joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11056d3
Capabilities:
Encode data using xor

Disassembly:
cwd
xadd edx, eax
adc al, byte [esi + eax*2]
btr edx, edx
or dx, dx
xor al, bl
bt edx, 0x1c
not al
rol al, 1
sal edx, 0x96
btc edx, edx
sbb al, dl
jmp 0x161a1ab
dec eax
mov dword [esp], ebx
call fcn.010c61cd
push es
push 0x12e2cded
pop edi
inc esi
jp 0x1105669
xor byte [ebx], 0xe7
xor esp, edi
arpl word [esi], ax
salc
pop ecx
jb 0x1105759
stosb byte es:[edi], al
fist word [edx - 0x340ed17a]
xor dl, byte [edx + 0x575613a7]
push edi
mov ecx, 0x5e399aa2
mov al, byte gs:[0x998392a4]
mov bl, 0x6c
adc al, 0x65
rcl cl, 1
aas
movsd dword es:[edi], dword [esi]
test eax, 0x31d5feef
xor ebx, dword [esi + 0x39]
outsb dx, byte [esi]
pop ecx
jne 0x110570f
jns 0x1105723
push 0xffffffffffffff83
push cs
xor dword [ebp + 0x24], edi
leave
push es
dec edx
xor edi, dword [esi + 0x61]
lodsd eax, dword [esi]
adc al, 0xf9
xchg esi, eax
fisub dword [ebx]
daa
mov byte [0x68a42b1a], al
jno 0x1105753
mov ebx, 0x46897e57
or al, 0x68
mov edi, 0xe8cc8b95
jb 0x11056fb
jp 0x1105747
invalid
rcr byte [ebx], cl
loope 0x11056e6
adc ecx, dword [edi]
mov dword [0xeaba0fd2], eax
pop es
inc dl
not al
push edx
not edx
inc edx
xor al, 0x23
or edx, dword [esp]
sbb dl, dh
dec al
xor bl, al
shr dl, 0x41
lea eax, [esp + eax + 4]
mov edx, dword [eax]
sar byte [esp + 3], 0x47
sbb ebp, 4
call fcn.0165dd4f
or dx, 0xc9b7
xor al, 3
jmp 0x16040f3

Function at 0x111b4f9
Capabilities:
Encode data using base64

Disassembly:
xor bl, dl
sub ebp, 2
push 0x83b26abd
call fcn.0168a8c0

Function at 0x113f67c
Capabilities:
Encode data using base64

Disassembly:
push 0xe92ef213
inc al
xor bl, al
xor word [esp + 0x15], 0xb11f
not word [esp + 0x15]
mov dword [esp + 8], 0x4f05b233
lea eax, [esp + eax + 0x18]
call fcn.011081dd
stc

Function at 0x128c65b
Capabilities:
Encode data using base64

Disassembly:
add ebp, 6
dec word [esp + 4]
shrd eax, edi, cl
call fcn.01632beb

Function at 0x1611b23
Capabilities:
Encode data using base64

Disassembly:
push 0xc33aad2d
mov dword [esp + 8], 0x6d08fc19
mov word [esi], di
call fcn.010eb5d6
and dword [esp], 0x4f9238b6
inc dx
neg byte [esp + 1]
rol dword [esp], 0x13
rol dx, 1
call fcn.0113f251
push 0x62925210
sbb esi, 2
jmp 0x113f64b
jae 0x1611b13

Function at 0x167994d
Capabilities:
Encode data using base64

Disassembly:
rol cl, 1
not cl
inc cl
neg dword [esp + 7]
push 0x46080511
push 0x86831695
ror cl, 1
xor bl, cl
lea ecx, [esp + ecx + 0x1c]
mov word [ecx], dx
push 0x869d1215
lea esp, [esp + 0x20]
jmp fcn.01663eaa
dec word [esp + 4]
jne 0x144c60d
test esp, 0x578aba37

Function at 0x169119d
Capabilities:
Encode data using base64

Disassembly:
call fcn.0110c873
shr cx, 1
call fcn.0161a5cc
call fcn.0166dec5
bswap eax
jns 0x167e00a
Function at 0x1693488
Capabilities:
Encode data using base64

Disassembly:
jge 0x1646690
stosb byte es:[edi], al
inc dword [ecx + 0x2a3891d2]
jnp 0x16466ff
adc edx, 0x7b2a3891
push 0x5361c18
sub word [esp + 4], 0x3f06
sbb byte [esi + esi], bl
add eax, 0x246c8166
add al, 6
aas
shl word [esp + 3], 0x42
not edx
call fcn.010e8b6d
push esp
jbe 0x164668e
cmpsd dword [esi], dword es:[edi]
mov cl, byte [esi + 0x6a]
mov byte [edx + 0x40dcfca1], dl
xchg byte [ebx + ebp*2 - 0x6b9d8162], ah
xchg esi, eax
jge 0x1646743
out dx, eax
dec esp
leave
jmp 0x1a623eb3
dec ecx
inc esi
push edi
pop edi
cld
mov edx, 0x4fbbead
fstp dword [ecx - 0xe]
in al, 0x9b
cwde
cmp eax, 0xc3f62c02
imul eax, dword [edi], 0x5d
xchg edi, eax
and byte [ebp - 0x267cfe13], al
sub dh, bh
xchg dword [ebx - 0x2f], edi
mov ebx, 0x8d75edc0
pop ds
and eax, 0xc69d89e2
and byte [ebx - 0x25f91106], bl
das
cmp al, 0
pop eax
in eax, 0xc5
mov eax, dword [0x5b4690f]
xor bh, byte [eax - 0x67dc941b]
test bh, al
mov ebx, 0x9c6b02ee
and ebx, dword [eax - 0x1144387c]
add ch, byte [ebx - 0x64]
test dword [ebp - 0x38], ecx
out dx, eax
ret 0xa32e
mov dword [esp], 0x6a24dd86
cmp esi, eax
jmp 0x1694365
call fcn.0110d522
sub edx, 0x91220b86
shr dword [esp], 0xf3
not edx
dec dword [esp]
jno 0x112ab41
mov edx, 0xe0005e3d
imul edx, edx
mov edx, dword [edi]
mov ecx, 0xaf870d12
xchg ch, cl
seto cl
movzx cx, byte ss:[edx]
push 0x7e2d3933
adc edi, 1
mov word [edi], cx
lea esp, [esp + 4]
jmp fcn.010e3d2f

Function at 0x18ad65b
Capabilities:
Encode data using base64

Disassembly:
pop ebp
mov ebp, dword [esp + ecx - 0x82cb]
call fcn.0164a5eb
xchg ecx, ecx
Function at 0x18baeb1
Capabilities:
Encode data using xor

Disassembly:
mov word [ebp], dx
call fcn.0110b2ac
call 0xf5fda913
xchg edi, eax
imul edi, dword [0xddd2a44e], 0x40
std
pop esi
sti
or al, 0x63
push ebp
mov bh, 0x5b
test byte [ebp + 0x4647bd26], 0x5d
cmp esi, dword [0x19332a16]
inc dx
sub eax, dword [ecx]
jb 0x18baf31
or ebp, dword [ecx]
sbb ah, byte [esi]
and eax, dword [ecx]
adc dl, byte [0x37e4d1d3]
mov dh, 0x51
ljmp 0x5599
xchg dword [eax + 0x2f0d0854], ecx
pop eax
stc
xchg edi, edi
push ds
invalid
mov dh, 0x71
jbe 0x18baf35
outsb dx, byte [esi]
aaa
xor al, 0xce
js 0x18baf1f
xlatb
scasb al, byte es:[edi]
dec eax
mov eax, 0xe7e0ddf9
jno 0x18baf83
mov esi, 0x47b77a34
push es
imul ebx, dword [edi - 0x20], 0xffffffa6
jo 0x18baf3b
arpl word [edx], di
jnp 0x18bafb9
mov al, 0xad
std
push 0xc647b7af
mov al, 0x1c
aad 0x63
xlatb
lcall 0xf58f, 0x6b008f02
invalid
jp 0x18bafe9
cmpsd dword [esi], dword es:[edi]
xor eax, 0xd6488264
dec edx
retf
adc al, 0x55
add byte [0x36f15027], al
retf 0x9719
and eax, dword [edx + 0x56f719df]
sbb edi, esi
push esi
jb 0x18bb05b
push 0x51833d4a
lodsd eax, dword [esi]
jle 0x18bafe6
int1
inc edi
inc ecx
inc esp
call fcn.018b5a41
js 0x18bb07d
pop edi
sub al, bl
test al, 0x95
invalid
mov eax, 0x4cc7cbf9
daa
arpl word [ebp + 7], bx
xor byte [edx - 0x61], dh
out 0xde, al
mov eax, 0x5ea895f9
push edx
sbb eax, 0x2159179d
inc edi
push es
mov ecx, 0xab385ebf
xchg edi, eax
add byte [ecx - 0x77555073], ah
call dword [esi - 0x57]
push ebp
cld
sbb dword [edi - 0x40], edi
adc dword [esi + 0x52], esp
push esi
test eax, 0x7f19fc55
rcl byte [ecx], 0x66
push edx
scasb al, byte es:[edi]
jge 0x18bb03e
stosd dword es:[edi], eax
xchg edx, eax
xchg esp, eax
xchg ecx, eax
mov bl, 0xc4
sahf
std
add dword [esi + 0x58], ecx
jno 0x18bb0b2
call dword [ebx - 0x42]
salc
fidiv word [ebx - 2]
mov esi, 0xfe73ded6
cmp al, 0xf9
and dword [edi - 0x7a], eax
loopne 0x18bb016
mov dl, 0x1c
xchg edi, eax
mov cl, 0x31
adc byte [edi + 0x46473c53], bh
or al, 0xaa
fidivr dword [edi + eax*2 + 0x48]
ret
mov dword [0xc3e9d0e4], eax
clc
lodsb al, byte [esi]
fist word [edx - 0x23]
mov eax, 0xc12f3a4e
mov ebx, 0x7b840da6
bnd jno 0x18bb09c
fisub dword [esi - 0x27779b96]
dec ecx
xlatb
xchg edx, eax
and ebp, dword [edi + 0x1a261565]
aas
sbb eax, 0x91b0622
or ah, byte ds:[ebx + 0x49]
push 0x56
pop ebx
imul ecx, dword [esi + 0x7a], 0x2601965b
jp 0x18bb10f
xchg esi, eax
add dword [esi], esp
ret
ret

