], ecx
cmp dword [ebp - 0x8c], 0x3c
jae 0x10049a91
jmp 0x10049a96
call 0x10071c5c
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x64], 0
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x64], 0x72
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x64], 0x63
add eax, 0x1b9639c
add byte [eax], al
add byte [ebx - 0x2f], ch
sbb al, dh
inc esp
adc eax, 0x1b85c9c
add byte [eax], al
add byte [ebx - 0x38], ch
xor dh, al
inc esp
or eax, 0x1ba659c
add byte [eax], al
add byte [ebx - 0x3e], ch
pop es
mov byte [ebp + eax - 0x64], 0x65
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x50
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x1c], 0x6e
outsb dx, byte [esi]
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x79
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x65
or eax, 0x1ba65e4
add byte [eax], al
add byte [ebx - 0x3e], ch
add eax, esi
inc esp
add eax, 0x1b978e4
add byte [eax], al
add byte [ebx - 0x2f], ch
pop es
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x72
mov ecx, 1
imul edx, ecx, 0xb
mov dword [ebp - 0x90], edx
cmp dword [ebp - 0x90], 0xc
jae 0x10049b6f
jmp 0x10049b74
call 0x10071d3a
mov eax, dword [ebp - 0x90]
mov byte [ebp + eax - 0x1c], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x62
mov edx, 1
add dword [eax], eax
add byte [eax], al
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x45
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x28], 0x76
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x28], 0x78
mov ecx, 1
add byte [eax], al
add cl, al
loope 0x10049bbd
mov byte [ebp + ecx - 0x28], 0x79
mov edx, 1
add byte [eax], al
imul eax, edx, 9
mov byte [ebp + eax - 0x28], 0x65
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x28], 0x72
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x28], 0x53
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x28], 0x65
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x28], 0x72
mov edx, 1
imul eax, edx, 0xb
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xc
jae 0x10049c1a
jmp 0x10049c1f
call 0x10071de5
mov ecx, dword [ebp - 0x94]
mov byte [ebp + ecx - 0x28], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x28], 0x6f
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x28], 0x72
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x28], 0x50
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb0], esp
lea edx, [ebp - 0x1c]
push edx
call 0x1004edc4
invalid
invalid
Function at 0x10049b2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x64], 0x4d
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x64], 0x69
mov edx, 1
imul eax, edx, 0x2b
mov byte [ebp + eax - 0x64], 0x6e
pushfd
outsb dx, byte [esi]
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x64], 0x69
mov eax, 1
imul ecx, eax, 0x3b
mov dword [ebp - 0x8c], ecx
cmp dword [ebp - 0x8c], 0x3c
jae 0x10049a91
jmp 0x10049a96
call 0x10071c5c
mov edx, dword [ebp - 0x8c]
mov byte [ebp + edx - 0x64], 0
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x64], 0x72
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x64], 0x63
add eax, 0x1b9639c
add byte [eax], al
add byte [ebx - 0x2f], ch
sbb al, dh
inc esp
adc eax, 0x1b85c9c
add byte [eax], al
add byte [ebx - 0x38], ch
xor dh, al
inc esp
or eax, 0x1ba659c
add byte [eax], al
add byte [ebx - 0x3e], ch
pop es
mov byte [ebp + eax - 0x64], 0x65
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x50
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x1c], 0x6e
outsb dx, byte [esi]
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x79
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x65
or eax, 0x1ba65e4
add byte [eax], al
add byte [ebx - 0x3e], ch
add eax, esi
inc esp
add eax, 0x1b978e4
add byte [eax], al
add byte [ebx - 0x2f], ch
pop es
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x72
mov ecx, 1
imul edx, ecx, 0xb
mov dword [ebp - 0x90], edx
cmp dword [ebp - 0x90], 0xc
jae 0x10049b6f
jmp 0x10049b74
call 0x10071d3a
mov eax, dword [ebp - 0x90]
mov byte [ebp + eax - 0x1c], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x62
mov edx, 1
add dword [eax], eax
add byte [eax], al
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x45
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x28], 0x76
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x28], 0x78
mov ecx, 1
add byte [eax], al
add cl, al
loope 0x10049bbd
mov byte [ebp + ecx - 0x28], 0x79
mov edx, 1
add byte [eax], al
imul eax, edx, 9
mov byte [ebp + eax - 0x28], 0x65
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x28], 0x72
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x28], 0x53
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x28], 0x65
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x28], 0x72
mov edx, 1
imul eax, edx, 0xb
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xc
jae 0x10049c1a
jmp 0x10049c1f
call 0x10071de5
mov ecx, dword [ebp - 0x94]
mov byte [ebp + ecx - 0x28], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x28], 0x6f
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x28], 0x72
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x28], 0x50
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb0], esp
lea edx, [ebp - 0x1c]
push edx
call 0x1004edc4
invalid
invalid
Function at 0x1004b174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fsub dword [eax]
mov eax, 1
shl eax, 3

Function at 0x1004eac5
Capabilities:
Get disk information

Disassembly:
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1004eb50
mov edx, 2
shl edx, 1
mov eax, 0x75
mov word [ebp + edx - 0x18], ax
movsb byte es:[edi], byte [esi]
loope 0x1004eaee
add byte [eax], al
imul edx, ecx, 3
mov dword [ebp - 0x650], edx
cmp dword [ebp - 0x650], 8
add ecx, dword [ecx - 0x64f6b]
inc dword [ebx - 0x64f43]
dec dword [eax]
jae 0x1004eb00
jmp 0x1004eb05
call 0x10076ccb
xor eax, eax
mov ecx, dword [ebp - 0x650]
mov word [ebp + ecx - 0x18], ax
shl cl, 1
add al, 0
add byte [eax], al
shl edx, 0
mov eax, 0x6c
mov word [ebp + edx - 0x18], ax
loope 0x1004eb07
add al, 0
add byte [ebx - 0x2f], ch
add byte [eax + 0x25], bh
mov word [ebp + edx - 0x18], ax
mov ecx, dword [ebp - 0x640]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x63c]
push eax
call 0x1006b66d
add esp, 0xc
lea ecx, [ebp - 0x63c]
push ecx
mov ecx, dword [ebp + 8]
call 0x1006ae0f
mov edx, dword [ebp - 0x654]
or edx, 1
mov dword [ebp - 0x654], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x63c]
call 0x1006ad10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x10076659
mov esp, ebp
pop ebp
ret

Function at 0x1004ebfb
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
add byte [eax], al
add cl, al
loopne 0x1004ec06
mov ecx, 0x72
mov word [ebp + eax - 0x98], cx
mov edx, 2
imul eax, edx, 0x14
mov ecx, 0x69
mov word [ebp + eax - 0x98], cx
mov edx, 2
imul eax, edx, 0xa
mov ecx, 0x69
mov word [ebp + eax - 0x98], cx
mov edx, 2
imul eax, edx, 0x1f
mov ecx, 0x75
mov word [ebp + eax - 0x98], cx
mov edx, 2
imul eax, edx, 5
mov ecx, 0x41
mov word [ebp + eax - 0x98], cx
mov edx, 2
shl edx, 3
mov eax, 0x5c
mov word [ebp + edx - 0x98], ax
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x53
mov word [ebp + edx - 0x98], ax
mov ecx, 2
imul edx, ecx, 0xe
mov eax, 0x73
mov word [ebp + edx - 0x98], ax
mov ecx, 2
shl ecx, 4
mov edx, 0x66
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0xb
mov edx, 0x63
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x27
mov edx, 0x72
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 3
mov edx, 0x54
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x1a
mov edx, 0x20
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x13
mov edx, 0x57
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x23
mov edx, 0x6e
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x29
mov edx, 0x69
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x22
mov edx, 0x65
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x1b
mov edx, 0x4e
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 7
mov edx, 0x45
mov word [ebp + ecx - 0x98], dx
mov eax, 2
imul ecx, eax, 0x12
mov edx, 0x5c
mov word [ebp + ecx - 0x98], dx
mov eax, 2
add byte [eax], al