joyce8/EMBER2024-capa huggingface dataset:
Function at 0x34d270
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x34d370
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0x34d389
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0x34d3e2
cmp eax, edx
jae 0x34d3ce
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0x34d3c0
lea eax, [esi + 0x2c]
push esi
call fcn.0034b7c0
add esp, 4
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0x34d3ff
jmp 0x34d3f0
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0x34d3f0
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x2c]
push esi
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
call fcn.0034b7c0
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
add esp, 4
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x34dba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x34dc44
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0x34dbd1
call eax
dec dword [ebp - 8]
call fcn.003689db
mov esi, eax
call fcn.003689db
cmp esi, eax
jne 0x34dbf0
xor edi, 1
call fcn.003689db
cmp esi, eax
je 0x34dbe4
call fcn.003689db
mov esi, eax
call fcn.003689db
cmp esi, eax
jne 0x34dc0c
xor ebx, 1
call fcn.003689db
cmp esi, eax
je 0x34dc00
cmp edi, ebx
je 0x34dbd4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0x34dbd1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0x34dbc5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x34dd50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00366fe0
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0x34dda0
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0x34dda0
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0x34dd84
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.00366fe0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x357524
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0x35755b
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0x35753b
pop edi
pop esi
pop ebp
ret

Function at 0x35b6c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.0034f366
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0034f205
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.00366b0d
add esp, 0x20
jmp 0x35b722
cmp esi, 0x3fffffff
ja 0x35b706
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0034f205
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.00366b0d
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0x35b6fc
lea eax, [ebp - 0x210]
push eax
call fcn.0034f2ce
pop ecx
pop esi
leave
ret

Function at 0x35b73c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0034f366
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0034f205
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.00366b0d
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.0034f2ce
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x35ba2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.00350314
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0x35babe
push ebx
push dword [ebp + 8]
dec esi
call fcn.003504a3
pop ecx
pop ecx
cmp eax, 3
jne 0x35ba87
test edi, edi
je 0x35bab3
push 0
push ebx
push dword [ebp + 8]
call fcn.0035068c
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0036414d
add esp, 0x10
test eax, eax
jle 0x35bab3
xor edi, edi
inc edi
jmp 0x35bab5
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.0034fe88
add esp, 0xc
test edi, edi
je 0x35bab3
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.0036573e
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x35bab5
xor edi, edi
inc ebx
test esi, esi
jne 0x35ba48
test edi, edi
je 0x35bac3
xor eax, eax
inc eax
jmp 0x35bad2
push 0
push 0
push dword [ebp + 8]
call fcn.0034f02f
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x314a1b2c
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x25137e50
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4031a0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404fc8
test esi, esi
jne 0x4031d6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004050b8
jmp 0x4031f4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403044
mov edi, eax
test esi, esi
je 0x4031f4
cmp dword [ebx], 0
je 0x4031f4
dec esi
jmp 0x4031dd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403228
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x472008], 0x8088405
inc edx
mov dword [ebx + 0x472008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403ee8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x472024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403f80
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f60
xor eax, eax
push ebp
push 0x403f59
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403f9c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x472024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x472024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404d94
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47904c], 0
je 0x404df5
cmp word [0x479220], 0xd7b2
jne 0x404dbd
cmp dword [0x479228], 0
jbe 0x404dbd
mov eax, 0x47921c
call dword [0x479238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404e1c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x472030], 0
jne 0x404e11
push 0
push 0x472780
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404f4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x472038], 0
je 0x404f72
mov edx, esi
mov eax, ebx
call dword [0x472038]
jmp 0x404f81
mov eax, 8
call fcn.00402d48
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x47904d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404f14
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x406624
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406854
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4066a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406854
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4066a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406870
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406730
xor eax, eax
push ebp
push 0x406729
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406460
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40670e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406890
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40670e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406730
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40684a
cmp byte [ebp - 0xd], 0
jne 0x406777
cmp byte [ebp - 0x12], 0
je 0x40684a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406790
dec ebx
cmp byte [ebx], 0x2e
je 0x40679f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40678f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40684a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4067dc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40684a
cmp byte [ebp - 0xd], 0
je 0x40684a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40684a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406730
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406854
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4066a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406854
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4066a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406870
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406730
xor eax, eax
push ebp
push 0x406729
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406460
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40670e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406890
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40670e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406730
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40684a
cmp byte [ebp - 0xd], 0
jne 0x406777
cmp byte [ebp - 0x12], 0
je 0x40684a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406790
dec ebx
cmp byte [ebx], 0x2e
je 0x40679f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40678f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40684a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4067dc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40684a
cmp byte [ebp - 0xd], 0
je 0x40684a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40684a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408ef0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408f80
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408f80
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408f33
test edx, 3
jne 0x408f22
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408f2d
jmp 0x408f33
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408f33
cmp dword [ecx - 8], 1
je 0x408f3d
mov edx, ebx
or edx, 3
call fcn.00405714
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408f4f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404fc8

Function at 0x408f8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40901c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40901c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408fcf
test edx, 3
jne 0x408fbe
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408fc9
jmp 0x408fcf
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408fcf
cmp dword [ecx - 8], 1
je 0x408fd9
mov edx, ebx
or edx, 3
call fcn.00405714
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408feb
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404fc8

Function at 0x4098fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040548c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409915
test al, 0x10
je 0x409919
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040548c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409939
test al, 0x10
jne 0x40993d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c554
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c58d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004050b8
jmp 0x40c596
mov eax, ebx
mov edx, esi
call fcn.0040501c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c5a0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c5c2
movzx eax, byte [esp]
jmp 0x40c5c4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cc54
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cacc
mov eax, dword [0x478254]
cmp byte [eax], 0
je 0x40ccd0
mov eax, dword [0x47803c]
call fcn.004035e8
call fcn.00402ea4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409bb4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cd18
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40cd06
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x477fe4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x47b7f8]
call fcn.00406408
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d5ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d682
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405060
lea eax, [ebp - 4]
call fcn.004054dc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040548c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d66c
mov eax, ebx
call fcn.00402d48
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d665
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040548c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d64f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d694
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d64f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d66c
mov eax, dword [ebp - 0x10]
call fcn.00402d64
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d689
lea eax, [ebp - 4]
call fcn.00404fc8
ret