joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43d3ee
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00402020
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x53ae20]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00401f10
mov eax, dword [esp + 4]
test eax, eax
je 0x43d3d3
mov eax, dword [esp + 0x1c]
lea ecx, [0x53ae20]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00408970
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00401f10
mov eax, dword [esp + 4]
test eax, eax
je 0x43d3c1
mov eax, dword [esp + 0x1c]
lea ecx, [0x53ae20]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0043d840
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
jne 0x43d3a8
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00408b80
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43d340
mov ecx, dword [eax + 0x14]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x10]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
jne 0x43d37c
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x43d3d7
movzx ecx, byte [esp + 0x38]
test cl, cl
jne 0x43d354
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.0043ce60
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x43d340
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
je 0x43d344
add esp, 0x30
ret
lea eax, [0x4b6a18]
mov dword [esp], eax
call fcn.004547c0
jmp 0x43d340
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.0043d400
movzx eax, byte [esp + 4]
test al, al
je 0x43d376
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x43d30c
mov eax, dword [esp + 0x24]
jmp 0x43d30c
mov eax, dword [esp + 0x14]
sub eax, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x18]
sbb eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.00452410
mov eax, dword [esp + 0x24]
jmp 0x43d2f8
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00402020
jmp 0x43d2c4
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00408b80
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x4b1616]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.0042ea20
nop
call fcn.00454940
jmp fcn.0043d1e0
Function at 0x4486c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x448861
sub esp, 0x48
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x78]
add ebx, 1
mov edx, dword [edx + 0x54]
mov ebp, dword [ecx + 0x7c]
mov dword [ecx + 0x78], ebx
adc ebp, 0
mov dword [ecx + 0x7c], ebp
mov ebx, edx
mov ebp, dword [edx + 0xb70]
cmp ecx, ebp
jne 0x448795
mov dword [esp + 0x44], ecx
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0045605a
mov ecx, dword [esp + 0x44]
mov ebx, dword [ecx + 0x50]
mov ebp, dword [ecx + 0x54]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov ebx, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
mov eax, dword [edx + 0xb74]
cmp eax, 3
jae 0x448856
lea ecx, [0x54d634]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
mov byte [esp], 0x29
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.00447730
add esp, 0x48
ret
cmp dword [ecx + 0x80], ebx
jne 0x4487e6
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp], 0x26
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.00447730
jmp 0x448791
mov dword [ecx + 0x80], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x54]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov byte [esp], 0xe
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00447730
jmp 0x448791
mov ecx, 3
call fcn.00455f10
nop
call fcn.00454940
jmp fcn.004486c0
Function at 0x448a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x448b75
sub esp, 0x2c
mov ecx, dword [esp + 0x30]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x34]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x448b6e
mov edx, dword [0x5455dc]
cmp ebx, edx
setl dl
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp dword [0x5455d8], ecx
xchg esi, ebx
seta bl
xchg esi, ebx
and ebp, esi
or edx, ebp
test dl, dl
je 0x448b6e
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 0x4c]
mov ebx, dword [edx + 0x78]
add ebx, 1
mov ebp, dword [edx + 0x7c]
mov dword [edx + 0x78], ebx
adc ebp, 0
mov dword [edx + 0x7c], ebp
mov ebx, dword [edx + 0x18]
mov ebx, dword [ebx + 0x54]
mov dword [edx + 0x80], ebx
lea edi, [esp + 0x14]
mov ebx, eax
xor eax, eax
call fcn.0045605a
mov ecx, dword [edx + 0x50]
mov ebp, dword [edx + 0x54]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
mov ecx, dword [edx + 0x78]
mov edx, dword [edx + 0x7c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x30]
shr ecx, 6
mov edx, ebx
shl ebx, 0x1a
or ecx, ebx
mov dword [esp + 0x24], ecx
shr edx, 6
mov dword [esp + 0x28], edx
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.00447730
add esp, 0x2c
ret
mov eax, ebx
jmp 0x448aca
call fcn.00454940
jmp fcn.00448a60
Function at 0x44b340
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44b3df
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00456057
lea ecx, [0x451c30]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00454820
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00454940
jmp fcn.0044b340
Function at 0x455d40
Capabilities:
Encrypt data using aes via x86 extensions
Hash data using murmur3

