joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33d6704a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x33d6c00b
call fcn.33d6b669
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call dword [0x33d6e7b4]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x33d67106
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.33d65125
test eax, eax
jl 0x33d67106
mov edi, dword [ebp - 0x42c]
cmp edi, 0x400
jg 0x33d670e8
push edi
call fcn.33d64033
test al, al
je 0x33d670e8
mov eax, edi
call fcn.33d6b549
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x33d670f4
push edi
lea ecx, [ebp - 0x428]
call fcn.33d65125
push dword [ebp - 0x424]
push edi
push esi
push eax
call fcn.33d65125
cmp eax, ebx
jne 0x33d6713d
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x33d6711f
lea ecx, [ebp - 0x418]
call fcn.33d63f65
lea ecx, [ebp - 0x428]
call fcn.33d63e95
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.33d6b6c2
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x424], edi
jne 0x33d6715f
call fcn.33d6356e
mov esi, eax
jmp 0x33d67252
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x33d67182
call fcn.33d6356e
jmp 0x33d67244
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
je 0x33d67178
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x420], esi
jae 0x33d671db
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x33d671c4
lea ecx, [ebp - 0x418]
call fcn.33d63f65
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.33d63e95
mov eax, esi
jmp 0x33d6712f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.33d65125
mov dword [ebp - 4], 1
jmp 0x33d67202
cmp dword [ebp - 0x418], ebx
jne 0x33d67211
mov esi, 0x8007000e
jmp 0x33d67246
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x418]
call fcn.33d65125
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.33d65125
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x33d671c9
lea ecx, [ebp - 0x418]
call fcn.33d63f65
jmp 0x33d671c9
Function at 0x33d6aa74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x33d61c1c]
jne 0x33d6b785
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x33d6e950], eax
mov dword [0x33d6e94c], ecx
mov dword [0x33d6e948], edx
mov dword [0x33d6e944], ebx
mov dword [0x33d6e940], esi
mov dword [0x33d6e93c], edi
mov word [0x33d6e968], ss
mov word [0x33d6e95c], cs
mov word [0x33d6e938], ds
mov word [0x33d6e934], es
mov word [0x33d6e930], fs
mov word [0x33d6e92c], gs
pushfd
pop dword [0x33d6e960]
mov eax, dword [ebp]
mov dword [0x33d6e954], eax
mov eax, dword [ebp + 4]
mov dword [0x33d6e958], eax
lea eax, [ebp + 8]
mov dword [0x33d6e964], eax
mov eax, dword [ebp - 0x320]
mov dword [0x33d6e8a0], 0x10001
mov eax, dword [0x33d6e958]
mov dword [0x33d6e854], eax
mov dword [0x33d6e848], 0xc0000409
mov dword [0x33d6e84c], 1
mov eax, dword [0x33d61c1c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x33d6e794]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x33d6e898], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x33d61fac
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x33d6e898], 0
jne 0x33d6b875
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x4068b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068dc
xor eax, eax
test eax, eax
je 0x4068ef
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068ef
xor ecx, ecx
jmp 0x4068f2
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a15
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5dec], 0
push esi
jne 0x406a4c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a26
mov dword [ecx*4 + 0x7a5de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a21
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a7d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5de8]
xor eax, esi
inc ecx
dec edx
jne 0x406a5f
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4220be
Capabilities:
Encode data using xor

Disassembly:
push 0x203
call fcn.004225cd
jb 0x422387
xchg esi, eax
mov eax, dword [esp + 4]
bswap eax
mov edx, eax
and eax, 0xf0f0f0f
xor edx, eax
rol eax, 8
or eax, edx
mov edx, eax
and eax, 0x33333333
xor edx, eax
rol eax, 4
or eax, edx
mov edx, eax
and eax, 0x55555555
xor edx, eax
rol eax, 2
or eax, edx
ror eax, 7
push eax
mov eax, esi
bswap eax
mov edx, eax
and eax, 0xf0f0f0f
xor edx, eax
rol eax, 8
or eax, edx
mov edx, eax
and eax, 0x33333333
xor edx, eax
rol eax, 4
or eax, edx
mov edx, eax
and eax, 0x55555555
xor edx, eax
rol eax, 2
or eax, edx
ror eax, 7
pop ebx
push esi
add eax, ebx
xchg ecx, eax
lea esi, [ebp + 0x776]
mov ebx, ecx
shr ebx, 0x10
mov edx, 0x3575
dec edx
shr edx, 1
mov ch, cl
dec cx
and cl, 0xf
mov ax, word [esi]
xor ax, bx
add ax, cx
ror ax, cl
xor ax, cx
mov word [esi], ax
inc esi
inc esi
dec edx
jne 0x42214c
mov ecx, 0x3575
dec ecx
shr ecx, 2
lea esi, [ebp + 0x776]
mov edi, esi
lodsw ax, word [esi]
mov bx, ax
lodsw ax, word [esi]
stosw word es:[edi], ax
mov ax, bx
stosw word es:[edi], ax
loop 0x42217b
lea esi, [ebp + 0x776]
pop ecx
mov ebx, ecx
shr ebx, 0x10
mov edx, 0x3575
dec edx
mov ch, cl
dec cx
and cl, 0xf
mov al, byte [esi]
xor al, bl
add al, ch
ror al, cl
xor al, cl
mov byte [esi], al
inc ebx
inc esi
dec edx
jne 0x42219d
lea esi, [ebp + 0x776]
mov ecx, dword [esp + 4]
mov ebx, ecx
shr ebx, 0x10
mov edx, 0x3575
dec edx
shr edx, 1
mov ch, cl
dec cx
and cl, 0xf
mov ax, word [esi]
xor ax, bx
add ax, cx
ror ax, cl
xor ax, cx
mov word [esi], ax
inc esi
inc esi
dec edx
jne 0x4221cc
clc
xor ecx, ecx
pop ebx
pop eax
call fcn.00422776

Function at 0x422436
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
mov edi, dword [eax + 0x3c]
add edi, eax
mov ecx, dword [edi + 0x7c]
jecxz 0x422490
mov ebx, eax
add ebx, dword [edi + 0x78]
mov edx, eax
add edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
mov edi, edx
mov ebp, eax
xor eax, eax
push eax
mov esi, ebp
add esi, dword [edx + eax*4]
push esi
mov edi, esi
push eax
push ecx
mov al, 0
xor ecx, ecx
dec ecx
repne scasb al, byte es:[edi]
pop ecx
pop eax
xchg edi, esi
sub esi, dword [esp]
mov edi, esi
pop esi
call fcn.0042207b
cmp eax, dword [esp + 0x18]
pop eax
je 0x4224a1
inc eax
loop 0x422465
xor eax, eax
pop dword fs:[0]
add esp, 4
pop ebp
clc
ret 8
mov edx, ebp
add edx, dword [ebx + 0x24]
movzx eax, word [edx + eax*2]
cmp eax, dword [ebx + 0x14]
jae 0x422490
mov edx, ebp
add edx, dword [ebx + 0x1c]
add ebp, dword [edx + eax*4]
xchg ebp, eax
jmp 0x422492
Function at 0x4224ba
Capabilities:
Encode data using xor

Disassembly:
push 0x4402890e
xor eax, eax
push eax
call fcn.00422401
jb 0x4225ca
push 4
push 0x1000
push 0x200
push 0
call eax
dec eax
js 0x4225ca
inc eax
push eax
mov edi, eax
xor ecx, ecx
xor eax, eax
mov al, cl
push ecx
mov ecx, 8
clc
rcr ax, 1
jae 0x4224fe
xor ax, 0xa001
loop 0x4224f4
mov word [edi], ax
inc edi
inc edi
pop ecx
inc ecx
cmp ecx, 0x100
jne 0x4224ea
mov esi, ebp
mov edi, dword [esp]
mov ecx, 0x762
dec ecx
xor eax, eax
xor ebx, ebx
xor bh, bh
mov bl, al
lodsb al, byte [esi]
xor bl, al
shl bx, 1
mov bx, word [edi + ebx]
xor bl, ah
mov ax, bx
loop 0x42251e
xor edx, edx
mov ecx, 0x762
dec ecx
mov edi, ecx
shr edi, 1
mov esi, ebp
test ah, 0x80
je 0x42254a
xor ax, 0xa097
test dh, 0x80
je 0x422554
xor dx, 0xa097
mov bx, ax
add bx, ax
mov cx, dx
add cx, dx
lodsw ax, word [esi]
mov dl, ah
add ax, bx
mov ah, bh
add dx, cx
mov dh, ch
dec edi
jne 0x422541
shl eax, 0x10
add eax, edx
mov edx, eax
shr eax, 4
and edx, 0xf0f0f0f
shl edx, 4
and eax, 0xf0f0f0f
or eax, edx
pop ebx
push eax
push ebx
push 0x2aad1211
xor eax, eax
push eax
call fcn.00422401
jb 0x4225ca
pop ebx
push 0x8000
push 0
push ebx
call eax
call fcn.004222b9
jb 0x4225ca
push ecx
mov ecx, dword [ebp + 0x762]
add ecx, ebp
lea ebx, [ebp + 0x401]
sub ebx, dword [ebp + 0x766]
mov dword [ecx + 0x18], ebx
pop ecx
inc ecx
ret
xor ecx, ecx
ret

Function at 0x422662
Capabilities:
Encode data using xor

Disassembly:
pop ecx
push 0x4402890e
xor eax, eax
push eax
call fcn.00422401
jb 0x4225ca
push 4
push 0x1000
push 0x200
push 0
call eax
dec eax
js 0x42275a
inc eax
push eax
mov edi, eax
xor ecx, ecx
xor eax, eax
mov al, cl
push ecx
mov ecx, 8
clc
rcr ax, 1
jae 0x4226a7
xor ax, 0xa001
loop 0x42269d
mov word [edi], ax
inc edi
inc edi
pop ecx
inc ecx
cmp ecx, 0x100
jne 0x422693
mov esi, ebp
mov edi, dword [esp]
mov ecx, 0x762
dec ecx
xor eax, eax
xor ebx, ebx
xor bh, bh
mov bl, al
lodsb al, byte [esi]
xor bl, al
shl bx, 1
mov bx, word [edi + ebx]
xor bl, ah
mov ax, bx
loop 0x4226c7
xor edx, edx
mov ecx, 0x762
dec ecx
mov edi, ecx
shr edi, 1
mov esi, ebp
test ah, 0x80
je 0x4226f3
xor ax, 0xa097
test dh, 0x80
je 0x4226fd
xor dx, 0xa097
mov bx, ax
add bx, ax
mov cx, dx
add cx, dx
lodsw ax, word [esi]
mov dl, ah
add ax, bx
mov ah, bh
add dx, cx
mov dh, ch
dec edi
jne 0x4226ea
shl eax, 0x10
add eax, edx
mov edx, eax
shr eax, 4
and edx, 0xf0f0f0f
shl edx, 4
and eax, 0xf0f0f0f
or eax, edx
pop ebx
push eax
push ebx
push 0x2aad1211
xor eax, eax
push eax
call fcn.00422401
jb 0x42275a
pop ebx
push 0x8000
push 0
push ebx
call eax
call fcn.004220be
jb 0x42275a
inc ecx
ret
xor ecx, ecx
jmp 0x422656

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x14626f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x606000]
push edi
or ebp, 0xffffffff
jmp 0x1462712
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1462719
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1462708
mov eax, 1
add ebx, ebx
jne 0x146272b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x146273c
jne 0x146275b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146275b
dec eax
add ebx, ebx
jne 0x1462748
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1462720
add ebx, ebx
jne 0x1462757
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x14627ad
xor ecx, ecx
sub eax, 3
jb 0x1462773
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x14627e2
sar eax, 1
mov ebp, eax
jmp 0x146277e
add ebx, ebx
jne 0x146277e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146274c
inc ecx
add ebx, ebx
jne 0x146278c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146274c
add ebx, ebx
jne 0x1462799
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x146278e
jne 0x14627aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x146278e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x14627cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x14627be
jmp 0x146270e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x14627cc
add edi, ecx
jmp 0x146270e
pop esi
mov edi, esi
mov ecx, 0x7fc4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x14627ea
cmp byte [edi], 0x36
jne 0x14627ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x14627ef
lea edi, [esi + 0x105f000]
mov eax, dword [edi]
or eax, eax
je 0x1462867
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x106573c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1065888]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x146281c
mov ecx, edi
jns 0x146284b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1065890]
or eax, eax
je 0x1462861
mov dword [ebx], eax
add ebx, 4
jmp 0x1462839
call dword [esi + 0x106588c]
mov ebp, dword [esi + 0x1065894]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x146289b
sub esp, 0xffffff80
jmp 0x51824e
Function at 0x403430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40343f
pop dword [ebp - 0x1c]
mov eax, 0xfb3dd85e
add eax, 0x5025be1
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd8fd2086
sub dword [ebp - 0x2c], 0x8aaadb3b
mov dword [ebp - 0x28], 0x5964ee55
add dword [ebp - 0x28], 0xd8ce5df0
mov dword [ebp - 0x24], 0x3a84e2d8
add dword [ebp - 0x24], 0x11c76156
mov dword [ebp - 0x20], 0x99d0fb11
sub dword [ebp - 0x20], 0x99d0fb11
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x9192d1f3
add eax, 0x6eae5ea5
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xf10c6c1
sub dword [ebp - 0x2c], 0x9a9e5d6b
mov dword [ebp - 0x28], 0xf0d7df27
add dword [ebp - 0x28], 0x5094824e
mov dword [ebp - 0x24], 0x7758f9db
sub dword [ebp - 0x24], 0x13e98d6f
mov dword [ebp - 0x20], 0xea86db98
add dword [ebp - 0x20], 0x15792468
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39aa0
push 0
call eax
mov ecx, 0x885c1f0d
add ecx, 0x77a42b3a
xor ebx, ebx
add ebx, eax
mov esi, 0x260ed750
add esi, 0xda32ccb0
add esi, dword [ebp - 0x1c]
mov edx, 0x5f4b1413
sub edx, 0x166556a3
sub dword [ebp - 0x18], eax
mov edi, dword [esi]
add dword [ebp - 8], eax
sub edi, edx
xor dword [ebp - 0x18], edi
mov dword [ebx], edi
sub dword [ebp - 8], 0xc161963e
add ebx, 0x98caecc9
add ebx, 0x6735133b
add esi, 0xc2fa442
sub esi, 0xc2fa43e
loop 0x40355e
add eax, 0x1895a354
sub eax, 0x18948765
mov ebx, eax
add eax, 0x2b46a831
sub eax, 0x2b46a82c
mov ecx, 0xc5c22cc8
sub ecx, 0xc5822cc8
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret
Function at 0x404a80
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404c38
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404ae1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404c54
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404b4e
xor eax, eax
push ebp
push 0x404b47
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b30
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404c74
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b4e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404c2f
cmp byte [ebp - 0xd], 0
jne 0x404b90
cmp byte [ebp - 0x12], 0
je 0x404c2f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404ba9
dec ebx
cmp byte [ebx], 0x2e
je 0x404bb8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404ba8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404c2f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404be5
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c2f
cmp byte [ebp - 0xd], 0
je 0x404c2f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c2f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407ff8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408031
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403870
jmp 0x40803a
mov eax, ebx
mov edx, esi
call fcn.00403824
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408044
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408065
mov al, byte [esp]
jmp 0x408067
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412f0c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x412f12
ret

Function at 0x415330
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x415381
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x415368
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x415358
jmp 0x415381
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x415369
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c54c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x43d758], 0
sete dl
or al, dl
jne 0x41c690
mov eax, dword [0x43d75c]
mov bx, 0xffff
call fcn.00402de0
mov eax, dword [0x43d758]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x41c65f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x43d758]
call fcn.0040c94c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x41c657
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x41c657
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x41c657
mov eax, dword [ebp - 0x10]
call fcn.00424388
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x41c657
push ebp
call fcn.0041c508
pop ecx
test al, al
jne 0x41c657
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x41c613
mov eax, dword [ebp - 0x10]
call fcn.00422cd0
dec eax
jle 0x41c657
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402de0
cmp byte [ebp - 0x15], 0
je 0x41c657
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x41c657
mov edx, dword [ebp - 0x10]
mov eax, dword [0x43d75c]
call fcn.0041bdb8
inc edi
dec esi
jne 0x41c5a6
mov eax, dword [0x43d75c]
cmp dword [eax + 8], 0
jle 0x41c677
mov eax, dword [0x43d75c]
call fcn.0041be48
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c690
push ebp
mov eax, dword [ebp - 0x14]
call fcn.0041c3c0
pop ecx
test al, al
jne 0x41c690
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret