joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d7580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
test esi, esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x7d76e1
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x7d76e0
mov al, byte [edi + 4]
mov byte [esi + 0x16], al
mov cl, byte [edi + 4]
mov byte [esi + 0x17], cl
mov edx, dword [edi]
mov ecx, dword [esi + 0x24]
push ebx
mov dword [esi + 0x1c], edx
mov al, byte [edi + 5]
push 1
push ecx
mov byte [esi + 0x18], al
call fcn.00460450
movsx edx, word [0x92aed2]
mov eax, dword [esi + 0x78]
mov dword [esp + 0x30], edx
push eax
mov dword [esp + 0x24], 0x42040000
fild dword [esp + 0x34]
mov dword [esp + 0x28], 0x43190000
mov dword [esp + 0x2c], 0x41900000
fstp dword [esp + 0x20]
call fcn.004627d0
movzx ecx, byte [edi + 5]
movzx edx, byte [edi + 4]
push ecx
push 0
push 2
push edx
call fcn.00561740
mov ecx, dword [esi + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x16
push ecx
call fcn.004629a0
mov ebx, eax
push 1
push ebx
mov dword [esi + 0x78], ebx
call fcn.00460450
push 0
lea edx, [esp + 0x4c]
push edx
push ebx
call fcn.004602c0
movsx eax, word [str._f_Zt]
mov ecx, dword [esi + 0x38]
mov ebx, dword [esi + 0x34]
mov dword [esp + 0x68], eax
add esp, 0x40
push ecx
fild dword [esp + 0x2c]
push ebx
mov dword [esp + 0x18], 0x42000000
fstp dword [esp + 0x14]
call fcn.0085cfd0
mov edx, dword [edi]
mov ecx, dword [esi + 0x30]
xor eax, eax
mov al, byte [edi + 4]
push edx
lea edx, [esp + 0x18]
push eax
push ecx
push edx
push ebx
call fcn.007df820
mov ebx, dword [esi + 0x34]
mov edx, dword [esi + 0x3c]
mov dword [esi + 0x38], eax
movsx eax, word [str._f_Zt]
movsx ecx, word [0x92aee0]
mov dword [esp + 0x44], eax
inc ecx
fild dword [esp + 0x44]
mov dword [esp + 0x44], ecx
fstp dword [esp + 0x28]
fild dword [esp + 0x44]
fstp dword [esp + 0x2c]
push edx
push ebx
call fcn.0085cfd0
mov eax, dword [edi]
mov edx, dword [esi + 0x30]
xor ecx, ecx
mov cl, byte [edi + 4]
push eax
lea eax, [esp + 0x34]
push ecx
push edx
push eax
push ebx
call fcn.007df820
add esp, 0x38
mov dword [esi + 0x3c], eax
call fcn.007d7200
pop ebx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x7de550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov al, 0x20
push ebx
mov bl, 0x26
mov cl, 0xd9
mov byte [esp + 0xe], al
mov byte [esp + 0x10], bl
mov byte [esp + 0x12], al
mov byte [esp + 0x16], al
mov byte [esp + 0x18], bl
mov ebx, dword [esp + 0x30]
mov byte [esp + 0x1a], al
xor eax, eax
cmp ebx, eax
mov byte [esp + 0xf], cl
mov dl, 0x18
mov byte [esp + 0x13], cl
mov cl, 0xff
mov byte [esp + 0xc], 0xa
mov byte [esp + 0xd], 0x1a
mov byte [esp + 0x11], dl
mov byte [esp + 0x14], 0xa
mov byte [esp + 0x15], 0x1a
mov byte [esp + 0x17], cl
mov byte [esp + 0x19], dl
mov byte [esp + 0x1b], cl
mov word [esp + 4], ax
mov word [esp + 6], ax
mov word [esp + 8], 0x93
mov word [esp + 0xa], 0x2f
je 0x7de773
mov ecx, dword [0x8d5a94]
mov edx, dword [0x8d5a98]
mov eax, dword [0x8d5a90]
push ebp
push esi
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
movsx ecx, word [esi]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x2c], edx
movsx edx, word [esi + 2]
fild dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov eax, dword [0x8d5a9c]
fstp dword [esp + 0x24]
mov dword [esp + 0x38], edx
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 0x18]
fild dword [esp + 0x38]
push edi
push eax
fstp dword [esp + 0x30]
call fcn.0045cca0
mov ebp, dword [esp + 0x48]
xor eax, eax
add esp, 4
and ebp, 0x80000003
mov ecx, 8
mov edi, ebx
rep stosd dword es:[edi], eax
jns 0x7de63c
dec ebp
or ebp, 0xfffffffc
inc ebp
mov ecx, dword [esi]
movzx eax, byte [esp + 0x4c]
sub eax, 9
mov dword [ebx], ecx
mov edx, dword [esi]
mov dword [ebx + 4], edx
mov dword [ebx + 0x14], 0x8d5ac0
je 0x7de66e
dec eax
je 0x7de665
dec eax
jne 0x7de675
mov dword [ebx + 0x14], 0x8d5abc
jmp 0x7de675
mov dword [ebx + 0x14], 0x8d5ab8
jmp 0x7de675
mov dword [ebx + 0x14], 0x8d5ab4
call fcn.0045cce0
mov esi, eax
mov eax, dword [esp + 0x48]
push eax
push esi
mov dword [ebx + 0x18], esi
call fcn.00460520
push 0
lea ecx, [esp + 0x34]
push ecx
push esi
call fcn.004602c0
push 1
push esi
call fcn.00460450
push esi
call fcn.0085cf30
mov edi, eax
push 1
push edi
call fcn.00460450
push edi
call fcn.0085d050
mov edi, eax
push 1
push edi
call fcn.00460450
lea edx, [esp + ebp*4 + 0x4c]
push edx
push 3
push 5
push 0
push 0x8d5a90
push 0
push edi
call fcn.007dff40
mov eax, dword [0x8d5aa0]
mov ecx, dword [0x8d5aa4]
mov edx, dword [0x8d5aa8]
mov dword [esp + 0x78], eax
mov eax, dword [0x8d5aac]
add esp, 0x50
push esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call fcn.0085cf30
push 0
lea ecx, [esp + 0x30]
mov edi, eax
push ecx
push edi
call fcn.004602c0
push 1
push edi
call fcn.00460450
push edi
call fcn.0085d780
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.0085d710
push esi
call fcn.0085cf30
mov edi, eax
push 0
lea eax, [esp + 0x54]
push eax
push edi
mov dword [ebx + 0x1c], edi
call fcn.004602c0
push 1
push edi
call fcn.00460450
push esi
call fcn.0085cf30
add esp, 0x40
mov esi, eax
push 1
push esi
call fcn.00460450
push esi
call fcn.0085d780
push eax
call fcn.0085d760
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x7fba10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov al, byte [ecx]
add al, 4
movzx eax, al
cdq
mov ebx, 5
idiv ebx
mov byte [ecx], dl
movzx eax, byte [esi]
lea ebx, [eax + edi]
movzx edx, dl
lea eax, [ebx + eax*4]
cmp byte [edx + eax], 0xff
je 0x7fba11
pop ebx
ret

Function at 0x7fba40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov al, byte [ecx]
inc al
movzx eax, al
cdq
mov ebx, 5
idiv ebx
mov byte [ecx], dl
movzx eax, byte [esi]
lea ebx, [eax + edi]
movzx edx, dl
lea eax, [ebx + eax*4]
cmp byte [edx + eax], 0xff
je 0x7fba41
pop ebx
ret

Function at 0x804970
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
xor ebx, ebx
push esi
mov byte [esp + 0xd], bl
call fcn.007fa050
mov esi, eax
call fcn.007fa050
mov cl, byte [esi + edi + 0x12]
mov ebp, eax
mov al, byte [esi + edi + 0x10]
mov byte [esp + 0xe], al
mov al, byte [esp + 0x14]
add ebp, 0x478
test al, 9
mov byte [esp + 0xf], cl
je 0x8049b0
mov ebx, 1
mov byte [esp + 0xd], bl
nop
mov dl, byte [esi + edi + 0x12]
add dl, bl
movzx eax, dl
and eax, 0x80000001
jns 0x8049c5
dec eax
or eax, 0xfffffffe
inc eax
mov byte [esi + edi + 0x12], al
movzx ecx, byte [esi + edi + 0x10]
movzx eax, al
mov edx, ebp
add edx, ecx
lea eax, [eax + eax*2]
cmp byte [edx + eax*2], 0xff
je 0x8049b0
mov eax, dword [esp + 0x14]
xor ecx, ecx
test al, al
jns 0x8049ef
mov ecx, 5
jmp 0x8049f9
test ah, 4
je 0x804a00
mov ecx, 1
mov byte [esp + 0xd], 1
mov edi, edi
mov al, byte [esi + edi + 0x10]
add al, cl
movzx eax, al
cdq
mov ebx, 6
idiv ebx
mov ebx, ebp
mov byte [esi + edi + 0x10], dl
movzx eax, byte [esi + edi + 0x12]
movzx edx, dl
add ebx, edx
lea eax, [eax + eax*2]
cmp byte [ebx + eax*2], 0xff
je 0x804a00
mov al, byte [esp + 0xd]
test al, al
je 0x804a3f
push 0x6c00850c
call fcn.005617c0
add esp, 4
mov cl, byte [esi + edi + 0x10]
cmp byte [esp + 0xe], cl
jne 0x804a53
mov al, byte [esp + 0xf]
cmp al, byte [esi + edi + 0x12]
je 0x804aad
movzx eax, byte [esi + edi + 0x12]
lea edx, [eax + eax*2]
movzx eax, cl
push 1
lea eax, [eax + edx*2]
movzx ecx, byte [eax + ebp]
push 1
push eax
push ecx
push edi
call fcn.007f85f0
mov eax, dword [0xdb7020]
add esp, 0x14
xor edx, edx
cmp eax, 2
jne 0x804a99
mov dl, byte [esi + edi + 0x12]
xor eax, eax
mov al, byte [esi + edi + 0x10]
push edx
push eax
call fcn.0081af80
add esp, 8
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dl, byte [esi + edi + 0x10]
xor ecx, ecx
mov cl, byte [esi + edi + 0x12]
push ecx
push edx
call fcn.00818c50
add esp, 8
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x81ca00
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
call fcn.008080e0
mov ebx, eax
xor edi, edi
mov esi, 0x2c
lea esp, [esp]
cmp ebx, 0xb
mov byte [esp + 0x14], 0
je 0x81ca61
cmp ebx, 0xc
je 0x81ca61
cmp ebx, 0xf
je 0x81ca42
cmp ebx, 0x12
je 0x81ca42
cmp ebx, 0x14
jne 0x81cac3
push edi
call fcn.007fb3e0
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x17], 0xff
mov eax, dword [edx + esi]
push ecx
push eax
jmp 0x81cab6
cmp dword [esp + 0x20], 3
jne 0x81ca99
mov eax, edi
cdq
mov ecx, 5
idiv ecx
test edx, edx
jne 0x81cac3
cmp eax, 4
jge 0x81cac3
lea edx, [eax*4 + 0x94e48c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + esi]
push edx
push ecx
mov byte [esp + 0x1c], 1
call fcn.00815080
add esp, 8
jmp 0x81cac3
push edi
call fcn.007fb3e0
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], edx
lea eax, [esp + 0x14]
mov byte [esp + 0x17], 0xff
mov edx, dword [ecx + esi]
push eax
push edx
call fcn.00815080
add esp, 0xc
mov byte [esp + 0x14], 1
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + esi]
push eax
push edx
call fcn.00815070
add esp, 8
add esi, 4
inc edi
cmp esi, 0xcc
jl 0x81ca20
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x81d170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
cmp cl, 4
mov eax, 0x61
push edi
mov edi, 1
mov edx, 0x2a
mov word [esp + 4], ax
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x28]
mov word [esp + 6], 0x73
mov word [esp + 8], 0x4a
mov word [esp + 0xa], 0x26
mov word [esp + 0xc], di
mov word [esp + 0xe], 0x7f
mov word [esp + 0x10], 0x60
mov word [esp + 0x12], dx
mov word [esp + 0x16], 0x4d
mov word [esp + 0x18], 0x4a
mov word [esp + 0x1a], 0x26
mov word [esp + 0x1c], di
mov word [esp + 0x1e], 0x55
mov word [esp + 0x20], 0x60
mov word [esp + 0x22], dx
jb 0x81d200
push 0
push eax
call fcn.00815070
add esp, 8
pop edi
add esp, 0x20
ret
movzx edi, cl
lea edi, [esp + edi*8 + 4]
push 0x4e38
call fcn.0081cdc0
add esp, 4
pop edi
add esp, 0x20
ret
Function at 0x826190
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
push 1
push ebp
push ebx
call fcn.007f6e80
mov esi, eax
push esi
call fcn.007fd2d0
push ebp
push ebx
mov dword [esp + 0x38], eax
call fcn.007fd310
push ebp
push ebx
call fcn.007fd310
push 2
push ebp
push ebx
call fcn.00839140
push 4
push esi
call fcn.00839070
push 0
push ebp
push ebx
mov edi, eax
call fcn.007fd3d0
add esp, 0x40
push 4
push esi
mov dword [esp + 0x14], eax
call fcn.008391e0
push 0
push ebp
push ebx
mov dword [esp + 0x28], eax
call fcn.007fd480
push esi
mov dword [esp + 0x28], eax
call fcn.00839360
push 1
push ebp
push ebx
mov dword [esp + 0x40], eax
call fcn.007fd4b0
push esi
mov dword [esp + 0x40], eax
call fcn.00839860
add esp, 0x28
cmp eax, 1
je 0x8263a9
test si, si
je 0x8263a9
cmp si, 0x7ff0
je 0x8263a9
cmp si, 0x8000
jb 0x826248
cmp si, 0x80b7
jbe 0x8263a9
cmp ebx, 0x38
jne 0x82625a
call fcn.008386b0
test byte [eax], 1
jmp 0x826323
cmp ebx, 0x39
jne 0x82626c
call fcn.008386b0
test byte [eax], 2
jmp 0x826323
cmp ebx, 0x3a
jne 0x82627e
call fcn.008386b0
test byte [eax], 4
jmp 0x826323
cmp ebx, 0x3b
jne 0x826290
call fcn.008386b0
test byte [eax], 8
jmp 0x826323
cmp ebx, 0x3c
jne 0x8262a2
call fcn.008386b0
test byte [eax], 0x10
jmp 0x826323
cmp ebx, 0x3d
jne 0x8262b1
call fcn.008386b0
test byte [eax], 0x20
jmp 0x826323
cmp ebx, 0x3e
jne 0x8262c0
call fcn.008386b0
test byte [eax], 0x40
jmp 0x826323
cmp ebx, 0x3f
jne 0x8262d5
call fcn.008386b0
cmp byte [eax], 0
jns 0x8263a9
jmp 0x826329
cmp ebx, 0x40
jne 0x8262ed
call fcn.008386b0
mov ecx, dword [eax]
test ch, 1
jne 0x826329
pop edi
pop esi
pop ebp
add esp, 0x18
ret
cmp ebx, 0xae
jne 0x826308
call fcn.008386b0
mov ecx, ebp
mov edx, 1
shl edx, cl
mov ecx, dword [eax + 4]
jmp 0x826321
cmp ebx, 0xaf
jne 0x826329
call fcn.008386b0
mov ecx, ebp
mov edx, 1
shl edx, cl
mov ecx, dword [eax + 8]
test edx, ecx
je 0x8263a9
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x82633e
push esi
call fcn.00839730
add esp, 4
test eax, eax
jne 0x8263a9
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov dx, word [esi + 0xc]
mov word [eax + 0xc], dx
mov cl, byte [esi + 0xe]
mov edx, dword [esp + 0x18]
mov byte [eax + 0xe], cl
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push 2
push ebp
push ebx
mov dword [eax], edx
call fcn.008397b0
push 0x100
call fcn.0059d170
push 0x200
call fcn.0059d170
push 0x400
call fcn.0059d170
add esp, 0x1c
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x8263b0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
push 2
mov esi, ecx
push edi
push esi
call fcn.00838e30
push 1
push edi
push esi
mov ebx, eax
call fcn.007fd520
push 2
push edi
push esi
mov ebp, eax
call fcn.00839880
add esp, 0x24
cmp eax, 1
je 0x82647d
push 1
push edi
push esi
call fcn.007f6e80
add esp, 0xc
cmp ax, 0x7ff0
je 0x82647d
cmp esi, 0x38
jne 0x82640b
call fcn.008386b0
test byte [eax], 1
jmp 0x8264ce
cmp esi, 0x39
jne 0x82641d
call fcn.008386b0
test byte [eax], 2
jmp 0x8264ce
cmp esi, 0x3a
jne 0x82642f
call fcn.008386b0
test byte [eax], 4
jmp 0x8264ce
cmp esi, 0x3b
jne 0x826441
call fcn.008386b0
test byte [eax], 8
jmp 0x8264ce
cmp esi, 0x3c
jne 0x826450
call fcn.008386b0
test byte [eax], 0x10
jmp 0x8264ce
cmp esi, 0x3d
jne 0x82645f
call fcn.008386b0
test byte [eax], 0x20
jmp 0x8264ce
cmp esi, 0x3e
jne 0x82646e
call fcn.008386b0
test byte [eax], 0x40
jmp 0x8264ce
cmp esi, 0x3f
jne 0x826482
call fcn.008386b0
cmp byte [eax], 0
js 0x8264d0
pop edi
pop esi
pop ebp
pop ebx
ret
cmp esi, 0x40
jne 0x826498
call fcn.008386b0
mov ecx, dword [eax]
test ch, 1
jne 0x8264d0
pop edi
pop esi
pop ebp
pop ebx
ret
cmp esi, 0xae
jne 0x8264b3
call fcn.008386b0
mov ecx, edi
mov edx, 1
shl edx, cl
mov ecx, dword [eax + 4]
jmp 0x8264cc
cmp esi, 0xaf
jne 0x8264d0
call fcn.008386b0
mov ecx, edi
mov edx, 1
shl edx, cl
mov ecx, dword [eax + 8]
test edx, ecx
je 0x82647d
mov esi, dword [esp + 0x14]
test esi, esi
je 0x8264dd
cmp esi, 2
jne 0x826506
push ebp
push ebx
call fcn.007f7e50
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebx + 0x20]
mov edx, dword [ebp + 0x20]
xor eax, ecx
and eax, 0x7fffffff
xor eax, edx
push 0x2000
mov dword [ebx + 0x20], eax
call fcn.0059d170
add esp, 0xc
cmp esi, 1
je 0x826514
cmp esi, 2
jne 0x82647d
push ebp
push ebx
call fcn.007f7b00
mov edi, dword [ebx + 0x20]
mov ecx, dword [ebp + 0x20]
add esp, 8
xor ecx, edi
mov edx, edi
pop edi
and ecx, 0x40000000
pop esi
xor edx, ecx
pop ebp
mov dword [ebx + 0x20], edx
pop ebx
mov dword [esp + 4], 0x2000
jmp fcn.0059d170
Function at 0x827420
Capabilities:
Check http status code

Disassembly:
push ebx
push esi
mov esi, dword [ecx + 4]
shr esi, 0xe
xor dl, dl
push edi
and esi, 0xff
movzx edi, dl
movzx edi, byte [edi + 0x94eea0]
cmp esi, edi
je 0x827446
inc dl
cmp dl, 0xc8
jb 0x827431
mov bl, byte [ecx]
and bl, 3
inc bl
mov byte [eax], bl
mov bl, byte [ecx + 4]
mov byte [eax + 1], bl
mov ebx, dword [ecx + 0x28]
shr ebx, 0x17
and bl, 7
inc bl
mov byte [eax + 2], bl
mov bl, byte [ecx + 0x24]
and bl, 7
inc bl
inc dl
mov byte [eax + 6], dl
mov byte [eax + 3], bl
mov edx, dword [ecx]
shr edx, 7
and dl, 0x3f
inc dl
mov byte [eax + 7], dl
mov edx, dword [ecx + 0x24]
shr edx, 0x12
and dl, 3
inc dl
mov byte [eax + 4], dl
mov edx, dword [ecx + 0x24]
shr edx, 0x14
and dl, 0xf
mov byte [eax + 5], dl
mov edx, dword [ecx + 4]
shr edx, 8
and dl, 7
inc dl
mov byte [eax + 8], dl
mov edx, dword [ecx]
shr edx, 0xd
and dl, 0x7f
mov byte [eax + 9], dl
mov edx, dword [ecx]
shr edx, 0x14
and dl, 0x3f
inc dl
mov byte [eax + 0xa], dl
mov dl, byte [ecx + 0x34]
and dl, 3
mov byte [eax + 0xb], dl
mov edx, dword [ecx + 0x34]
shr edx, 2
and dl, 7
inc dl
mov byte [eax + 0xc], dl
mov edx, dword [ecx + 0x34]
shr edx, 5
and dl, 3
mov byte [eax + 0xd], dl
mov edx, dword [ecx + 0x34]
shr edx, 7
and dl, 7
inc dl
mov byte [eax + 0xe], dl
mov edx, dword [ecx + 0x34]
shr edx, 0x16
and dl, 1
mov byte [eax + 0xf], dl
mov edx, dword [ecx + 0x34]
shr edx, 0xa
and dl, 7
inc dl
mov byte [eax + 0x10], dl
mov edx, dword [ecx + 0x34]
shr edx, 0xd
and dl, 3
mov byte [eax + 0x11], dl
mov edx, dword [ecx + 0x34]
shr edx, 0xf
and dl, 1
mov byte [eax + 0x12], dl
mov edx, dword [ecx + 0x24]
shr edx, 0x1e
and dl, 3
mov byte [eax + 0x13], dl
mov dl, byte [ecx + 8]
and dl, 0xf
inc dl
mov byte [eax + 0x14], dl
mov dl, byte [ecx + 0x27]
and dl, 7
inc dl
mov byte [eax + 0x15], dl
mov edx, dword [ecx + 0x24]
shr edx, 0x1b
and dl, 7
inc dl
mov byte [eax + 0x16], dl
mov dl, byte [ecx + 0x36]
and dl, 7
inc dl
mov byte [eax + 0x17], dl
mov dl, byte [ecx + 0x28]
and dl, 7
inc dl
mov byte [eax + 0x18], dl
mov edx, dword [ecx + 0x34]
shr edx, 0x13
and dl, 7
inc dl
mov byte [eax + 0x19], dl
mov edx, dword [ecx]
shr edx, 0x1a
and dl, 0x3f
sub dl, 0x6c
mov byte [eax + 0x1a], dl
mov edx, dword [ecx + 0x24]
shr edx, 3
and dl, 0x7f
mov byte [eax + 0x1b], dl
mov ecx, dword [ecx + 4]
shr ecx, 0xb
pop edi
and cl, 7
inc cl
pop esi
mov byte [eax + 0x1c], cl
pop ebx
ret

Function at 0x83c2a0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x80]
test eax, eax
jne 0x83c2f0
mov eax, dword [esi + 0x7c]
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x83c0b0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x80], eax
jne 0x83c2f0
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jle 0x83c2f2
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x856b42
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 4], 0
push edi
xor eax, eax
lea edi, [ebp - 3]
stosb byte es:[edi], al
push 2
lea eax, [ebp - 4]
push eax
push 0x22
call fcn.00449db1
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
mov al, byte [ebp - 4]
cmp al, 0x30
pop edi
jne 0x856b74
push 2
pop eax
leave
ret
cmp al, 0x31
jne 0x856b7d
xor eax, eax
inc eax
leave
ret
sub al, 0x32
neg al
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
leave
ret
Function at 0x86d9e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x8eb7cc]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x86da5b
push ebx
call fcn.0086d9a9
test eax, eax
pop ecx
jne 0x86da2d
call fcn.00442eaa
mov dword [eax], 0xf
call fcn.00442ea1
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.00442f57
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
jmp 0x86da6d
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x86da1d
inc eax
cmp eax, 0x104
ja 0x86da1d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x86daa5
cmp eax, dword [ebp + 0x10]
jg 0x86da88
mov eax, dword [ebp + 0x10]
push eax
call fcn.0043ca12
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x86daba
call fcn.00442ea1
mov dword [eax], 0xc
jmp 0x86da1d
cmp eax, dword [ebp + 0x10]
jle 0x86daba
call fcn.00442ea1
mov dword [eax], 0x22
jmp 0x86da1d
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.0043e9a0
pop ecx
pop ecx
jmp 0x86da1f
Function at 0x86ffe0
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x875568
call fcn.004416d0
mov edi, 0x94
mov eax, edi
call fcn.0043cba0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call sub.kernel32.dll_GetVersionExA
nop
mov ecx, dword [esi + 0x10]
mov dword [0xcc4ec8], ecx
mov eax, dword [esi + 4]
mov dword [0xcc4ed4], eax
mov edx, dword [esi + 8]
mov dword [0xcc4ed8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0xcc4ecc], esi
cmp ecx, 2
je 0x43becc
or esi, 0x8000
mov dword [0xcc4ecc], esi
shl eax, 8
add eax, edx
mov dword [0xcc4ed0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x43bf07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43bf07
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x43bf1f
cmp eax, 0x20b
je 0x43bf0c
mov dword [ebp - 0x1c], esi
jmp 0x43bf33
cmp dword [ecx + 0x84], 0xe
jbe 0x43bf07
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x43bf2d
cmp dword [ecx + 0x74], 0xe
jbe 0x43bf07
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0044167d
pop ecx
test eax, eax
jne 0x43bf47
push 0x1c
call fcn.0043be48
pop ecx
call fcn.0043e8df
test eax, eax
jne 0x43bf58
push 0x10
call fcn.0043be48
pop ecx
call fcn.004415db
mov dword [ebp - 4], esi
call fcn.004413dd
test eax, eax
jge 0x43bf71
push 0x1b
call fcn.0043be23
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0xeff120], eax
call fcn.004412bb
mov dword [0xcc4d5c], eax
call fcn.00441219
test eax, eax
jge 0x43bf97
push 8
call fcn.0043be23
pop ecx
call fcn.00440fe6
test eax, eax
jge 0x43bfa8
push 9
call fcn.0043be23
pop ecx
call fcn.00440af1
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x43bfbb
push eax
call fcn.0043be23
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call fcn.00440f7d
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x43bfdc
movzx eax, word [ebp - 0x34]
jmp 0x43bfdf
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.004026f0
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x43bffd
push edi
call fcn.00440c29
call fcn.00440c4b
jmp 0x43c02f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0044170b
ret
push 0x8e4fe8
call dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x43be6c
Function at 0x407160
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434170
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
mov eax, dword [0x48f868]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x442df8
mov dword [ebp - 0x24], 0x444010
mov dword [ebp - 4], 0
mov byte [ebp - 0x15], 0
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 0x15], al
movsx eax, byte [ebp - 0x15]
test eax, eax
je 0x4071c5
mov byte [ebp - 0x16], 1
jmp 0x4071c9
mov byte [ebp - 0x16], 0
mov al, byte [ebp - 0x16]
jmp 0x4071f1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e932
mov esp, ebp
pop ebp
ret

Function at 0x409730
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x48f868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x44a0f0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
rdtsc
mov dword [ebp - 0xc], eax
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0x44b8d8
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
cmp eax, 0x64
jbe 0x40977d
mov dword [ebp - 0x10], 1
jmp 0x409784
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e932
mov esp, ebp
pop ebp
ret