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x54d8a0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4543cb
je 0x45441a
cmp ebx, 0x20
jbe 0x454420
cmp ebx, 0x40
jbe 0x45445e
jmp 0x4544ef
test ebx, ebx
je 0x454410
add eax, 0x10
test ax, 0xff0
je 0x4543fc
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4cc9e0]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4ccae0]
jmp 0x4543e8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4543e8
pxor xmm1, xmmword [0x54d8b0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x54d8b0]
pxor xmm2, xmmword [0x54d8c0]
pxor xmm3, xmmword [0x54d8d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x54d8b0]
pxor xmm2, xmmword [0x54d8c0]
pxor xmm3, xmmword [0x54d8d0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45454e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x54d671], 0
je 0x455d5a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x454390
jmp fcn.00407600
Function at 0x455d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40242e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407600
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00454940
jmp 0x4023f0
cmp byte [0x54d671], 0
je 0x455d7b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x454390
jmp 0x4023f0

Function at 0x455d80
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40783c
mov eax, dword [0x54d820]
mov ecx, dword [esp + 4]
mov ecx, dword [ecx]
mov edx, dword [esp + 8]
lea eax, [edx + eax*4]
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.00454940
jmp 0x4077e0
cmp byte [0x54d671], 0
je 0x455dbb
mov eax, dword [esp + 4]
movd xmm0, dword [esp + 8]
pinsrd xmm0, dword [eax], 1
aesenc xmm0, xmmword [0x54d8a0]
aesenc xmm0, xmmword [0x54d8b0]
aesenc xmm0, xmmword [0x54d8c0]
movd dword [esp + 0xc], xmm0
ret
jmp 0x4077e0

Function at 0x455dc0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4078c0
mov eax, dword [0x54d820]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 8]
lea eax, [ebx + eax*8]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.00454940
jmp 0x407850
cmp byte [0x54d671], 0
je 0x455dfb
mov eax, dword [esp + 4]
movq xmm0, qword [eax]
pinsrd xmm0, dword [esp + 8], 2
aesenc xmm0, xmmword [0x54d8a0]
aesenc xmm0, xmmword [0x54d8b0]
aesenc xmm0, xmmword [0x54d8c0]
movd dword [esp + 0xc], xmm0
ret
jmp 0x407850

Function at 0x456ab0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00455cc0
call fcn.00432fa0
ret
Function at 0x456b30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov dword [esp], 0xfffffff4
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov esp, ebp
mov dword [esp], eax
mov edx, 0x54d9e0
mov dword [esp + 4], edx
mov edx, dword [0x54d698]
mov dword [esp + 8], edx
lea edx, [esp + 0x14]
mov dword [edx], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
call dword [sym.imp.kernel32.dll_WriteFile]
mov esi, ebp
add esp, 0x18
ret

Function at 0x456bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x21c
mov dword [esp], esp
mov dword [esp + 4], 0x21c
call fcn.00456580
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00456580
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46e080
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46e0b8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x46e0af
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ebx, ecx
jl 0x46e0a2
mov dword [esp + 0x14], edx
ret
call fcn.00454940
jmp fcn.0046e080
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40611c
pop dword [ebp - 0x30]
mov eax, 0x83ade9ae
add eax, 0x7c92776e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xdd2e1e2b
sub dword [ebp - 0x40], 0x8edbd8e0
mov dword [ebp - 0x3c], 0x880c9198
add dword [ebp - 0x3c], 0xaa26baad
mov dword [ebp - 0x38], 0x91c0bcc4
add dword [ebp - 0x38], 0xba8b876a
mov dword [ebp - 0x34], 0xe3cd3ae9
sub dword [ebp - 0x34], 0xe3cd3ae9
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x13c3cefb
sub dword [ebp - 0x40], 0x9f5165a5
mov dword [ebp - 0x3c], 0x4d553a0c
add dword [ebp - 0x3c], 0xf4172769
mov dword [ebp - 0x38], 0xf4200f99
sub dword [ebp - 0x38], 0x90b0a32d
mov dword [ebp - 0x34], 0x3a45934c
sub dword [ebp - 0x34], 0x3a45934c
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xda0e15b4
sub eax, 0xd9cda4b4
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3864f
push 0
call eax
mov ecx, 0x97b9d378
add ecx, 0x68467bad
mov edx, eax
mov ebx, 0x870e97e7
sub ebx, 0x86cd97e7
add ebx, dword [ebp - 0x30]
mov edi, 0x885cebe6
add edi, 0xe84300ad
mov dword [ebp - 4], 0xf1c62d0b
mov esi, dword [ebx]
sub dword [ebp - 4], esi
xor esi, edi
xor dword [ebp - 4], edx
mov dword [edx], esi
add dword [ebp - 0x10], 0xe54b7040
add edx, 4
add ebx, 0xe65ec6a0
add ebx, 0x19a13964
loop 0x406239
add eax, 0x12f67
xor ebx, ebx
add ebx, eax
add eax, 0x8a181c7a
sub eax, 0x8a181c75
mov ecx, 0xf40bda20
add ecx, 0xc3425e0
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x100067ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x4a4
lea ebp, [esp - 4]
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x4a4], eax
push 0xc
mov eax, 0x1004ff77
call fcn.10037f26
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000682d
cmp dword [ebp + 0x10], 2
jb 0x10006944
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp dword [0x1006a458], ebx
je 0x100068cc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
push 0x10056838
push 4
push ebx
push 0x10056858
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jne 0x100068b5
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x100068b5
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jne 0x100068b5
cmp dword [ebp - 0x18], ebx
je 0x100068b5
push dword [ebp - 0x18]
call fcn.1003892a
pop ecx
cmp eax, 0xf3
jae 0x100068ac
push dword [ebp - 0x18]
lea eax, [ebp + 0x29c]
push eax
call fcn.1003af2a
pop ecx
pop ecx
mov byte [ebp - 0xd], 1
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1001e586
cmp byte [ebp - 0xd], bl
jne 0x1000691a
mov eax, dword [0x10069bc4]
cmp eax, ebx
je 0x100069b2
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x29c]
push ecx
push ebx
push ebx
push str.ExePath
push eax
mov dword [ebp - 0x14], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100069b2
lea eax, [ebp + 0x29c]
push 0x5c
push eax
call fcn.10039550
pop ecx
pop ecx
cmp eax, ebx
je 0x1000691a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x29c]
push eax
lea eax, [ebp + 0x94]
push str._sidmbrbtn.dll
push eax
call fcn.100047e3
add esp, 0xc
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100069ad
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x198]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x10055cd4
push dword [0x10069bc4]
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100069b2
lea eax, [ebp + 0x198]
push 0x5c
push eax
call fcn.100394e0
pop ecx
pop ecx
cmp eax, ebx
je 0x100069b2
mov byte [eax], bl
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp + 0x3a0]
push 0x10055dd4
push eax
call fcn.1003b325
add esp, 0xc
lea eax, [ebp + 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100698e8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4a4]
xor ecx, ebp
call fcn.10037f17
add ebp, 0x4a8
leave
ret
Function at 0x10007cd6
Capabilities:
Get geographical location

Disassembly:
push 0x14
mov eax, 0x100501e6
call fcn.10037f59
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
mov esi, 0x400
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003b6c0
mov dword [ebp - 0x18], eax
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp + 8]
sub ecx, eax
mov eax, dword [ebp + 0xc]
sbb eax, edx
push ebx
push esi
push eax
push ecx
call fcn.1003b610
mov edi, eax
and edi, 0x800003ff
jns 0x10007d28
dec edi
or edi, 0xfffffc00
inc edi
mov eax, edi
shl eax, 0xa
cdq
mov ecx, dword [ebp + 8]
sub ecx, eax
mov eax, dword [ebp + 0xc]
sbb eax, edx
sub ecx, dword [ebp - 0x20]
sbb eax, dword [ebp - 0x1c]
push ebx
push 0x100000
push eax
push ecx
call fcn.1003b610
mov ebx, eax
and ebx, 0x800003ff
jns 0x10007d5d
dec ebx
or ebx, 0xfffffc00
inc ebx
push 0
push 0x40000000
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003b610
mov dword [ebp - 0x1c], eax
push 3
lea eax, [ebp - 0x14]
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10007d95
push 0x10055e4c
lea eax, [ebp - 0x14]
push eax
call fcn.10038090
pop ecx
pop ecx
cmp dword [ebp - 0x1c], 0
jne 0x10007e36
mov eax, 0x3e7
cmp ebx, eax
jg 0x10007e36
test ebx, ebx
jne 0x10007e05
cmp edi, eax
jg 0x10007e05
mov ecx, 0x1006a488
test edi, edi
je 0x10007dea
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x3e8
cdq
and edx, 0x3ff
add eax, edx
mov esi, eax
sar esi, 0xa
call fcn.10007658
push eax
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp - 0x14]
push eax
push edi
jmp 0x10007e67
call fcn.10007684
push eax
push dword [ebp - 0x18]
push str._d___s
push dword [ebp + 0x10]
call fcn.1003b325
add esp, 0x10
jmp 0x10007e77
mov eax, edi
imul eax, eax, 0x3e8
cdq
and edx, 0x3ff
add eax, edx
mov esi, eax
sar esi, 0xa
mov ecx, 0x1006a488
call fcn.1000762c
push eax
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
jmp 0x10007e67
mov eax, ebx
imul eax, eax, 0x3e8
cdq
and edx, 0x3ff
add eax, edx
mov esi, eax
sar esi, 0xa
mov ecx, 0x1006a488
call fcn.10007600
push eax
mov eax, esi
cdq
push 0xa
pop ecx
idiv ecx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
push str._d_s_02d___s
push dword [ebp + 0x10]
call fcn.1003b325
add esp, 0x18
or dword [ebp - 4], 0xffffffff
call fcn.10037ffe
ret
Function at 0x100113da
Capabilities:
Create thread

Disassembly:
push 0x110
mov eax, 0x10051180
call fcn.10037fc5
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.10011350
test eax, eax
je 0x10011454
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x15], bl
push 0x5c
lea eax, [ebp - 0x118]
push eax
call fcn.100394e0
pop ecx
pop ecx
cmp eax, ebx
je 0x1001143a
push str.explorer.exe
inc eax
push eax
call fcn.100383b0
pop ecx
pop ecx
test eax, eax
je 0x10011454
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push 0x1000fb7a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
call fcn.10038021
ret
Function at 0x1001811a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xc
mov eax, 0x10051c77
call fcn.10037f59
and dword [ebp - 4], 0
mov eax, dword [0x10067420]
cmp eax, 0xffffffff
je 0x100181e1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x10018196
push 0x20
call fcn.10038e3f
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10018166
call fcn.10017023
mov esi, eax
jmp 0x10018168
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x100181e1
push esi
push dword [0x10067420]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10018192
push 1
mov ecx, esi
call fcn.10016d6f
xor esi, esi
mov dword [ebp - 0x14], esi
test esi, esi
je 0x100181e1
mov dword [esi], 1
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x100181cb
push dword [ebp + 0x10]
lea ecx, [esi + 0x18]
call fcn.10001f52
jmp 0x100181e1
add esi, 0x18
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x100181e1
mov ecx, esi
call fcn.1000f899
or dword [ebp - 4], 0xffffffff
call fcn.10037ffe
ret