joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c15c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x57c1e6
xor edx, edx
push ebp
push 0x57c1c7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57c1e6
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x57d7a0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052f0
mov eax, dword [ebp - 8]
call fcn.004052f0
mov eax, dword [ebp - 0xc]
call fcn.004052f0
xor eax, eax
push ebp
push 0x57d8cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00405300
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0xc]
call fcn.00405300
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
call fcn.0043b128
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x57d8b4
xor eax, eax
push ebp
push 0x57d8ad
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
push 0
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x57d88d
push 0
push 0
push 0x25
push 0
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x57d891
xor eax, eax
jmp 0x57d893
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d8b4
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d8d6
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e54
ret
Function at 0x57d8e0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052f0
mov eax, dword [ebp - 8]
call fcn.004052f0
mov eax, dword [ebp - 0xc]
call fcn.004052f0
mov eax, dword [ebp + 0xc]
call fcn.004052f0
xor eax, eax
push ebp
push 0x57da4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x2c], 0x14
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], 2
mov eax, dword [ebp - 8]
call fcn.00405300
mov esi, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], 3
mov eax, 0x57da64
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x57da2c
xor eax, eax
push ebp
push 0x57da25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405300
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405300
push eax
mov ax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x57da0e
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x57da05
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x57da09
xor eax, eax
jmp 0x57da0b
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57da2c
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57da56
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e54
lea eax, [ebp + 0xc]
call fcn.00404e30
ret
Function at 0x57da6c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x57db34
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x57db38
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x57db34
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x57db2b
xor eax, eax
push ebp
push 0x57db24
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57db2b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57dda4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57dfbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402bf8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57de21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
je 0x57de0b
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00405038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57de28
mov eax, dword [ebp - 8]
call fcn.00402c28
ret

Function at 0x57f38c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004035f8
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x57f3c6
cmp byte [ebp - 0xa], 0x31
jne 0x57f3c4
mov bl, 1
jmp 0x57f3c6
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x580af0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00462958
test al, al
je 0x580bae
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
jmp 0x580b8c
cmp word [esi + 0x5f2], 0
je 0x580b41
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x580b63
cmp dword [ebp - 4], 0
jbe 0x580b5f
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x580b63
xor ebx, ebx
jmp 0x580b65
mov bl, 1
test bl, bl
jne 0x580bae
mov eax, dword [0x70f63c]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x580bae
mov eax, dword [0x70f63c]
mov eax, dword [eax]
call fcn.0047bfd4
push 1
call sub.KERNEL32.DLL_Sleep_1
test esi, esi
je 0x580bae
cmp byte [esi + 0x588], 0
jne 0x580bae
mov edx, 0xfffffdf3
mov eax, esi
call fcn.00573660
cmp eax, 4
jne 0x580b1e
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59a0b8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor esi, esi
mov ecx, edx
test ecx, ecx
jle 0x59a0dd
mov ebx, 1
xor eax, eax
mov al, byte [edi + ebx]
movsx eax, ax
cdq
xor eax, edx
sub eax, edx
add esi, eax
inc ebx
dec ecx
jne 0x59a0ca
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x59bc88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
or eax, 0xffffffff
cmp ecx, ebx
jbe 0x59bcb5
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov edi, dword [0x754c38]
mov esi, dword [edi + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
inc ebx
cmp ecx, ebx
ja 0x59bc94
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x608b54
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x608ca5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x12]
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.006085bc
lea ecx, [ebp - 0xc]
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.0060791c
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.00607964
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0x12]
mov byte [ebx + 0xc], al
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.00404e84
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00405588
mov al, byte [esi + 0x20]
mov byte [ebx + 0x30], al
mov eax, ebx
call fcn.00672520
mov edx, dword [ebp - 0xc]
call fcn.0042bd00
mov eax, ebx
call fcn.00672520
mov dl, byte [ebp - 0x11]
call fcn.0042be08
mov eax, ebx
call fcn.00672520
mov dl, byte [esi + 0x18]
call fcn.0042bda4
mov eax, ebx
call fcn.00672520
mov edx, dword [esi + 0x1c]
call fcn.0042bad8
mov eax, ebx
call fcn.00672520
mov edx, dword [esi + 0x24]
call fcn.0042bd78
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x3c]
call fcn.00677cf0
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x40]
call fcn.00677cf0
add eax, dword [ebx + 0x24]
mov dword [ebx + 0x2c], eax
cmp dword [esi + 0x44], 0xfffffc18
je 0x608c53
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x44]
call fcn.00677cf0
sub eax, dword [ebx + 0x24]
mov dword [ebx + 0x28], eax
jmp 0x608c58
xor eax, eax
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x3c], eax
cmp byte [esi + 0x2a], 0
je 0x608c71
mov al, byte [0x608cb4]
not eax
and al, byte [ebx + 0x38]
mov byte [ebx + 0x38], al
cmp byte [esi + 0x29], 0
je 0x608c82
mov al, byte [0x608cb8]
or al, byte [ebx + 0x38]
mov byte [ebx + 0x38], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608cac
lea eax, [ebp - 0x10]
call fcn.0040554c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e54
ret
Function at 0x612590
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov esi, eax
mov bl, byte [0x612658]
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x18], 0x80
je 0x6125b5
or bl, 1
test byte [esp + 0x19], 0x80
je 0x6125bf
or bl, 4
test byte [esp + 0x1a], 0x80
je 0x6125c9
or bl, 2
test byte [esp + 9], 0x80
je 0x6125d3
or bl, 8
test byte [esp + 0xa], 0x80
je 0x6125dd
or bl, 0x10
test byte [esp + 0xc], 0x80
je 0x6125e7
or bl, 0x20
push esp
call sub.user32.dll_GetCursorPos
lea ecx, [esp + 0x108]
mov edx, esp
mov eax, esi
call fcn.0045b81c
mov eax, dword [esp + 0x108]
mov dword [esp], eax
mov eax, dword [esp + 0x10c]
mov dword [esp + 4], eax
mov edi, dword [esp]
test edi, edi
jl 0x61264e
mov eax, esi
call fcn.0045b6dc
cmp edi, eax
jge 0x61264e
cmp dword [esp + 4], 0
jl 0x61264e
mov eax, esi
call fcn.0045b720
cmp eax, dword [esp + 4]
jle 0x61264e
mov eax, dword [esp + 4]
push eax
mov ecx, dword [esp + 4]
mov edx, ebx
mov eax, esi
mov si, 0xffd4
call fcn.004041ac
add esp, 0x110
pop edi
pop esi
pop ebx
ret
Function at 0x6326fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff48
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x632906
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00631c30
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x63274e
mov eax, dword [ebp - 8]
add eax, 0x58
call fcn.00404e30
jmp 0x6328e5
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xc]
sub al, 1
jb 0x632775
sub al, 2
jb 0x6328ba
sub al, 5
je 0x6328ba
dec al
je 0x6328ad
jmp 0x6328c7
xor eax, eax
push ebp
push 0x632890
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
xor eax, eax
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0xb
xor eax, eax
mov dword [ebp - 0xac], eax
mov byte [ebp - 0xa8], 0xb
xor eax, eax
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0xa0], 0xb
xor eax, eax
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 0xb
xor eax, eax
mov dword [ebp - 0x94], eax
mov byte [ebp - 0x90], 0xb
xor eax, eax
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0xb
xor eax, eax
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
xor eax, eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0xb
xor eax, eax
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0xb
xor eax, eax
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
xor eax, eax
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
xor eax, eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
xor eax, eax
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
xor eax, eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
xor eax, eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
xor eax, eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
xor eax, eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, 0x13
call fcn.0040b918
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, 0x58
call fcn.00404e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6328e5
mov eax, dword [ebp - 8]
add eax, 0x58
call fcn.00404e30
jmp 0x6328e5
mov eax, dword [ebp - 8]
add eax, 0x58
call fcn.00404e30
jmp 0x6328e5
push ebp
lea eax, [ebp - 0xb8]
call fcn.0063247c
pop ecx
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 8]
add eax, 0x58
call fcn.00404e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63290d
lea eax, [ebp - 0xb8]
call fcn.00404e30
lea eax, [ebp - 0x14]
call fcn.00404e30
ret
Function at 0x654b54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x654c4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0xc]
sub al, 1
jb 0x654b87
add al, 0xfe
sub al, 6
jb 0x654ba5
je 0x654b96
jmp 0x654c31
mov edx, esi
mov eax, dword [ebx + 0x1c]
call fcn.00639ca0
jmp 0x654c38
mov edx, esi
mov eax, dword [ebx + 0x20]
call fcn.00639c50
jmp 0x654c38
lea eax, [ebp - 4]
push eax
mov eax, 0x654c64
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x654c70
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, 0x654c7c
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, 0x654c88
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x654c94
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, 0x654ca0
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, 0x654cac
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, 0x654cb8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov eax, 0x654cc4
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x4c]
mov ecx, 8
mov eax, dword [ebx + 0x1c]
call fcn.0040b918
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00639ca0
jmp 0x654c38
mov eax, esi
call fcn.00404e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x654c55
lea eax, [ebp - 4]
call fcn.00404e30
ret
Function at 0x66d698
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x66d86a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
test byte [eax - 0xc], 1
setne al
mov edx, dword [ebp + 8]
test byte [edx - 0xc], 2
setne bl
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 1]
cmp cl, 0x2f
ja 0x66d6e2
and ecx, 0x7f
bt dword [edx - 0xe], ecx
setb dl
mov byte [ebp - 3], dl
mov edx, dword [ebp + 8]
test byte [edx - 0xd], 0x80
setne dl
mov byte [ebp - 4], dl
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 2]
cmp cl, 0x2f
ja 0x66d707
and ecx, 0x7f
bt dword [edx - 0xe], ecx
setb dl
mov byte [ebp - 5], dl
or al, bl
jne 0x66d729
cmp byte [ebp - 3], 0
jne 0x66d729
cmp byte [ebp - 4], 0
jne 0x66d729
mov eax, esi
call fcn.00404e30
jmp 0x66d854
mov al, byte [ebp - 1]
sub al, 0x13
je 0x66d73e
dec al
je 0x66d74d
dec al
je 0x66d75c
dec al
je 0x66d76b
jmp 0x66d77a
lea eax, [ebp - 0xc]
mov edx, 0x66d880
call fcn.00404ec8
jmp 0x66d782
lea eax, [ebp - 0xc]
mov edx, 0x66d890
call fcn.00404ec8
jmp 0x66d782
lea eax, [ebp - 0xc]
mov edx, 0x66d89c
call fcn.00404ec8
jmp 0x66d782
lea eax, [ebp - 0xc]
mov edx, 0x66d8ac
call fcn.00404ec8
jmp 0x66d782
lea eax, [ebp - 0xc]
call fcn.00404e30
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x38]
test eax, eax
jne 0x66d7a6
mov al, byte [ebp - 4]
push eax
push esi
mov cl, byte [ebp - 3]
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0066d3bc
jmp 0x66d854
mov dl, byte [ebp - 1]
sub dl, 0x13
je 0x66d7bc
dec dl
je 0x66d7d7
dec dl
je 0x66d7f2
dec dl
je 0x66d80d
jmp 0x66d828
mov edx, dword [ebp + 8]
mov edx, dword [eax + 0x14]
mov dl, byte [edx + 5]
mov byte [ebp - 0xd], dl
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0xc]
mov byte [ebp - 0xe], 0
jmp 0x66d832
mov edx, dword [ebp + 8]
mov edx, dword [eax + 0x14]
mov dl, byte [edx + 4]
mov byte [ebp - 0xd], dl
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 8]
mov byte [ebp - 0xe], 0
jmp 0x66d832
mov edx, dword [ebp + 8]
mov edx, dword [eax + 0x14]
mov dl, byte [edx + 6]
mov byte [ebp - 0xd], dl
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0x10]
mov byte [ebp - 0xe], 1
jmp 0x66d832
mov edx, dword [ebp + 8]
mov edx, dword [eax + 0x14]
mov dl, byte [edx + 7]
mov byte [ebp - 0xd], dl
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0x14]
mov byte [ebp - 0xe], 1
jmp 0x66d832
mov byte [ebp - 0xd], 0
xor edi, edi
mov byte [ebp - 0xe], 0
mov eax, dword [ebp + 8]
push eax
push edi
push ebx
mov al, byte [ebp - 3]
push eax
mov al, byte [ebp - 4]
push eax
mov al, byte [ebp - 5]
push eax
push esi
mov cl, byte [ebp - 0xe]
mov dl, byte [ebp - 0xd]
mov eax, dword [ebp - 0xc]
call fcn.0066d4a0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66d871
lea eax, [ebp - 0xc]
call fcn.00404e30
ret
Function at 0x671fd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffffec
push 0x67203c
push 0x67205c
mov word [esp + 8], 0x6f
mov word [esp + 0xa], 0x4f
mov word [esp + 0xc], 0
mov word [esp + 0xe], 0x25ef
mov word [esp + 0x10], 0x25e6
mov word [esp + 0x12], 0x25cb
mov word [esp + 0x14], 0x2b2d
mov word [esp + 0x16], 0x2b2f
mov word [esp + 0x18], 0x2b55
mov word [esp + 0x1a], 0x2b58
lea edx, [esp + 8]
mov ecx, 9
call fcn.00671cb0
add esp, 0x14
ret
Function at 0x687bc8
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x687c79
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov esi, eax
and esi, 0xffff
push 0
push 0
push 1
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040548c
push ebx
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
push 1
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
mov edx, dword [ebp - 4]
mov eax, 0x687c90
call fcn.00405444
mov ebx, eax
test ebx, ebx
jle 0x687c35
mov edx, ebx
dec edx
lea eax, [ebp - 4]
call fcn.0040548c
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.00405100
mov esi, eax
test esi, esi
jle 0x687c63
mov ebx, 1
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
call fcn.00687b84
mov edx, edi
shl edx, 4
add eax, edx
mov edi, eax
inc ebx
dec esi
jne 0x687c4a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687c80
lea eax, [ebp - 4]
call fcn.00404e30
ret

Function at 0x6923fc
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
mov dword [ebx], 1
mov edx, esp
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x44]
push esi
lea esi, [esp + 4]
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [esi + 0x338]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x33c]
sub dword [ebx + 0x14], eax
mov eax, esi
call fcn.0068ee7c
mov edx, eax
mov eax, dword [esi + 0x420]
mov eax, dword [eax + 0x84]
call fcn.00670d84
mov edi, eax
mov edx, dword [edi + 0x20]
mov eax, dword [esi + 0x420]
call fcn.00677a94
add dword [ebx + 0xc], eax
mov edx, dword [edi + 0x24]
mov eax, dword [esi + 0x420]
call fcn.00677a94
sub dword [ebx + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esi + 0x438]
call fcn.005d4a40
mov eax, dword [esp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 4]
jle 0x69249a
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 8]
jle 0x6924a5
mov dword [ebx + 8], eax
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
cmp eax, 0x412
jne 0x6924d7
mov dword [ebx], 2
mov eax, dword [ebx + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
push 1
push 0
lea eax, [ebx + 0xc]
push eax
call sub.user32.dll_OffsetRect
add esp, 0x18
pop edi
pop esi
pop ebx
ret