joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d097
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4cf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49d0e2
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0049d54f
test al, al
jne 0x49d0dc
sub edx, 2
cmp edx, edi
jne 0x49d0c2
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49d104
lea eax, [edi + 2]
cmp edx, eax
je 0x49d104
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049cc90
add esp, 0x10
jmp 0x49d1fe
push esi
lea ecx, [ebp - 0x255]
call fcn.0049d54f
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49d147
push dword [ebp - 0x25c]
jmp 0x49d0f4
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49d184
cmp word [ebp - 0x226], 0
je 0x49d1a5
cmp word [ebp - 0x226], ax
jne 0x49d184
cmp word [ebp - 0x224], 0
je 0x49d1a5
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049cc90
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49d1f1
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49d15e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49d1d9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49d1fe
push 0x49c678
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040546b
add esp, 0x10
jmp 0x49d1ce
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040300d
leave
ret

Function at 0x4a2b60
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040425f
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4a2bcf
cmp esi, dword [ebp - 4]
je 0x4a2bca
cmp dword [ebp + 0xc], 0
je 0x4a2bca
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4a2ba7
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004a2588
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4a2bd1
xor eax, eax
inc eax
jmp 0x4a2bd1
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10060830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1006085d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006085d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10008310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013bc0
push 0x1000ac34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x10008376
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x100083ff
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x1000839d
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x100083ff
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x100083d8
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x100083d8
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x100083ff
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x100083ff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100084a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1005cb4c]
mov dword [ebp - 4], eax
jmp 0x100084b9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100084d6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100084b0
mov esp, ebp
pop ebp
ret
Function at 0x100084e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1005cb5c], eax
je 0x100084fe
mov eax, 0x10dd
jmp 0x100085e0
mov eax, dword [0x1005cb6c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000857d
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1000855b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1000855b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10008650
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1000a19d
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10008506
mov dword [0x1005cb6c], 0
call fcn.100085f0
mov ecx, dword [0x1005cb68]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100085ca
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1000a19d
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x10008595
mov dword [0x1005cb68], 0
mov dword [0x1005cb5c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10008b60
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10008b75
xor eax, eax
jmp 0x10008bea
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x10008ba2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10008be5
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10008be3
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10008bdf
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10008be3
xor eax, eax
jmp 0x10008bea
jmp 0x10008b99
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10008ca0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1005cb60], 0
je 0x10008cb9
mov eax, dword [0x1005cb60]
jmp 0x10008d59
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10008ccb
xor eax, eax
jmp 0x10008d59
push 8
call fcn.1000ad0c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10008d21
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10008d0a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000a19d
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1005cb60], eax
mov dword [0x1005cb64], 0
mov eax, dword [ebp - 8]
jmp 0x10008d59
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10008d3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10008ceb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1005cb68]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1005cb68], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100095a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10009670
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000965c
cmp dword [ebp - 4], 0x50000000
jb 0x100095dc
cmp dword [ebp - 4], 0x80000000
ja 0x100095dc
mov dword [ebp - 4], 0x80010000
jmp 0x100095b5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1000a5b0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10009602
jmp 0x1000965c
cmp dword [ebp - 0x10], 0x10000
jne 0x10009645
cmp dword [ebp - 0x14], 0x10000
jb 0x10009645
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10009638
mov eax, dword [ebp - 0x24]
jmp 0x1000965e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10009657
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10009670
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100095b5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100096b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10009780
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10009774
cmp dword [ebp - 4], 0x50000000
jb 0x100096f1
cmp dword [ebp - 4], 0x80000000
ja 0x100096f1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100096ca
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1000a5b0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10009717
jmp 0x10009774
cmp dword [ebp - 0x10], 0x10000
jne 0x1000975a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000975a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000974d
mov eax, dword [ebp - 0x24]
jmp 0x10009776
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000976f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10009780
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100096ca
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100097b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1005cb5c], eax
je 0x100097d5
mov eax, 0x10dd
jmp 0x1000996a
cmp dword [0x1005cb60], 0
je 0x100097e8
mov eax, dword [0x1005cb60]
jmp 0x1000996a
cmp dword [ebp + 8], 0
jne 0x100097f8
mov eax, 6
jmp 0x1000996a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10009821
mov dword [ebp - 0x14], 6
mov ecx, dword [ebp - 0x14]
mov dword [0x1005cb60], ecx
mov edx, dword [ebp + 8]
mov dword [0x1005cb64], edx
mov eax, dword [ebp - 0x14]
jmp 0x1000996a
push 0x18
call fcn.1000ad0c
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000987a
mov dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x14]
mov dword [0x1005cb60], ecx
cmp dword [ebp - 0x18], 0
je 0x10009869
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.1000a19d
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x1005cb64], ecx
mov eax, dword [ebp - 0x14]
jmp 0x1000996a
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.100081d0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100081d0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
je 0x100098bb
cmp dword [ebp - 8], 0x1e
jbe 0x100098d5
mov dword [ebp - 0x14], 9
cmp dword [0x1005cb54], 0
je 0x100098d0
jmp 0x1000984a
jmp 0x10009841
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x100098fa
mov dword [ebp - 0x14], 9
cmp dword [0x1005cb54], 0
je 0x100098f5
jmp 0x1000984a
jmp 0x10009841
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10009927
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x10009841
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x1005cb6c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x1005cb6c], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x100615d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call fcn.1000a5b0
cdq
rcl al, cl
or al, ch
add esp, 0xc
rdtsc
xchg dh, ah
not ah
cdq
Function at 0x100626e3
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x10003f76
pushal
mov dword [esp + 0x20], 0x10029e78
pushfd
pushfd
mov byte [esp + 0x10], ah
pushfd
lea esp, [esp + 0x2c]
call fcn.10008d60
push eax
mov byte [esp], 0xad
mov dword [esp], 0x10003f0c
pushal
mov byte [esp], al
pushfd
mov dword [esp + 0x20], 0x10029e7c
pushal
call fcn.10071253
and byte [esi + ebx*4 + 2], bh
adc byte [eax - 0x18], ah
xor bl, ch
add byte [eax], al
and eax, 0x2c3d6060
push ds
sahf
jp 0x10062718
imul ebx, dword [eax - 0x3c], 0x72
mov ebx, 0x38e35c18
push ss
mov al, 0xb1
pop ss
inc ecx
sbb dword [esi + 0x3c], eax
push ebp
salc
xor eax, dword [esi]
add edi, dword [esi]
cmp eax, 0xcd8ce706
push 0x29
invalid

Function at 0x10066ea7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x20], str...HardwareInterfaceDll.dll
mov word [esp], si
adc byte [esi - 0x77], ah
xor al, 0x24
mov dword [esp + 0x1c], 0x100649da
pushfd
call fcn.1006d71c
mov esp, edx
mov al, 0xb2
adc byte [ecx], al
je 0x10066eae
push edi
inc edi
invalid

Function at 0x1006bb9b
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x1006ec43
mov dword [esp + 4], 0x385a6762
lea esp, [esp + 0xc]
jge 0x1006856b
jne 0x10062da4
stc
sub eax, eax
pushal
lea esp, [esp + 0x20]
jmp 0x1006697d

Function at 0x1006e203
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushfd
push dword [sym.imp.KERNEL32.dll_GetCurrentThread]
pop dword [esp + 0x20]
mov byte [esp], 0x19
push 0xe2950607
mov word [esp], di
push dword [esp + 0x24]
ret 0x28
push 0x10066998
pushal
mov word [esp + 4], 0x7492
pushal
push dword [sym.imp.KERNEL32.dll_GetCurrentThread]
pop dword [esp + 0x3c]
pushfd
mov byte [esp], dh
pushfd
push dword [esp + 0x44]
ret 0x48
test dh, cl
stc
add ecx, 0x10936e
call fcn.10071f6e
adc dword [ebx - 0x3d], 0x36
test al, 0xb7
adc dh, byte [eax - 0x1e]
out dx, eax
push esp
push ebx
mov edi, 0xf58889ab
loop 0x1006e1b6
inc ebx
xor byte [0xe06f2cbd], cl
cdq
fnstenv [ebx - 0x3d2f4866]
xor al, 0x6b
salc
dec ebp
ljmp 0xb5c3
mov bh, 0x3a
add dword fs:[ebx - 0x4c], eax
inc esi
mov dh, 0xf9
push 0xd0999538
mov ah, 0x38
sub al, byte [ebx - 0x4e]
clc
push 0xfa1faf3b
pop ebx
pop es
sub byte [edi - 0x23], 0xb9
mov dl, 0x1e
jne 0x1006e1fc
jg 0x1006e222
int3
in al, dx
insd dword es:[edi], dx
fmul qword [ebp + 0x648d61bc]
lea esp, [esp + 0x30]
jne 0x10062da4
push 0x54dcd420
call fcn.1006bf42
call fcn.1007093f
jns 0x100738c6
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.10008410
jmp 0x10063b70
jmp 0x10063469
pushfd
mov byte [esp], 0x46
pushal
lea esp, [esp + 0x24]
call fcn.10008410
pushal
push 0xb633797d
mov dword [esp + 0x20], 0x100751f4
mov byte [esp + 4], 0xe
jmp 0x1006ec39
Function at 0x4059d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a3a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a24
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a41
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40aaac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aae5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40aaee
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aaf8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab19
mov al, byte [esp]
jmp 0x40ab1b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b1a0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b018
mov eax, dword [0x453040]
cmp byte [eax], 0
je 0x40b21c
mov eax, dword [0x452e5c]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408320
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b264
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b252
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x452e0c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x454664]
call fcn.00404ee8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bab8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bb8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ee4
lea eax, [ebp - 8]
call fcn.0040435c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bb78
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bb71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bb5b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bba0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bb5b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb78
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb95
lea eax, [ebp - 8]
call fcn.00403e4c
ret

Function at 0x40c098
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c0fc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407df0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c103
lea eax, [ebp - 0xc]
call fcn.00403e4c
ret

Function at 0x41a234
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x454884
cmp dword [edi], 0
jne 0x41a2b0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x454880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4523ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a20c
lea eax, [esi + 5]
call fcn.0041a22c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a22c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a285
mov dword [0x454880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b81c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b822
ret
Function at 0x41dcb8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41dd09
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41dcf0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41dce0
jmp 0x41dd09
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41dcf1
pop ebx
mov esp, ebp
pop ebp
ret