joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401443
pop dword [ebp - 8]
mov eax, 0xb202957b
add eax, 0x4e3d7ec8
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x313ce381
sub dword [ebp - 0x18], 0xe2ea9e36
mov dword [ebp - 0x14], 0x9fc9be3a
sub dword [ebp - 0x14], 0x6d9671f5
mov dword [ebp - 0x10], 0xf5ba34e4
add dword [ebp - 0x10], 0x56920f4a
mov dword [ebp - 0xc], 0x238a0374
add dword [ebp - 0xc], 0xdc75fc8c
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1984b920
sub dword [ebp - 0x18], 0xa5124fca
mov dword [ebp - 0x14], 0xab1bd9e1
add dword [ebp - 0x14], 0x96508794
mov dword [ebp - 0x10], 0xf13b88e8
sub dword [ebp - 0x10], 0x8dcc1c7c
mov dword [ebp - 0xc], 0xe9cfe0e
sub dword [ebp - 0xc], 0xe9cfe0e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe1f31afb
add eax, 0x1e4d6605
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37a7a
push 0
call eax
mov ecx, 0x31da8b9e
add ecx, 0xce25b9d7
mov esi, eax
mov edx, 0xb3963449
add edx, 0x4cb0afb7
add edx, dword [ebp - 8]
mov edi, 0xaabc5541
mov dword [ebp - 4], 0xf43f05b0
mov ebx, dword [edx]
sub dword [ebp - 4], edx
xor ebx, edi
xor dword [ebp - 4], ecx
mov dword [esi], ebx
mov dword [ebp - 4], 0x39053013
add esi, 0x13b8ca69
sub esi, 0x13b8ca65
add edx, 0xfcc8fab0
sub edx, 0xfcc8faac
loop 0x40155a
add eax, 0xd6cab57b
sub eax, 0xd6c9acd4
mov ebx, eax
add eax, 0x1c9dd028
add eax, 0xe3622fdd
mov ecx, 0x7207069e
sub ecx, 0x71c7069e
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, section..data
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, str.pause
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x40e447
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40e456
pop dword [ebp - 0x30]
mov eax, 0xff5e2d74
add eax, 0xe2b6e2
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3cc6a
push 0
mov eax, 0xd80d9e43
add eax, 0x2834b3d5
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x43f2
xor edx, edx
add edx, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x30]
mov edi, 0x215e83a
mov dword [ebp - 0x1c], 0xdd797f12
mov esi, dword [ebx]
xor dword [ebp - 4], 0xe2ecdc32
xor esi, edi
xor dword [ebp - 0xc], 0x2a866e5c
mov dword [edx], esi
mov dword [ebp - 0x24], 0xd30edf7
add edx, 0xbd19a8da
sub edx, 0xbd19a8d6
add ebx, 4
loop 0x40e4a5
add eax, 0xc64d591f
sub eax, 0xc64c5684
mov ebx, eax
add eax, 5
mov ecx, 0x5b9fa5c2
add ecx, 0xa4a05a3e
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x43fbad
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5e8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fbf0
push str.SystemFunction040
push dword [0x46b5e8]
call edi
push str.SystemFunction041
push dword [0x46b5e8]
mov dword [0x46b5f0], eax
call edi
mov dword [0x46b5f4], eax
jmp 0x43fbf5
mov eax, dword [0x46b5f4]
cmp dword [0x46b5f0], 0
je 0x43fc06
test eax, eax
jne 0x43fcad
push 0x46b5ec
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fcb7
push str.CryptProtectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f0], 0
mov dword [0x46b5f8], eax
jne 0x43fc6b
test eax, eax
jne 0x43fc6b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28
push str.cryputil.cpp
call fcn.004037d3
jmp 0x43fcb7
push str.CryptUnprotectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f4], 0
mov dword [0x46b5fc], eax
jne 0x43fcad
test eax, eax
jne 0x43fcad
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2d
jmp 0x43fc5f
mov dword [0x46b600], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x4401f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4401ff
pop dword [ebp - 0x24]
mov eax, 0xb0dbae2e
add eax, 0x4f6853d1
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4e8c8
push 0
mov eax, 0x452374bb
sub eax, 0x44dec213
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x44fc99f0
sub ecx, 0x44fc5702
xor ebx, ebx
add ebx, eax
mov esi, 0x38e638c0
sub esi, 0x389ecac0
add esi, dword [ebp - 0x24]
mov edi, 0x14dcf51b
sub edi, 0xc5206e0e
xor dword [ebp - 0x14], 0x2bcb724b
mov edx, dword [esi]
sub dword [ebp - 0x14], ecx
sub edx, edi
mov dword [ebp - 0x14], 0x5b0ecec9
mov dword [ebx], edx
xor dword [ebp - 0x1c], eax
add ebx, 0x546806fd
sub ebx, 0x546806f9
add esi, 0xcf14f84e
sub esi, 0xcf14f84a
loop 0x440260
add eax, 0xfe8b
xor ebx, ebx
add ebx, eax
add eax, 0x71684073
add eax, 0x8e97bf92
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x5b6404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x5b6404
lcall 0x5de5, 0x8b10c483
jmp loc.00d03998
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401039
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401070
lea ebx, [ebx]
cmp esi, eax
jae 0x401074
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401060
cmp esi, eax
jb 0x40107a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4078b0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 8], 0
cmp dx, word [eax + 6]
jae 0x407957
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x407912
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x40793b
mov ecx, dword [esi - 4]
push 4
push 0x1000
push edi
add ecx, ebx
push ecx
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00427030
jmp 0x407938
mov edx, dword [esi - 4]
push 4
push 0x1000
push eax
add edx, ebx
push edx
call ebp
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi]
push eax
push ecx
push edi
call fcn.00427d90
mov dword [esi - 8], edi
add esp, 0xc
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4078e3
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x407960
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x407a15
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4079b7
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4079fd
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov edx, dword [ecx*4 + 0x44c230]
test eax, 0x4000000
je 0x4079d1
or edx, 0x200
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x4079ea
test al, 0x40
je 0x4079e1
mov ecx, dword [ebx + 0x20]
jmp 0x4079e8
test al, al
jns 0x4079fd
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4079fd
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x407984
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40f489
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40f4d0
call fcn.004090fe
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f4d0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40f4ec
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f003
mov esi, eax
test edi, edi
je 0x40f4ea
test ebx, ebx
je 0x40f4ea
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x410586
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43a76f
call fcn.0042879b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4105ab
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4105f1
lea ecx, [ebp - 0x10]
call fcn.00402660
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407f1f
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010d0
mov eax, esi
call fcn.00428873
ret 8

Function at 0x413830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x413854
cmp dword [edi + 0x54], 0
jne 0x413854
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004090fe
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004137f1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x413d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x413da8
call fcn.004090fe
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x413da8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x413deb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x413dd4
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x413dd4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x413de8
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x427490
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d7c0]
jne 0x42749a
repz ret
jmp fcn.0042e2ec
Function at 0x436207
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042cae9
and dword [ebp - 4], 0
cmp dword [0x4514cc], 0
mov ebx, eax
jne 0x4362b8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x436369
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x442ca0
push edi
call esi
test eax, eax
je 0x436369
push eax
call fcn.0042ca77
mov dword [esp], 0x442c90
push edi
mov dword [0x4514cc], eax
call esi
push eax
call fcn.0042ca77
mov dword [esp], 0x442c7c
push edi
mov dword [0x4514d0], eax
call esi
push eax
call fcn.0042ca77
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4514d4], eax
call esi
push eax
call fcn.0042ca77
pop ecx
mov dword [0x4514dc], eax
test eax, eax
je 0x4362b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042ca77
pop ecx
mov dword [0x4514d8], eax
mov eax, dword [0x4514d8]
cmp eax, ebx
je 0x436310
cmp dword [0x4514dc], ebx
je 0x436310
push eax
call fcn.0042caf2
push dword [0x4514dc]
mov esi, eax
call fcn.0042caf2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x436310
test edi, edi
je 0x436310
call esi
test eax, eax
je 0x436307
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x436307
test byte [ebp - 0xc], 1
jne 0x436310
or dword [ebp + 0x10], 0x200000
jmp 0x436349
mov eax, dword [0x4514d0]
cmp eax, ebx
je 0x436349
push eax
call fcn.0042caf2
pop ecx
test eax, eax
je 0x436349
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x436349
mov eax, dword [0x4514d4]
cmp eax, ebx
je 0x436349
push eax
call fcn.0042caf2
pop ecx
test eax, eax
je 0x436349
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4514cc]
call fcn.0042caf2
pop ecx
test eax, eax
je 0x436369
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43636b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005fc8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006007
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10006007
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006007
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10006007
cmp dword [ecx + 0x74], 0xe
jbe 0x10006007
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10007b9a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100116d8
push 0x100116d0
push str.FlsAlloc
push 0x1f
call fcn.10007ab6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007bce
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f130]
call esi
jmp 0x10007bd4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007c18
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100116e8
push 0x100116e0
push str.FlsGetValue
push 0x21
call fcn.10007ab6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007c4f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007c57
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100116f0
push 0x100116e8
push str.FlsSetValue
push 0x22
call fcn.10007ab6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007c91
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10009b9a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10009c37
push ebx
push esi
call fcn.10009b63
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10009af7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009be4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009c36
push edi
push eax
call fcn.10009dbd
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10009c04
call fcn.10007963
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009c35
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10009af7
add esp, 0x20
test eax, eax
jne 0x10009c23
push edi
call fcn.10007963
jmp 0x10009c2b
push ebx
call fcn.10007963
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000e6f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e71d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e71d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x47d3a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x5b0008]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
cmp eax, dword [edi + 0xc]
je 0x47d56a
xorps xmm0, xmm0
push 0x7f0
push esi
movaps xmmword [esp + 0x28], xmm0
movaps xmmword [esp + 0x38], xmm0
movaps xmmword [esp + 0x48], xmm0
movaps xmmword [esp + 0x58], xmm0
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esp + 0x18], eax
test eax, eax
je 0x47d56a
push 0x479
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esp + 0x10], eax
test eax, eax
je 0x47d56a
cmp dword [ebp + 0xc], 0
jne 0x47d421
push dword [edi + 0x10]
jmp 0x47d424
push dword [edi + 0x14]
push 0
push 0xf7
push 0x800
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x47d4a0
mov edi, dword [ebp + 0xc]
nop dword [eax]
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
jne 0x47d48d
push edi
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x47d460
mov edi, dword [esp + 0x1c]
cmp dword [ebp + 0xc], 0
mov esi, dword [esp + 0x14]
jne 0x47d530
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [edi], 0
jne 0x47d4e6
cmp dword [edi + 4], 0
jne 0x47d4e6
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x20]
mov dword [edi], eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push 0
push dword [esp + 0x14]
mov dword [edi + 4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x24]
push 6
push eax
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x28]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x5a2bd0
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [edi + 0xc], 0
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00518799
mov esp, ebp
pop ebp
ret 8
push 6
push dword [edi + 4]
push dword [edi]
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0x402
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x5a2be4
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [edi + 0xc], 1
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.00518799
mov esp, ebp
pop ebp
ret 8
Function at 0x41249e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4a7440]
xor eax, esp
mov dword [esp + 8], eax
mov byte [esp + 7], 1
mov eax, 0xfeb5c628
mov ecx, 0x6637d818
mov edx, 0xacaea3dc
cmp eax, 0x299dc6c4
jle 0x4124e4
cmp eax, 0x299dc6c5
je 0x412513
cmp eax, 0x4fafee73
je 0x41251a
cmp eax, 0x6637d818
jne 0x4124c3
jmp 0x412597
cmp eax, 0xacaea3dc
je 0x412557
cmp eax, 0xfeb5c628
jne 0x4124c3
rdtsc
xchg ebx, eax
rdtsc
sub eax, ebx
cmp eax, dword [esp + 0x1c]
jg 0x412504
mov byte [esp + 7], 0
movzx eax, byte [esp + 7]
mov dword [esp], eax
mov eax, 0x4fafee73
jmp 0x4124c3
mov eax, 0xacaea3dc
jmp 0x4124c3
mov eax, dword [0x4a79a0]
mov esi, dword [0x4a79a4]
lea edi, [eax + 1]
imul edi, eax
mov eax, edi
xor eax, 0xfffffffe
test eax, edi
sete bl
cmp esi, 0xa
setl bh
xor bh, bl
mov ebx, 0x299dc6c5
cmovne ebx, edx
test eax, edi
mov eax, ebx
cmove eax, edx
cmp esi, 0xa
cmovge eax, ebx
jmp 0x4124c3
mov edi, dword [0x4a79a0]
mov esi, dword [0x4a79a4]
lea eax, [edi + 1]
imul eax, edi
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete bl
cmp esi, 0xa
setl bh
xor bh, bl
mov edi, 0x299dc6c5
cmovne edi, ecx
cmp eax, 0xffffffff
mov eax, edi
cmove eax, ecx
cmp esi, 0xa
cmovge eax, edi
jmp 0x4124c3
mov esi, dword [esp]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004a0b91
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x4a1390
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4a13b7
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4a13ba
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004a136c
pop esi
leave
ret 8

Function at 0x4a17fe
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a183d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a183d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a183d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a183d
cmp dword [ecx + 0x74], 0xe
jbe 0x4a183d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret