joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e014e48
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e014e48
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8

Function at 0x2e014e48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x2e014e57
pop dword [ebp - 8]
mov eax, 0xb5016c41
sub eax, 0x87001dea
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x5d4f653b
sub dword [ebp - 0x18], 0xefd1ff0
mov dword [ebp - 0x14], 0x175ae9f0
sub dword [ebp - 0x14], 0xe5279dab
mov dword [ebp - 0x10], 0x61988ed2
add dword [ebp - 0x10], 0xeab3b55c
mov dword [ebp - 0xc], 0xe41d17c1
add dword [ebp - 0xc], 0x1be2e83f
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x379bd50f
sub dword [ebp - 0x18], 0xc3296bb9
mov dword [ebp - 0x14], 0xfb4070be
add dword [ebp - 0x14], 0x462bf0b7
mov dword [ebp - 0x10], 0x4cbd5d8c
add dword [ebp - 0x10], 0x16b20ee0
mov dword [ebp - 0xc], 0x848dbb62
sub dword [ebp - 0xc], 0x848dbb62
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3d5a1
push 0
call eax
mov ecx, 0xf436c89c
sub ecx, 0xf4368f7b
xor esi, esi
add esi, eax
mov edi, 0x2ee957a4
add edi, 0xff1c165c
add edi, dword [ebp - 8]
mov ebx, 0x79547e6b
sub ebx, 0xee5b4728
xor dword [ebp - 4], 0x661f14ec
mov edx, dword [edi]
add dword [ebp - 4], edi
add edx, ebx
sub dword [ebp - 4], ebx
mov dword [esi], edx
add dword [ebp - 4], ebx
add esi, 4
add edi, 4
loop 0x2e014f71
add eax, 0x9bffc476
add eax, 0x640112e1
mov ebx, eax
add eax, 0x39f7c5a
add eax, 0xfc6083ab
mov ecx, 0xc04987e7
sub ecx, 0x924987e7
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret

Function at 0x40cb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40cb2f
pop dword [ebp - 0x34]
mov eax, 0x76d4623d
add eax, 0x896c68f2
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xefd1f184
add dword [ebp - 0x44], 0x5e8053c7
mov dword [ebp - 0x40], 0x3aa8c024
add dword [ebp - 0x40], 0xf78a8c21
mov dword [ebp - 0x3c], 0xed5b3036
add dword [ebp - 0x3c], 0x5ef113f8
mov dword [ebp - 0x38], 0x33f1a4aa
add dword [ebp - 0x38], 0xcc0e5b56
lea eax, [ebp - 0x44]
push eax
mov eax, 0xa6e8f6f3
sub eax, 0xa6a7c65b
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x153c438
sub dword [ebp - 0x44], 0x8ce15ae2
mov dword [ebp - 0x40], 0x5b714497
sub dword [ebp - 0x40], 0x1a04e322
mov dword [ebp - 0x3c], 0x4306eb0d
add dword [ebp - 0x3c], 0x2068815f
mov dword [ebp - 0x38], 0x1748503e
sub dword [ebp - 0x38], 0x1748503e
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39d89
push 0
call eax
mov ecx, 0x4a1c
mov edx, eax
mov edi, 0x9b9ec749
sub edi, 0x9b5d2349
add edi, dword [ebp - 0x34]
mov esi, 0xcdd5de2c
add esi, 0x2e4a30d2
mov ebx, dword [edi]
mov dword [ebp - 0x14], 0x2eb38fa4
sub ebx, esi
xor dword [ebp - 0x20], 0xb8551132
mov dword [edx], ebx
xor dword [ebp - 0x2c], edi
add edx, 0xdf6c97d0
sub edx, 0xdf6c97cc
add edi, 0xa897a12
sub edi, 0xa897a0e
loop 0x40cc46
add eax, 0x3f8148e0
sub eax, 0x3f802d9d
mov ebx, eax
add eax, 0xa2de7902
add eax, 0x5d218703
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40a190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6459b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x110]
push eax
push 0x20019
xor edi, edi
push edi
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x118], 0x104
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x114], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a232
push esi
lea ecx, [ebp - 0x10c]
push str._sConnection
push ecx
call fcn.005473f8
mov ecx, dword [ebp - 0x110]
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0x20019
push edi
lea eax, [ebp - 0x10c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40a246
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x11c]
push edx
push edi
push str.PnpInstanceID
push eax
mov dword [ebp - 0x118], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a299
push 3
lea ecx, [ebp - 0x10c]
push 0x596110
push ecx
call fcn.00547338
add esp, 0xc
test eax, eax
jne 0x40a299
lea edi, [eax + 1]
mov edx, dword [ebp - 0x114]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x110]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
Function at 0x40a2d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x6459b8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x510]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x524], 0x104
mov dword [ebp - 0x51c], 1
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x514], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a33f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
push esi
push 0x3ff
lea ecx, [ebp - 0x50b]
push 0
push ecx
mov byte [ebp - 0x50c], 0
call fcn.00546d60
mov ecx, dword [ebp - 0x510]
add esp, 0xc
xor esi, esi
push esi
push esi
push esi
push esi
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x50c]
push eax
push esi
push ecx
mov dword [ebp - 0x518], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40a3b0
mov edx, dword [ebp - 0x510]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
push edi
test eax, eax
jne 0x40a4c3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop
mov edx, dword [ebp - 0x510]
lea eax, [ebp - 0x514]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x50c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a48c
lea eax, [ebp - 0x524]
push eax
mov eax, dword [ebp - 0x514]
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x51c]
push edx
push 0
push str.NetCfgInstanceId
push eax
call edi
test eax, eax
jne 0x40a48c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a440
test dl, dl
je 0x40a43c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a440
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a420
xor eax, eax
jmp 0x40a445
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40a48c
mov eax, 4
lea ecx, [ebp - 0x52c]
push ecx
mov ecx, dword [ebp - 0x514]
lea edx, [ebp - 0x520]
push edx
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
lea eax, [ebp - 0x528]
push eax
push 0
push str.Characteristics
push ecx
call edi
test eax, eax
jne 0x40a48c
test byte [ebp - 0x520], 4
jne 0x40a4ef
mov ecx, dword [ebp - 0x510]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x50c]
push eax
inc esi
push esi
push ecx
mov dword [ebp - 0x518], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40a3c0
mov ecx, dword [ebp - 0x514]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [ebp - 0x510]
push edx
call esi
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x510]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x514]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
Function at 0x40ca40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ae41
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6459b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.0040a530
test eax, eax
je 0x40cb63
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40caa0
mov ecx, 0xe
mov esi, str.ReaderbDisableInternet.txt
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00406440
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.00445e00
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x21c]
push 0
push 0x1002
push edx
lea ecx, [ebp - 0x234]
call fcn.00445cde
test eax, eax
je 0x40cb2e
mov eax, dword [ebp - 0x234]
mov edx, dword [eax + 0x2c]
push 0
push 0
push 0
lea ecx, [ebp - 0x234]
call edx
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00445edb
lea ecx, [ebp - 0x234]
call fcn.004460a1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.00446151
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cb63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cb89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00546bde
mov esp, ebp
pop ebp
ret 4
Function at 0x42b990
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fc7b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x6459b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
jne 0x42b9d6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x7c
call fcn.00443868
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x42b9f3
mov ecx, eax
call fcn.0040b5e0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 0x3c]
lea ecx, [ebx + 0x34]
push esi
push eax
call fcn.0045388b
push edi
mov ecx, esi
call fcn.0056ca70
lea ecx, [edi + 4]
push ecx
lea ecx, [esi + 4]
call fcn.004059f0
lea edx, [edi + 8]
push edx
lea ecx, [esi + 8]
call fcn.004059f0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004059f0
lea ecx, [edi + 0x10]
push ecx
lea ecx, [esi + 0x10]
call fcn.004059f0
lea edx, [edi + 0x14]
push edx
lea ecx, [esi + 0x14]
call fcn.004059f0
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.004059f0
lea ecx, [edi + 0x1c]
push ecx
lea ecx, [esi + 0x1c]
call fcn.004059f0
mov edx, dword [edi + 0x20]
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], edx
call fcn.004059f0
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [ebx + 8]
lea eax, [edi + 0x38]
push eax
lea ecx, [esi + 0x38]
mov dword [esi + 0x2c], edx
call fcn.004059f0
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esi + 0x30]
call fcn.004059f0
lea edx, [edi + 0x34]
push edx
lea ecx, [esi + 0x34]
call fcn.004059f0
add edi, 0x4c
push edi
lea ecx, [esi + 0x4c]
call fcn.004059f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100080d6
pop dword [ebp - 0x28]
mov eax, 0xd8765f90
add eax, 0x378a2146
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x39752
push 0
mov eax, 0x23e908c7
add eax, 0xec18379d
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x7beab51b
add ecx, 0x841594b7
xor ebx, ebx
add ebx, eax
mov edi, 0xcba046a1
add edi, 0x44613f5f
add edi, dword [ebp - 0x28]
mov edx, 0x948aa098
sub dword [ebp - 0x20], 0x961078a5
mov esi, dword [edi]
xor dword [ebp - 4], edi
add esi, edx
sub dword [ebp - 0x18], ebx
mov dword [ebx], esi
xor dword [ebp - 8], 0x5766b0b8
add ebx, 0x161ab051
add ebx, 0xe9e54fb3
add edi, 4
loop 0x10008131
add eax, 0x11a1b
xor ebx, ebx
add ebx, eax
add eax, 0x813248c8
add eax, 0x7ecdb73d
mov ecx, 0x4f2ad5e8
add ecx, 0xc0d52a18
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401be0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401c2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c24
test esi, esi
je 0x401c24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c00
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f38
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e9e
cmp eax, 4
jne 0x401ec0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401eae
cmp edx, 4
je 0x401eae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x10022270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1002227f
pop dword [ebp - 0x24]
mov eax, 0x1002227f
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x894b0
push 0
mov eax, 0xacdcec1a
add eax, 0x63389512
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x44db
mov edi, eax
mov ebx, 0xd7915134
add ebx, 0x388fa8cc
add ebx, dword [ebp - 0x24]
mov esi, 0x74d76861
add esi, 0x7c1cc8d3
add dword [ebp - 4], ebx
mov edx, dword [ebx]
xor dword [ebp - 0x14], esi
xor edx, esi
add dword [ebp - 0x1c], ebx
mov dword [edi], edx
mov dword [ebp - 0x20], 0x937f9193
add edi, 0xfd95c00b
add edi, 0x26a3ff9
add ebx, 4
loop 0x100222d3
add eax, 0xee9ca301
sub eax, 0xee9b9cc2
xor ebx, ebx
add ebx, eax
add eax, 0x5009a8ba
add eax, 0xaff6574b
mov ecx, 0x12ad5cf0
sub ecx, 0x2ad5cf0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10032b90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101fe4b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x10032c7f
push 0x55
push 0x101fe4b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10032c68
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.10108310
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x101fe4b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10032c13
inc edx
cmp edx, 0x55
jl 0x10032bf0
mov byte [ebp - 8], 0
push 0x41
call fcn.10022270
mov esi, eax
add esp, 4
test esi, esi
je 0x10032c67
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10022270
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x10032c5e
push 0x10032340
push 0x15
mov byte [eax + esi], 0
mov dword [0x101fe4b0], esi
mov byte [0x101fe4b4], 1
call fcn.10022270
add esp, 8
jmp 0x10032c67
push esi
call fcn.10022270
add esp, 4
pop esi
mov eax, dword [0x101fe4b0]
mov ecx, 0x10166518
test eax, eax
cmovne ecx, eax
mov dword [0x101fe4b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret