joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0c80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4f2a68
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov word [esp + 0x20], ax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b0cc4
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x24]
call fcn.00401760
mov ecx, esi
push ecx
lea edx, [esp + 0x18]
push edx
mov esi, edi
mov dword [esp + 0x48], 0
call fcn.0040af40
cmp dword [esp + 0x34], 8
jb 0x4b0d09
mov eax, dword [esp + 0x20]
push eax
call fcn.004c8f17
add esp, 4
mov esi, dword [esp + 0x14]
mov ebx, dword [edi + 0x18]
mov edi, dword [edi]
test esi, esi
je 0x4b0d1a
cmp esi, edi
je 0x4b0d1f
call fcn.004c96d9
mov edi, dword [esp + 0x18]
cmp edi, ebx
je 0x4b0d54
test esi, esi
jne 0x4b0d50
call fcn.004c96d9
cmp edi, dword [esi + 0x18]
jne 0x4b0d3a
call fcn.004c96d9
mov eax, dword [edi + 0x28]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x34
ret
mov esi, dword [esi]
jmp 0x4b0d30
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x34
ret
Function at 0x4b7610
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4b7689
push esi
mov esi, dword [eax + 4]
test esi, esi
je 0x4b7688
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b7688
cmp byte [esp + 0x10], 0
je 0x4b767f
push edi
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x4b764d
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b765d
push 9
push esi
call edi
call fcn.00462fe0
mov eax, dword [ebx + 4]
pop edi
test eax, eax
je 0x4b7688
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4b7688
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
pop esi
pop ebx
ret 8
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
ret 8
Function at 0x4c8f08
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x52b360]
jne 0x4c8f12
repz ret
jmp fcn.004d11e7

Function at 0x4cc8ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4cc91e
call fcn.004ce632
mov dword [eax], esi
call fcn.004ce61f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004c96b3
add esp, 0x14
push 0x16
pop eax
jmp 0x4cc973
test dword [ebp + 0xc], 0xfffffff9
jne 0x4cc8fa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4cc94b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ce645
pop ecx
call fcn.004ce61f
mov eax, dword [eax]
jmp 0x4cc973
test al, 0x10
jne 0x4cc971
test al, 1
je 0x4cc971
test byte [ebp + 0xc], 2
je 0x4cc971
call fcn.004ce632
mov dword [eax], 5
call fcn.004ce61f
mov dword [eax], 0xd
jmp 0x4cc942
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4ce2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4ce321
call fcn.004ce632
mov dword [eax], esi
call fcn.004ce61f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004c96b3
add esp, 0x14
push 0x16
pop eax
jmp 0x4ce376
test dword [ebp + 0xc], 0xfffffff9
jne 0x4ce2fd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ce34e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ce645
pop ecx
call fcn.004ce61f
mov eax, dword [eax]
jmp 0x4ce376
test al, 0x10
jne 0x4ce374
test al, 1
je 0x4ce374
test byte [ebp + 0xc], 2
je 0x4ce374
call fcn.004ce632
mov dword [eax], 5
call fcn.004ce61f
mov dword [eax], 0xd
jmp 0x4ce345
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4e2b31
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004d167e
and dword [ebp - 4], 0
cmp dword [0x53199c], 0
mov ebx, eax
jne 0x4e2be2
push 0x4fe6bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4e2c93
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4fe6b0
push edi
call esi
test eax, eax
je 0x4e2c93
push eax
call fcn.004d160c
mov dword [esp], 0x4fe6a0
push edi
mov dword [0x53199c], eax
call esi
push eax
call fcn.004d160c
mov dword [esp], 0x4fe68c
push edi
mov dword [0x5319a0], eax
call esi
push eax
call fcn.004d160c
mov dword [esp], 0x4fe670
push edi
mov dword [0x5319a4], eax
call esi
push eax
call fcn.004d160c
pop ecx
mov dword [0x5319ac], eax
test eax, eax
je 0x4e2be2
push 0x4fe658
push edi
call esi
push eax
call fcn.004d160c
pop ecx
mov dword [0x5319a8], eax
mov eax, dword [0x5319a8]
cmp eax, ebx
je 0x4e2c3a
cmp dword [0x5319ac], ebx
je 0x4e2c3a
push eax
call fcn.004d1687
push dword [0x5319ac]
mov esi, eax
call fcn.004d1687
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4e2c3a
test edi, edi
je 0x4e2c3a
call esi
test eax, eax
je 0x4e2c31
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4e2c31
test byte [ebp - 0xc], 1
jne 0x4e2c3a
or dword [ebp + 0x10], 0x200000
jmp 0x4e2c73
mov eax, dword [0x5319a0]
cmp eax, ebx
je 0x4e2c73
push eax
call fcn.004d1687
pop ecx
test eax, eax
je 0x4e2c73
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4e2c73
mov eax, dword [0x5319a4]
cmp eax, ebx
je 0x4e2c73
push eax
call fcn.004d1687
pop ecx
test eax, eax
je 0x4e2c73
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x53199c]
call fcn.004d1687
pop ecx
test eax, eax
je 0x4e2c93
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4e2c95
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ea5d3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x531a54], 0
push esi
jne 0x4ea546
call fcn.004ea46c
test eax, eax
je 0x4ea589
mov eax, dword [0x531a54]
cmp eax, 1
jne 0x4ea567
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4ea589
pop esi
ret
push eax
call dword [0x531a5c]
test eax, eax
jne 0x4ea5d1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4ea58d
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x531a54]
call dword [0x531a5c]
mov edi, eax
test edi, edi
je 0x4ea5b2
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4ea5ce
mov edi, esi
add esi, 0xff0
push edi
push dword [0x531a54]
call dword [0x531a58]
add edi, 0x10
cmp edi, esi
jb 0x4ea5ba
mov eax, edi
pop edi
pop esi
ret
jmp 0x4ea533
Function at 0x41d769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x421190
cmp edx, dword [eax]
je 0x41d78b
add eax, 8
inc ecx
cmp eax, 0x421220
jl 0x41d77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x421190]
jne 0x41d8b9
mov eax, dword [0x421bb0]
cmp eax, 1
je 0x41d893
test eax, eax
jne 0x41d7bc
cmp dword [0x4210e4], 1
je 0x41d893
cmp edx, 0xfc
je 0x41d8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41d7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041e670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041e490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41d836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041e490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42045c
push edi
call fcn.0041ef00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041e670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041e680
lea eax, [ebp - 0xa0]
push 0x42043c
push eax
call fcn.0041e680
push dword [esi + 0x421194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041e680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041ee75
add esp, 0x2c
pop edi
jmp 0x41d8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x421194]
push 0
push eax
push dword [esi]
call fcn.0041e490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xa0376b1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2ceb6ef1
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0x143c8c13
sub eax, 0x13fc6013
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x37ff15fa
add dword [ebp - 0x18], 0x16532f51
mov dword [ebp - 0x14], 0xdfbd186
add dword [ebp - 0x14], 0x24377abf
mov dword [ebp - 0x10], 0xf87486c5
sub dword [ebp - 0x10], 0xac284297
mov dword [ebp - 0xc], 0xf5c489e1
sub dword [ebp - 0xc], 0xf5c489e1
lea eax, [ebp - 0x18]
push eax
mov eax, 0xb43069bc
add eax, 0x4c1006a8
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x96733874
add dword [ebp - 0x18], 0xddff30e2
mov dword [ebp - 0x14], 0xc04d9141
sub dword [ebp - 0x14], 0x7ee12fcc
mov dword [ebp - 0x10], 0x89df6550
add dword [ebp - 0x10], 0xd990071c
mov dword [ebp - 0xc], 0x25c17c13
sub dword [ebp - 0xc], 0x25c17c13
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x62ff51f8
add eax, 0x9d411eb0
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad9e
push 0
call eax
mov ecx, 0xaa1dc2c3
sub ecx, 0xaa1d6a1d
mov edi, eax
mov edx, 0x2f06ef05
add edx, 0xd13a10fb
add edx, dword [ebp - 8]
mov esi, 0xcb0b7dbe
add dword [ebp - 4], ebx
mov ebx, dword [edx]
sub ebx, esi
xor dword [ebp - 4], 0x319bef53
mov dword [edi], ebx
xor dword [ebp - 4], edi
add edi, 4
add edx, 4
loop 0x402d1c
add eax, 0x1556b
xor ebx, ebx
add ebx, eax
add eax, 0xa2059cf8
add eax, 0x5dfa630d
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x404417
Capabilities:
Encode data using xor

Disassembly:
inc eax
pop esi
xor dword [esi + 0xe], 0x7d6c25b0
sub esi, 0xfffffffc
loop 0x40441a
wait
in al, dx
out dx, eax
xchg esp, eax
xor ebp, ecx
xchg ebx, eax
or byte [edi - 0x26], 0xac
and esi, dword [ecx]
push ebx
bound edi, qword [ecx + 0x6d]
adc dword [edi], edi
invalid

Function at 0x40b283
Capabilities:
Write file on windows

Disassembly:
jne 0x40b2bd
mov ecx, dword [ebp - 0x49]
test ecx, ecx
jne 0x40b29e
mov ecx, dword [ebp + 0x14]
jle 0x40b2e6
cvtdq2ps xmm3, xmmword [edi + 0x5b]
jle 0x40b2a8
add dword [eax], eax
pop esi
adc dword [esi + 0x5d], ebx
mov al, 0x8b
push esi
or al, 0x85
sal byte [eax + ebx + 0x3c], cl
push esi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x40b2bd
cmp al, 0x56
mov byte [edx + edx*8 + 0x568b1175], 0x50
test dl, dl
jne 0x40b2bd
mov edx, dword [esi + 0x50]
add edx, ecx
pop ebx
dec esi
push esp
adc ecx, 0
mov dword [esi + 0x50], edx
mov dword [esi - 0x3b], ecx
mov ecx, dword [ebp + 0x38]
mov edx, dword [ebp + 0x10]
pop ebx
pop edi
mov dword [edi + 0x5e], ecx
pop ebp
ret
push es
rcl byte [ebx + 0x16], 0xf9
add dword [edi - 0x51], edx
pop ecx
xor al, 0x89
inc ebp
or byte [edi], cl
pushfd
dec esi
add byte [eax], al
mov edi, dword [esi + 0x7c]
cmp edi, eax
scasb al, byte es:[edi]
test byte [ecx - 0x75000000], dl
pop esi
cmp byte [ebx + 0x527ffff], al
dec esp
enter 0xffffffffffffeba2, 2
mov eax, edi
mov ebx, dword [edi - 0x3df72fc]
push 0x34
push ecx
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ljmp 0x3d95
Function at 0x1000a7e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000a7f3
pop dword [ebp - 0x1c]
mov eax, 0x3984aadb
sub eax, 0x298402e8
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xff7f888e
add dword [ebp - 0x2c], 0x4ed2bcbd
mov dword [ebp - 0x28], 0xda4915
add dword [ebp - 0x28], 0x31590330
mov dword [ebp - 0x24], 0xc0b98e93
sub dword [ebp - 0x24], 0x746d4a65
mov dword [ebp - 0x20], 0x227d7428
add dword [ebp - 0x20], 0xdd828bd8
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x6bdb8ec8
add eax, 0xa425315c
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x1c7e0770
add dword [ebp - 0x2c], 0x57f461e6
mov dword [ebp - 0x28], 0x7600f29f
sub dword [ebp - 0x28], 0x3494912a
mov dword [ebp - 0x24], 0x343066cd
sub dword [ebp - 0x24], 0xd0c0fa61
mov dword [ebp - 0x20], 0x54d39ffd
sub dword [ebp - 0x20], 0x54d39ffd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xdddfeed1
add eax, 0x3220d15b
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x377e4
push 0
call eax
mov ecx, 0x77c7bde1
add ecx, 0x88388819
mov edi, eax
mov ebx, 0x31e1a672
sub ebx, 0x21dd3272
add ebx, dword [ebp - 0x1c]
mov esi, 0x6f786f09
xor dword [ebp - 0x18], edx
mov edx, dword [ebx]
xor edx, esi
add dword [ebp - 8], 0x58dfc249
mov dword [edi], edx
add dword [ebp - 0x10], 0xd4cff6a2
add edi, 0xf625feef
sub edi, 0xf625feeb
add ebx, 0x80eb1dd
add ebx, 0xf7f14e27
loop 0x1000a90f
add eax, 0x2989a113
add eax, 0xd67769a8
xor ebx, ebx
add ebx, eax
add eax, 0xf00e65cc
sub eax, 0xf00e65c7
mov ecx, 0xa0c7f493
sub ecx, 0x90c7f493
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x41cbea
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041428e
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41cc22
xor eax, eax
jmp 0x41cc4e
cmp esi, dword [ebp - 4]
je 0x41cc4b
cmp dword [ebp + 0xc], 0
je 0x41cc4b
push dword [edi + 0x9c]
call fcn.0041c7f8
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040ef84
pop ecx
pop ecx
cmp esi, eax
je 0x41cc1e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41dbc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc48
xor eax, eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41dd6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3a4]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a0]
call fcn.00408148
push dword [ebp - 0x3a0]
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.00408210
push dword [ebp - 0x3a8]
push 0x41dd80
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b0c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402d44
lea eax, [ebp - 0x1d0]
call fcn.00402ad4
lea eax, [ebp - 0x1d0]
call fcn.00402ee8
lea eax, [ebp - 0x3b0]
call fcn.0041ca9c
lea eax, [ebp - 0x3b0]
mov edx, 0x41dd90
call fcn.00404a54
mov edx, dword [ebp - 0x3b0]
lea eax, [ebp - 0x39c]
call fcn.00402d44
lea eax, [ebp - 0x39c]
call fcn.00402ad4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x39c]
call fcn.00404d90
call fcn.00403558
lea eax, [ebp - 0x39c]
call fcn.00402ee8
push 0
lea eax, [ebp - 0x3b4]
call fcn.0041ca9c
lea eax, [ebp - 0x3b4]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b4]
call fcn.00404c44
push eax
call sub.kernel32.dll_WinExec
push 0x5dc
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x3b8]
call fcn.0041ca9c
lea eax, [ebp - 0x3b8]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b8]
call fcn.004080e0
mov eax, dword [ebp - 4]
call fcn.004080e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dd74
lea eax, [ebp - 0x3b8]
mov edx, 7
call fcn.004047b8
lea eax, [ebp - 4]
call fcn.00404794
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x414de5
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], eax
add ebx, ebx
add ebx, 1
sub edi, 0xf55e1f4e
add edx, 4
cmp edx, ecx
jne fcn.00414de5
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1005c09a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10094144]
jne 0x1005c0a4
repz ret
jmp fcn.1005c6ae
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10018c71
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10018c71
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x10ebeaab
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
push esi
rdtsc
push ebp
pushfd
push ebx
movsx ax, ch
push edi
push ecx
add ebx, esi
mov edx, 0
push edx
mov esi, dword [esp + 0x28]
shr bl, cl
neg esi
bswap ax
dec bp
jmp 0x10e802d4
dec esi
btr di, 0x2c
mov ebp, eax
not esi
ror al, 0xb6
cmp ecx, 0x4d8e5c8e
neg esi
btc bp, 0xa7
ror esi, 1
xor ah, 0x78
setle al
not esi
sbb ebx, ecx
ror al, 0x61
sub esi, 0x14f25d18
add esi, edx
bsf edx, edx
movsx ax, al
rdtsc
mov edi, esp
bsr bx, dx
sub esp, 0xc0
test ecx, ebx
cwd
mov ebx, esi
mov eax, 0
ror bp, 0xef
and dl, 0x6a
btc ebp, 0x33
sub ebx, eax
inc dx
and ebp, ebx
not dh
lea ebp, [0x10e80339]
neg dx
xor dx, sp
lea esi, [esi - 4]
ror edx, cl
btc dx, 0x20
and dl, cl
mov edx, dword [esi]
clc
xor edx, ebx
not edx
stc
clc
cmc
add edx, 0x6b6c615c
rol edx, 3
cmp bp, cx
cmc
test esi, ebx
lea edx, [edx + 0x2b3d5816]
cmp eax, 0x6c726b2b
xor ebx, edx
stc
clc
add ebp, edx
jmp ebp
push eax
jmp 0x1096498c