joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x390039
mov dword [ebp - 0x54], 0x370039
mov dword [ebp - 0x50], 0x360045
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x330033
mov dword [ebp - 0x44], 0x340036
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x330030
mov dword [ebp - 0x38], 0x2d0038
mov dword [ebp - 0x34], 0x440038
mov dword [ebp - 0x30], 0x310038
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x330046
mov dword [ebp - 0x24], 0x420045
mov dword [ebp - 0x20], 0x360046
mov dword [ebp - 0x1c], 0x320038
mov dword [ebp - 0x18], 0x420036
mov dword [ebp - 0x14], 0x45
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003c7de
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1003c7be
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c7a0
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1003c7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f368
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x690059
mov dword [ebp - 0x64], 0x67006e
mov dword [ebp - 0x60], 0x610079
mov dword [ebp - 0x5c], 0x43006e
mov dword [ebp - 0x58], 0x6e006f
mov dword [ebp - 0x54], 0x690066
mov dword [ebp - 0x50], 0x430067
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x530072
mov dword [ebp - 0x40], 0x750074
mov dword [ebp - 0x3c], 0x500062
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x570078
mov dword [ebp - 0x2c], 0x64006e
mov dword [ebp - 0x28], 0x6c0043
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x4e0073
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x5f0065
mov word [ebp - 0x14], ax
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003c92b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1003c90b
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c8f0
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3

Function at 0x1003c940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x4f0053
mov dword [ebp - 0x30], 0x540046
mov dword [ebp - 0x2c], 0x410057
mov dword [ebp - 0x28], 0x450052
mov dword [ebp - 0x24], 0x59005c
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x790067
mov dword [ebp - 0x18], 0x6e0061
mov word [ebp - 0x14], ax
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003ca19
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000ac20
test al, al
jne 0x1003c9fb
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c9e0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009f28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10009af6
int3
Function at 0x1003cb00
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x1003cc69
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.10040d30
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x1003cb6f
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x1003cb61
mov eax, dword [0x1007e7ac]
mov esi, dword [eax]
cmp esi, eax
je 0x1003cc69
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.10040d30
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x1003cc90
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov word [ebp - 8], ax
cmp ecx, 3
jne 0x1003cc21
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
jne 0x1003cc7c
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x1003cc47
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1003cc43
cmp esi, dword [eax + 8]
jne 0x1003cc43
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1003cc33
mov esi, eax
jmp 0x1003cc5d
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x1003cc5d
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x1003cc51
cmp esi, dword [0x1007e7ac]
jne 0x1003cb90
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
mov esp, ebp
pop ebp
ret
Function at 0x1003d170
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ff4a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1007b4bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003d334
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003d33e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.1000ada5
mov ecx, eax
test ecx, ecx
je 0x1003d348
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1003d252
xor ecx, ecx
jmp 0x1003d270
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003d260
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10009f28
push edi
mov ecx, ebx
call fcn.1002e5f0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1003d28c
xor ecx, ecx
jmp 0x1003d2a4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003d294
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10009f28
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1003dc20
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1002e5f0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003d2e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1003d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003d31e
cmp dword [esi + 0x10], 0
je 0x1003d315
push dword [edi]
call fcn.1004af66
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10009af6
push 0x80004005
call fcn.10009af6
push 0x80004005
call fcn.10009af6
int3
Function at 0x1003da20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060038
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003dbf4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003da75
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1003dbf4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003da93
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1003dbf4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003dab1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1003dbf4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003dacf
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1003dbf4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003dbf4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1003daf4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1003db27
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1003db3f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1003db7d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.1001b877
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.10040740
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x10067100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1001b896
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003dbab
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1003dbe4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003dbe4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10023a45
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10009abe
lea ecx, [ebp - 0x28]
call fcn.10009abe
lea ecx, [ebp - 0x34]
call fcn.1003d400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 4
Function at 0x1003df90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100600f7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1003dfda
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003dfe6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.1002846b
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x1003e053
push 0x48
call fcn.1003f5a0
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1003e047
push 0x48
push 0
push ebx
call fcn.10040d30
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.1003d170
jmp 0x1003e049
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003e080
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.1002846b
push 3
push 0x10067100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1001b8bd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003e0cf
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1003e11e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003e11e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1002846b
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10009abe
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1003e154
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003e14a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003e191
push edx
push ecx
call fcn.1003eead
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x1003e173
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret 0x14
call fcn.10045d8b
int3
Function at 0x1003ff80
Capabilities:
Check if file exists
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10077ed0
push 0x10042910
mov eax, dword fs:[0]
push eax
sub esp, 0x57c
mov eax, dword [0x1007b4bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
test esi, esi
je 0x100400fa
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100400fa
push 0x118
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.10040d30
add esp, 0xc
mov dword [ebp - 0x548], 0x11c
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x544], 6
jae 0x10040013
mov eax, 1
jmp 0x100400fc
mov dword [ebp - 0x58c], 0x10
mov dword [ebp - 0x588], esi
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x42c], 0xaac56b
mov dword [ebp - 0x428], 0x11d0cd44
mov dword [ebp - 0x424], 0xc000c28c
mov dword [ebp - 0x420], 0xee95c24f
xor eax, eax
mov dword [ebp - 0x57c], 0x30
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x570], 2
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x560], 1
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x558], eax
or eax, 0x1080
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], 0
lea eax, [ebp - 0x58c]
mov dword [ebp - 0x564], eax
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
je 0x10040118
cmp eax, 0x800b0101
je 0x10040118
cmp eax, 0x800b0109
je 0x10040118
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003eec9
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x55c]
call sub.WINTRUST.dll_WTHelperProvDataFromStateData
test eax, eax
je 0x100401af
cmp dword [eax + 0x40], 0
jbe 0x100401af
mov eax, dword [eax + 0x44]
test eax, eax
je 0x100401af
mov eax, dword [eax + 0x28]
test eax, eax
je 0x100401af
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x100401af
cmp dword [eax + 0xc], 0
jbe 0x100401af
mov eax, dword [ecx]
test eax, eax
je 0x100401af
cmp dword [eax + 0xc], 0
jbe 0x100401af
mov eax, dword [eax + 0x10]
test eax, eax
je 0x100401af
mov eax, dword [eax]
test eax, eax
je 0x100401af
mov esi, dword [eax + 4]
test esi, esi
je 0x100401af
push 0x400
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.10040d30
add esp, 0xc
push 0x200
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 4
push esi
call dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
dec eax
mov ecx, 1
cmp eax, 0x1fe
cmovbe edi, ecx
mov dword [ebp - 0x54c], edi
mov esi, dword [ebp - 0x55c]
push 0x30
push 0
lea eax, [ebp - 0x57c]
push eax
call fcn.10040d30
add esp, 0xc
mov dword [ebp - 0x57c], 0x30
mov dword [ebp - 0x55c], esi
mov dword [ebp - 0x560], 2
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x100400fc
Function at 0x10050023
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004fea2
Function at 0x439fb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x43a05a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x43a076
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x43a076
sub dx, 0x20
je 0x43a050
sub dx, 0x80
je 0x43a050
sub dx, 0x1f62
jb 0x43a076
sub dx, 1
jbe 0x43a050
sub dx, 6
je 0x43a050
sub dx, 0x26
jne 0x43a076
nop
jmp 0x43a050
cmp eax, dword [ebp - 0x20]
jg 0x439ff8
lea esi, [esi]
jmp 0x43a076
cmp dword [ebp - 0x1c], 2
jne 0x43a06a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x43a076
mov al, byte [ebp - 0xc]
call fcn.0040ea10
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x43a0f4
sub ax, 0x21
je 0x43a108
sub ax, 0x17
je 0x43a114
sub ax, 0x222
je 0x43a120
sub ax, 0x392
je 0x43a128
sub ax, 1
je 0x43a130
sub ax, 0x1996
je 0x43a138
sub ax, 1
je 0x43a140
sub ax, 6
je 0x43a148
sub ax, 0xb
je 0x43a158
sub ax, 0x1b
je 0x43a150
sub ax, 0x367
je 0x43a160
jmp 0x43a168
mov ax, word [ebp - 0x24]
call fcn.0040ea80
mov byte [ebp - 0x10], al
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x2e
jmp 0x43a170
mov byte [ebp - 0x10], 0x27
jmp 0x43a170
mov byte [ebp - 0x10], 0x2c
jmp 0x43a170
mov byte [ebp - 0x10], 0x27
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x2d
jmp 0x43a170
mov byte [ebp - 0x10], 0x27
jmp 0x43a170
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x450240
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx