joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f320
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43038d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x43d100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.004061d0
mov edi, eax
cmp edi, 0x43daac
je 0x40f3b7
mov esi, dword [0x43daac]
mov ecx, 0x43daac
push dword [esi + 4]
push 0x43daac
call fcn.00407650
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov ecx, dword [0x43daac]
mov dword [0x43dab0], 0
mov eax, dword [edi]
mov dword [0x43daac], eax
mov eax, dword [edi + 4]
mov dword [edi], ecx
mov ecx, dword [0x43dab0]
mov dword [0x43dab0], eax
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
lea eax, [ebp - 0x18]
push eax
mov ecx, eax
call fcn.00407650
push 0x40
push dword [ebp - 0x18]
call fcn.004248d9
add esp, 8
lea ecx, [ebp - 0x20]
push dword [ebp - 0x10]
call fcn.0040e340
mov cl, byte [0x43dab8]
mov al, byte [ebp - 0x20]
mov edx, dword [0x43dac0]
mov esi, dword [0x43dac4]
mov byte [ebp - 0x10], cl
mov byte [0x43dab8], al
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x20], cl
mov ecx, dword [ebp - 0x14]
mov dword [0x43dac0], eax
mov dword [0x43dac4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00414e00
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
mov byte [ebp - 4], 0
cmova eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.Luna_Start
push edi
call esi
push str.Luna_EmbedSettings
push edi
mov dword [0x43da90], eax
call esi
push str.Luna_Inject
push edi
mov dword [0x43da98], eax
call esi
push str.Luna_useembed
push edi
mov dword [0x43da94], eax
call esi
push str.Luna_checkisusingembed
push edi
mov dword [0x43da9c], eax
call esi
push str.Luna_embedcallback
push edi
mov dword [0x43daa0], eax
call esi
push 0
push 0x64
push 0
push 0
mov dword [0x43daa4], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0x405c70
push 0x405cc0
push fcn.00402bb0
push fcn.00402bb0
push fcn.00402bb0
push fcn.00402bb0
push 0x405cb0
push 0x405ca0
mov dword [0x43daa8], eax
call dword [0x43da90]
mov ecx, dword [ebp + 0x1c]
add esp, 0x20
cmp ecx, 7
jbe 0x40f50c
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f502
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f522
push ecx
push edx
call fcn.004248d9
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.00425c60
int3
Function at 0x411310
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
push esi
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x43dad0
xor eax, edx
imul esi, eax, 0x1000193
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00407ba0
mov edx, dword [eax + 4]
test edx, edx
je 0x4113c2
mov ecx, dword [0x43dae8]
mov eax, dword [0x43dadc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x41139c
cmp eax, edx
jne 0x411394
mov eax, dword [0x43dad4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4113a4
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x4113a4
cmp eax, edx
jne 0x4113a4
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [0x43dad8]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.004248d9
add esp, 8
push 0
push 1
push dword [0x43daa8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x413130
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
ja 0x41327c
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00412b00
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x413257
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
mov edx, dword [edi + 0xc]
imul esi, esi, 0x1000193
and esi, dword [edi + 0x18]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x4131e2
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x41324c
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x413219
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x413214
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x413249
cmp esi, edx
je 0x41322c
nop dword [eax]
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x413260
cmp esi, edx
jne 0x413220
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x413192
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x413249
push str.invalid_hash_bucket_count
call fcn.004238f6
int3
Function at 0x41c750
Capabilities:
Connect pipe
Create pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1528
call fcn.00425280
mov eax, dword [0x43d100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1504], eax
mov ecx, dword [eax + 8]
push dword [eax + 4]
mov dword [ebp - 0x14fc], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x1500], edi
test edi, edi
je 0x41c9a2
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartSession
push edi
call esi
push str.OpenEngine
push edi
mov ebx, eax
call esi
push str.SimpleTransSentM
push dword [ebp - 0x1500]
mov edi, eax
call esi
push str.SetBasicDictPathW
push dword [ebp - 0x1500]
mov dword [ebp - 0x1508], eax
call esi
mov esi, eax
lea eax, [ebp - 0x804]
push 0x4349bc
push eax
lea eax, [ebp - 0xcf8]
push eax
push dword [ebp - 0x14fc]
call ebx
push 0x4f4
call edi
push dword [ebp - 0x14fc]
push 0x4f4
call esi
mov edi, dword [ebp - 0x1504]
push 0
push 0xffffffffffffffff
push 0xffff
push 0xffff
push 0xff
push 6
push 3
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov dword [ebp - 0x1518], 0
push 1
lea eax, [ebp - 0x1528]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x1528], xmm0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x1528]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push dword [edi + 0x10]
lea eax, [ebp - 0x1528]
mov dword [ebp - 0x1514], 0xc
push 0
mov dword [ebp - 0x1510], eax
lea eax, [ebp - 0x1514]
push 0
push eax
mov dword [ebp - 0x150c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14fc]
push 0
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c98f
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x1508]
nop dword [eax + eax]
push 0x800
lea eax, [ebp - 0x14f8]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14f8]
push 4
push 0x28
push eax
lea eax, [ebp - 0x804]
push eax
push 0x4f4
call ebx
lea eax, [ebp - 0x14f8]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c930
sub eax, edx
lea ecx, [ebp - 0x14fc]
push 0
sar eax, 1
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x14f8]
push eax
push esi
call edi
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14fc]
push 0
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c8f0
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004248f5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004248f5
mov esp, ebp
pop ebp
ret
Function at 0x4223a0
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x34], 0
jne 0x4223b4
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp + 0x34], eax
cmp dword [ebp + 0x2c], 0
jne 0x4223d0
lea ecx, [ebp - 0x14]
mov dword [ebp + 0x2c], ecx
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
or ecx, 4
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp + 0x34]
test eax, eax
jne 0x422409
xor eax, eax
jmp 0x4224a2
mov ecx, dword [ebp + 0x30]
mov dword [ebp - 4], ecx
push 1
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
push ecx
call fcn.00422740
test eax, eax
jne 0x422467
mov edx, dword [ebp + 0x34]
push edx
mov eax, dword [ebp + 0x30]
push eax
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx + 8]
push edx
call fcn.00422720
test eax, eax
jne 0x422467
push 0xffffffffffffffff
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4224a2
mov eax, dword [ebp + 0x1c]
and eax, 4
jne 0x42247c
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp dword [ebp + 0x2c], eax
jne 0x42249d
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4224b0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x43d100]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x418], 0
cmp dword [ebp + 0xc], 1
jb 0x4224e6
cmp dword [ebp + 0xc], 0x1000
jbe 0x4224f8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4226fb
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00420b90
test eax, eax
jne 0x42251e
jmp 0x4226fb
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push str.WINDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
je 0x422550
cmp dword [ebp - 0x420], 0x104
jb 0x42255a
jmp 0x4226fb
push str._sysnative_rundll32.exe
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004213c0
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jge 0x422589
jmp 0x4226fb
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x418]
lea eax, [edx + ecx + 0xc]
push eax
push str.rundll32.exe___hs__1
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call fcn.004214d0
add esp, 0x10
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jge 0x4225ce
jmp 0x4226fb
push 0x10
push 0
lea edx, [ebp - 0x438]
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x47c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x47c], 0x44
lea ecx, [ebp - 0x438]
push ecx
lea edx, [ebp - 0x47c]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x4226fb
mov edx, dword [ebp - 0x418]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
push 0x43522c
mov edx, dword [ebp - 0x438]
push edx
call fcn.00422060
test eax, eax
jne 0x422683
push 0xffffffffffffffff
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4226fb
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x424], 0x1f4
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x424], 0
je 0x4226f1
jmp 0x4226fb
mov dword [ebp - 0x428], 1
lea ecx, [ebp - 0x418]
push ecx
call fcn.00420fa0
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004248f5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42421a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x424241
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x424244
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004241f6
pop esi
leave
ret 8

Function at 0x4256ff
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42573e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42573e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42573e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42573e
cmp dword [ecx + 0x74], 0xe
jbe 0x42573e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x425c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x43d100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x425cb7
mov ecx, 5
int 0x29
push 2
call fcn.004257a3
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x425dc2
test esi, esi
jne 0x425dc2
push 2
call fcn.004257a3
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004248f5
mov esp, ebp
pop ebp
ret
Function at 0x42a8d0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x42a8fa
mov eax, 2
pop ebp
ret
push esi
call fcn.00425af0
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x42a91a
jmp dword [eax*4 + 0x42a950]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.00425c20
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x42a960
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x43d100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x42aa5b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x42aa5b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x42a9ba
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x42a998
jmp 0x42aa5b
cmp edx, 0x200
jae 0x42aac1
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x42aa5b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x42aa5a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x42aa5a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x42aaa3
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x42aa40
pop edi
mov eax, dword [0x43e0f4]
test eax, eax
jne 0x42aa81
push str.setlocale
call fcn.0042b850
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x42aa7c
or eax, 0xffffffff
mov dword [0x43e0f4], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x42aaaf
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004248f5
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x42aa5a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004248f5
mov esp, ebp
pop ebp
ret
call fcn.00424a48
int3

Function at 0x42adc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0042adf0
mov esi, dword [ebp + 8]
test al, al
je 0x42adde
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.0042ae00
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42af30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42af8c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42af8c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42af8c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42af8c
cmp dword [ecx + 0x74], 0xe
jbe 0x42af8c
cmp dword [ecx + 0xe8], 0
je 0x42af8c
push dword [ebp + 8]
call fcn.0042ae00
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x43e100
call fcn.0042abd0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x42afc1
push dword [ebp + 8]
call fcn.0042adc0
mov esp, ebp
pop ebp
ret

Function at 0x42b000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42b05c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42b05c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42b05c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42b05c
cmp dword [ecx + 0x74], 0xe
jbe 0x42b05c
cmp dword [ecx + 0xe8], 0
je 0x42b05c
push dword [ebp + 8]
call fcn.0042ae00
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x43e100
call fcn.0042abd0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x42b091
push dword [ebp + 8]
call fcn.0042adc0
mov esp, ebp
pop ebp
ret

Function at 0xf488ec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf488f6
pushal
call 0xf488fc
pop ebp
sub ebp, 0x10
sub ebp, 0xb488ec
jmp 0xf48912
mov eax, 0xb488ec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0x2a68e535
xor byte [eax], dl
inc eax
dec ecx
jne 0xf48929
jmp 0xf4893c
mov esi, 0x9bcbef8
xor eax, 0xf4b43535
int 0x35
xor eax, 0x8df83635
xor esi, dword [0x1d8f3535]
xor eax, 0xd7c23535
std
mov esi, 0x353539b4
xor eax, 0x6565f036
pop ebp
push ebp
jae 0xf4897d
xor eax, 0xa177bf5d
xor eax, 0x5d111934
shl byte [eax + ebx*8 - 0x5f], 1
fnsave dword [eax]
xor eax, 0x1bdc3535
xor eax, 0x61603535
push 0x353db0be
xor eax, 0x39a0be35
xor eax, 0xb8be3535
and eax, 0xf4353535
fdiv qword [edi]
add al, 0x37
mov dh, 0xf7
xor dword [edx + edi - 0x50], edi
ror edx, 0xca
retf 0x19be