joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d68ad
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x50c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004ce4fe
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004ce4fe
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4d6924
cmp word [ecx], dx
je 0x4d6924
mov eax, dword [0x4faf94]
push edi
dec eax
push eax
push 0x4fae80
call fcn.004d684c
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4d6997
cmp word [eax], dx
je 0x4d6997
mov eax, dword [edi]
test eax, eax
je 0x4d6948
cmp word [eax], dx
je 0x4d6948
lea eax, [ebp - 0x10]
push eax
call fcn.004d622f
jmp 0x4d6951
lea eax, [ebp - 0x10]
push eax
call fcn.004d62ca
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4d69c1
mov eax, dword [0x4fae7c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4fab70
call fcn.004d684c
add esp, 0xc
test al, al
je 0x4d69c1
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4d698c
cmp word [eax], di
je 0x4d698c
lea eax, [ebp - 0x10]
push eax
call fcn.004d622f
pop ecx
jmp 0x4d69c3
lea eax, [ebp - 0x10]
push eax
call fcn.004d62ca
jmp 0x4d6989
mov eax, dword [edi]
test eax, eax
je 0x4d69ae
cmp word [eax], dx
je 0x4d69ae
lea eax, [ebp - 0x10]
push eax
call fcn.004d61e4
pop ecx
jmp 0x4d69c1
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4d6a8c
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004d66d1
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4d6a8c
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4d6a8c
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4d6a8c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4d6a19
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004d035d
test ebx, ebx
je 0x4d6a87
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004d035d
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d6a8c
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d6a8c
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004c8f2c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4d6a8e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b8378
leave
ret
Function at 0x4dc680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4dc6ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4dc6ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x402c00
pop dword [ebp - 0x4c]
mov eax, 0x402c00
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x979551f1
sub dword [ebp - 0x5c], 0x49430ca6
mov dword [ebp - 0x58], 0xae00195
add dword [ebp - 0x58], 0x27534ab0
mov dword [ebp - 0x54], 0xdaa2ed4a
sub dword [ebp - 0x54], 0x8e56a91c
mov dword [ebp - 0x50], 0x59dfaa1a
add dword [ebp - 0x50], 0xa62055e6
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9f2f2e40
sub dword [ebp - 0x5c], 0x2abcc4ea
mov dword [ebp - 0x58], 0xda34dd4d
add dword [ebp - 0x58], 0x67378428
mov dword [ebp - 0x54], 0x109318a7
add dword [ebp - 0x54], 0x52dc53c5
mov dword [ebp - 0x50], 0xf74bb323
add dword [ebp - 0x50], 0x8b44cdd
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x369fa
push 0
call eax
mov ecx, 0x47bd
xor edi, edi
add edi, eax
mov ebx, 0xd817809f
add ebx, 0x28297f61
add ebx, dword [ebp - 0x4c]
mov esi, 0xe96bad73
mov edx, dword [ebx]
add dword [ebp - 0x20], 0x736db48
sub edx, esi
xor dword [ebp - 0x3c], 0xfe36ce56
mov dword [edi], edx
mov dword [ebp - 0x44], 0xab156133
add edi, 4
add ebx, 0xd6bd239e
sub ebx, 0xd6bd239a
loop 0x402d09
add eax, 0x6635229d
add eax, 0x99cbef2a
mov ebx, eax
add eax, 5
mov ecx, 0xc9a1dc1f
sub ecx, 0xc961dc1f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000983f
pop dword [ebp - 0x34]
mov eax, 0x1000983f
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x36a6b
push 0
mov eax, 0x60b8acaa
sub eax, 0x50b76c46
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x3e99
mov edi, eax
mov ebx, 0x53fb1689
add ebx, 0xbc066f77
add ebx, dword [ebp - 0x34]
mov esi, 0xc8a315b6
sub esi, 0x59796b4c
mov dword [ebp - 0xc], 0xcca0139f
mov edx, dword [ebx]
add dword [ebp - 0x1c], 0xa368d03f
xor edx, esi
sub dword [ebp - 8], edx
mov dword [edi], edx
add dword [ebp - 0x30], 0xa2949299
add edi, 4
add ebx, 0x894b805d
add ebx, 0x76b47fa7
loop 0x10009893
add eax, 0xed37
mov ebx, eax
add eax, 0x12f24bfd
sub eax, 0x12f24bf8
mov ecx, 0x2054ac66
sub ecx, 0x1054ac66
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x23802f58
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x824
mov eax, 0x23908fa8
call fcn.23803221
call fcn.23803257
lea ecx, [ebp - 0x81c]
call fcn.23803c48
mov eax, dword [0x239840f4]
push str.JavaScriptPerms
xor ebx, ebx
push str.FeatureLockdown
mov dword [ebp - 4], ebx
call dword [eax + 0x5c0]
push str.BlackList
push eax
mov eax, dword [0x23984114]
call dword [eax + 0x114]
xor edi, edi
add esp, 0x10
inc edi
push edi
lea ecx, [ebp - 0x81c]
mov esi, eax
call fcn.2383dad8
push edi
lea ecx, [ebp - 0x81c]
mov dword [ebp - 0x81c], esi
call fcn.2383dad8
lea ecx, [ebp - 0x828]
call fcn.23803c48
mov ax, word [0x2397de1c]
mov ecx, 0xffff
mov byte [ebp - 4], 1
cmp ax, cx
jne 0x23802ff1
mov ecx, 0x2397de1c
call fcn.238022e3
movzx eax, ax
push str.Reader
push eax
mov eax, dword [0x239840b0]
call dword [eax + 0x2c]
pop ecx
push eax
call fcn.2383dad8
pop ecx
pop ecx
test ax, ax
je 0x23803025
mov eax, dword [0x239827d4]
mov esi, str.SOFTWAREAdobeAcrobat_Reader11.0JavaScriptPerms
call dword [eax + 0xcb8]
test ax, ax
je 0x2380302a
mov esi, str.SOFTWAREAdobeAdobe_Acrobat11.0JavaScriptPerms
lea eax, [ebp - 0x830]
push eax
push edi
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x238030b3
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push str.tBlackList
push dword [ebp - 0x830]
mov dword [ebp - 0x820], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x238030a7
cmp dword [ebp - 0x814], edi
jne 0x238030a7
push ebx
call fcn.2383dad8
pop ecx
push eax
push ebx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.2383dad8
push edi
lea ecx, [ebp - 0x828]
call fcn.2383dad8
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
lea ecx, [ebp - 0x81c]
call fcn.2383dad8
test eax, eax
jne 0x238030d9
push ebx
push ebx
lea ecx, [ebp - 0x828]
call fcn.2383dad8
test eax, eax
je 0x23803185
call fcn.238632bf
cmp dword [0x23982638], ebx
jne 0x2380314f
push edi
push 0x14
call fcn.2383dad8
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x814], esi
mov byte [ebp - 4], 2
cmp esi, ebx
je 0x2380311f
push ecx
mov dword [ebp - 0x820], esp
lea eax, [ebp - 0x829]
mov dword [ebp - 0x820], esp
push eax
mov ecx, esi
call fcn.23818594
mov eax, esi
jmp 0x23803121
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x23982638], eax
cmp eax, ebx
jne 0x2380314f
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.23803ba1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.23803ba1
xor eax, eax
jmp 0x238031a4
push ecx
push ecx
lea eax, [ebp - 0x81c]
mov ecx, esp
mov dword [ebp - 0x814], esp
push eax
call fcn.2383dad8
call fcn.23863099
lea eax, [ebp - 0x828]
mov ecx, esp
mov dword [ebp - 0x814], esp
push eax
call fcn.2383dad8
call fcn.23863099
pop ecx
pop ecx
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.23803ba1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.23803ba1
mov eax, edi
call fcn.238040e1
ret
Function at 0x23855293
Capabilities:
Set registry value

Disassembly:
push 0x19c
mov eax, 0x23911df9
call fcn.23803221
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
mov esi, ecx
jb 0x238552af
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x9c]
call fcn.2383dad8
mov edi, eax
xor ebx, ebx
push 0x23921b70
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], ebx
call fcn.2383dad8
push edi
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.2383dad8
push 0x23921b6c
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.2383dad8
add esp, 0x18
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 4], 3
jb 0x23855300
mov esi, dword [esi]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2383dad8
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.2383dad8
push ebx
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.2383dad8
push ebx
push esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 7
call fcn.2383dad8
push ebx
push esi
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 8
call fcn.2383dad8
call fcn.23819efd
test eax, eax
je 0x2385544d
mov dword [ebp - 0x1a4], ebx
lea eax, [ebp - 0x1a4]
push eax
push 0x239219ec
push 4
push ebx
push 0x239219fc
mov byte [ebp - 4], 9
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jne 0x23855437
push ecx
mov ecx, dword [ebp - 0x1a4]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], esp
cmp eax, ebx
je 0x238553a6
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
call fcn.238b8e99
mov edi, eax
pop ecx
cmp edi, ebx
je 0x23855437
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x238553c2
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x19c]
push 3
mov dword [ebp - 0x1a0], ecx
push eax
lea ecx, [ebp - 0x1a0]
call fcn.2383dad8
push dword [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x1a0], eax
je 0x2385540d
push dword [ebp - 0x1a0]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
movzx ecx, byte [ebp + 0xc]
mov eax, dword [ebp - 0x1a4]
mov edx, dword [eax]
push ecx
push esi
push edi
push eax
call dword [edx + 0x78]
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x8c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1a4]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x23855489
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x23855489
call fcn.2383dad8
mov esi, eax
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x1a4], eax
cmp esi, ebx
je 0x23855489
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2385546e
lea eax, [ebp - 0x2c]
push 4
lea ecx, [ebp - 0x1a4]
push ecx
push 4
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.2383dad8
call fcn.238040e1
ret
Function at 0x2386d1fc
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x2390a5e3
call fcn.2380155b
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.238d0b4f
xor esi, esi
push 0x44
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 4], esi
call sub.MSVCR100.dll_memset
push 5
pop eax
push 0x10
mov word [ebp - 0x38], ax
xor edi, edi
lea eax, [ebp - 0x24]
push esi
inc edi
push eax
mov dword [ebp - 0x60], 0x23927c78
mov dword [ebp - 0x3c], edi
call sub.MSVCR100.dll_memset
add esp, 0x28
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [0x23984114]
push esi
push esi
push 0x10
push edi
push esi
push esi
push dword [ebp - 0x14]
call dword [eax + 0x54]
pop ecx
push eax
push esi
call dword [sym.imp.kernel32.dll_CreateProcessW]
movzx edi, ax
cmp di, si
je 0x2386d285
push dword [ebp - 0x24]
call fcn.2383dad8
pop ecx
movzx edi, ax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.23803ba1
mov ax, di
call fcn.238015dd
ret
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4039d0
pop dword [ebp - 0x24]
mov eax, 0x3201af64
add eax, 0xce3e8a6c
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xc057d66c
add dword [ebp - 0x34], 0x8dfa6edf
mov dword [ebp - 0x30], 0xf3ac8283
sub dword [ebp - 0x30], 0xc179363e
mov dword [ebp - 0x2c], 0x92edd85e
add dword [ebp - 0x2c], 0xb95e6bd0
mov dword [ebp - 0x28], 0x4d550713
sub dword [ebp - 0x28], 0x4d550713
lea eax, [ebp - 0x34]
push eax
mov eax, 0x362bdaac
add eax, 0xca1465d8
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xfd1c42cd
sub dword [ebp - 0x34], 0x88a9d977
mov dword [ebp - 0x30], 0x750f0893
sub dword [ebp - 0x30], 0x33a2a71e
mov dword [ebp - 0x2c], 0xe817cd9c
sub dword [ebp - 0x2c], 0x84a86130
mov dword [ebp - 0x28], 0x79025cc
sub dword [ebp - 0x28], 0x79025cc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xb025b32
sub eax, 0xac21aaa
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x372c4
push 0
call eax
mov ecx, 0xdcf892c2
sub ecx, 0xdcf848ea
xor ebx, ebx
add ebx, eax
mov esi, 0xef7b6592
sub esi, 0xef3add92
add esi, dword [ebp - 0x24]
mov edi, 0xce051dd6
sub edi, 0x9a5e0f2a
sub dword [ebp - 4], ebx
mov edx, dword [esi]
xor dword [ebp - 0x20], 0x6e9a5661
sub edx, edi
add dword [ebp - 0x20], 0xd0629283
mov dword [ebx], edx
sub dword [ebp - 0xc], 0x60c7b977
add ebx, 4
add esi, 0x8d0f16b8
sub esi, 0x8d0f16b4
loop 0x403af4
add eax, 0x11a33
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x90d09f58
add ecx, 0x6f6f60a8
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x404da0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x410c6b
push eax
mov dword fs:[0], esp
sub esp, 0x834
push 0x439440
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x117a58
jne 0x404e42
cmp dword [0x4a7594], 0xc8b
jne 0x404e0a
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x401260
push 0x40127c
push 0x41cce0
call fcn.00405988
push 0x4012a0
push 0x4012a4
call fcn.004058f3
add esp, 0x14
lea ecx, [esp + 0x1c]
call fcn.00404ce0
lea ecx, [esp + 0x1c]
call fcn.00404d30
call fcn.004032a0
push 0x41cce0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x14f7
jne 0x404ebf
cmp dword [0x4a7594], 0x6ad
jne 0x404e6f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
xor ecx, ecx
push 1
mov word [esp + 8], cx
push 0x4012ac
lea ecx, [esp + 8]
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
call fcn.00404a10
push 0
mov dword [esp + 0x840], 0
call fcn.004057b3
add esp, 4
cmp dword [esp + 0x18], 8
jb 0x404ebf
mov edx, dword [esp + 4]
push edx
call fcn.00405127
add esp, 4
mov ecx, dword [esp + 0x834]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x840
ret 0x10

Function at 0x405bfb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41be5c]
jne 0x405c05
repz ret
jmp fcn.0040a818
Function at 0x40e96f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040788a
and dword [ebp - 4], 0
cmp dword [0x4a7f70], 0
mov ebx, eax
jne 0x40ea20
push 0x402348
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ead1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40233c
push edi
call esi
test eax, eax
je 0x40ead1
push eax
call fcn.00407818
mov dword [esp], 0x40232c
push edi
mov dword [0x4a7f70], eax
call esi
push eax
call fcn.00407818
mov dword [esp], 0x402318
push edi
mov dword [0x4a7f74], eax
call esi
push eax
call fcn.00407818
mov dword [esp], 0x4022fc
push edi
mov dword [0x4a7f78], eax
call esi
push eax
call fcn.00407818
pop ecx
mov dword [0x4a7f80], eax
test eax, eax
je 0x40ea20
push 0x4022e4
push edi
call esi
push eax
call fcn.00407818
pop ecx
mov dword [0x4a7f7c], eax
mov eax, dword [0x4a7f7c]
cmp eax, ebx
je 0x40ea78
cmp dword [0x4a7f80], ebx
je 0x40ea78
push eax
call fcn.00407893
push dword [0x4a7f80]
mov esi, eax
call fcn.00407893
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ea78
test edi, edi
je 0x40ea78
call esi
test eax, eax
je 0x40ea6f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ea6f
test byte [ebp - 0xc], 1
jne 0x40ea78
or dword [ebp + 0x10], 0x200000
jmp 0x40eab1
mov eax, dword [0x4a7f74]
cmp eax, ebx
je 0x40eab1
push eax
call fcn.00407893
pop ecx
test eax, eax
je 0x40eab1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40eab1
mov eax, dword [0x4a7f78]
cmp eax, ebx
je 0x40eab1
push eax
call fcn.00407893
pop ecx
test eax, eax
je 0x40eab1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a7f70]
call fcn.00407893
pop ecx
test eax, eax
je 0x40ead1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ead3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000983f
pop dword [ebp - 0x24]
mov eax, 0xeb43f8c6
sub eax, 0xdb436087
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4193b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x7a2ed64
add ecx, 0xf85d7ce9
mov edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x24]
mov esi, 0xed524823
sub esi, 0xcc56488f
xor dword [ebp - 0x20], edx
mov edi, dword [ebx]
xor dword [ebp - 0x20], 0x1c433890
sub edi, esi
sub dword [ebp - 0x20], ecx
mov dword [edx], edi
xor dword [ebp - 0x18], ecx
add edx, 0xc0251807
add edx, 0x3fdae7fd
add ebx, 0xa38b349f
add ebx, 0x5c74cb65
loop 0x10009893
add eax, 0x1f4e4879
add eax, 0xe0b3538e
xor ebx, ebx
add ebx, eax
add eax, 0x127cbaa7
add eax, 0xed83455e
mov ecx, 0xc966daa2
sub ecx, 0xb966daa2
add ecx, dword [ebp - 0x24]
call ebx
leave
ret