Function at 0x18bb325
Capabilities:
Encode data using base64

Disassembly:
adc ebp, 1
sar byte [esp + 6], 0x27
or dl, al
call fcn.010e8a14
Function at 0x18bbbe6
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx + 0x4246cc1], ch
mov dword [0x2de81], eax
add byte [eax], al
call fcn.01298a65
mov edx, 0x822e51a6
movsx ecx, dl
and ecx, ecx
movzx cx, byte [esi]
xor dl, 0xa3
mov dl, byte [esi + 2]
push 0xc6bc361d
adc esi, 2
shl byte [esp + 2], 0x63
not cl
jne 0x11251cd
sbb eax, dword [esi - 0x1f]
cld
or eax, 0x3ebf7c2f
in eax, 0x1a
mov eax, 0xff205767
jb 0x10cbc0f
jbe 0x10cbc1c
mov al, 0xa6
adc ebp, dword [0x50042f48]
mov ch, 0x66
adc byte [ebx + 0xd], ah
push es
invalid
movzx cx, byte [esi]
sub al, ah
mov al, byte [esi + 2]
jns 0x10cbc30
call fcn.012a0037
mov eax, dword [ebp]
mov edx, 0xdda1298d
shr edx, 0xd1
mov dx, word [eax + edx*2 - 0xdda0]
call fcn.0111e4ba
Function at 0x40c324
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40df40
call fcn.0040c5e8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c384
cmp eax, 0xffffffff
je 0x40c384
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40c37d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40c37d
cmp edx, 0x10000000
jae 0x40c37d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40c37a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40c3f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40c42e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40c426
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40c430
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40c416
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40c500
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40c531
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40c531
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40c531
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403494
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406c64
test esi, esi
jne 0x4034cc
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406da0
jmp 0x4034ea
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403378
mov edi, eax
test esi, esi
je 0x4034ea
cmp dword [ebx], 0
je 0x4034ea
dec esi
jmp 0x4034d3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40351c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5cd008], 0x8088405
inc edx
mov dword [ebx + 0x5cd008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403d4c
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403d6a
push dword [eax]
call sub.KERNEL32.DLL_SetEndOfFile
dec eax
je 0x403d74
jmp fcn.0040324c
mov eax, 0x67
jmp fcn.0040323c
ret

Function at 0x4043e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5cd024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40447c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x40445c
xor eax, eax
push ebp
push 0x404455
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4044b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40445c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
movzx eax, word [0x5cd024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5cd024], ax
mov esp, ebp
pop ebp
ret
Function at 0x404c64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00404f18
mov byte [esp], al
cmp byte [esp], 0
jne 0x404ded
test edi, edi
je 0x404ded
mov byte [esp + 1], 0
test ebp, ebp
jle 0x404d24
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x404cff
cmp edi, 0xffffffff
je 0x404cc3
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404cc3
mov byte [esp], 0
jmp 0x404ded
mov ebx, dword [esi]
cmp ebx, 1
jg 0x404cff
test ebx, ebx
jne 0x404cf8
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00401440
test eax, eax
jne 0x404cf8
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x404ded
pause
dec ebp
test ebp, ebp
jg 0x404ca8
cmp edi, 0xffffffff
je 0x404d24
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404d22
mov byte [esp], 0
jmp 0x404ded
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x404c72
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00401440
cmp ebx, eax
jne 0x404d24
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00404e60
mov edx, eax
mov ebx, dword [0x5d98cc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x404d8b
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x404d89
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x404d8b
xor edi, edi
cmp byte [esp], 0
je 0x404db4
mov ebx, dword [esi]
test bl, 1
jne 0x404dcd
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00401440
cmp ebx, eax
jne 0x404d91
mov byte [esp + 1], 1
jmp 0x404dcd
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00401440
cmp ebx, eax
jne 0x404db4
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x404d3e
cmp byte [esp], 0
je 0x404ded
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405a34
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5d9054], 0
je 0x405a95
cmp word [0x5d9330], 0xd7b2
jne 0x405a5d
cmp dword [0x5d9338], 0
jbe 0x405a5d
mov eax, 0x5d932c
call dword [0x5d9348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405ac0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x5cd034], 0
jne 0x405ab1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x405c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x5cd03c], 0
je 0x405c86
mov edx, esi
mov eax, ebx
call dword [0x5cd03c]
jmp 0x405c95
mov eax, 8
call fcn.004030b4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x5d9055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405c28
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40b618
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x5dbb60
push 0xa
push 0x40b6ac
mov eax, dword [0x5dbb50]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40b63c
call fcn.0041746c
push ebx
mov eax, dword [0x5dbb50]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40b653
call fcn.0041746c
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40b665
call fcn.0041746c
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x5dbb64], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x5dbb68], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x5dbb6c], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x5dbb70], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x5dbb74], ecx
add edx, dword [eax + 0x14]
mov dword [0x5dbb78], edx
pop esi
pop ebx
ret

Function at 0x40d194
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40d23d
test eax, edx
je 0x40d240
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40d1bd
push edx
mov edx, eax
mov eax, esp
call fcn.00406e80
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40d1d3
push eax
lea eax, [esp + 8]
call fcn.00406e80
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40d1e2
movzx eax, word [eax]
sub eax, ecx
jmp 0x40d209
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40d223
add ecx, 4
js 0x40d1fa
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40d220
push eax
mov eax, ecx
mov edx, 2
call fcn.00405d00
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40d207
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40d209
xor eax, eax
ret
test eax, eax
je 0x40d250
test edx, edx
jne 0x40d1a4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40e650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00406cf0
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40e66e
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.KERNEL32.DLL_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40e68f
cmp ebx, 3
je 0x40e68f
cmp ebx, 0x7b
je 0x40e68f
mov eax, esi
call fcn.0040e610
test al, al
jne 0x40e693
xor eax, eax
jmp 0x40e695
mov al, 1
pop esi
pop ebx
ret

Function at 0x40e698
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406cf0
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40e6b1
test al, 0x10
jne 0x40e6b5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x40e7d0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00406cf0
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x40e7f2
call sub.KERNEL32.DLL_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x414568
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW_1
test eax, eax
jle 0x4145a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406da0
jmp 0x4145aa
mov eax, ebx
mov edx, esi
call fcn.00406c64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4145b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW_1
test eax, eax
jle 0x4145d6
movzx eax, word [esp]
jmp 0x4145d8
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x414eac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x414fd1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00414cc0
mov esi, eax
mov eax, dword [0x5d8934]
cmp byte [eax], 0
je 0x414f79
mov eax, dword [0x5d8498]
call fcn.00403970
call fcn.0040321c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x414e88]
call fcn.00408418
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x414fec
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
jmp 0x414fb5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x5d83e4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5dbb50]
call fcn.00408620
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414fd8
lea eax, [ebp - 4]
mov edx, dword [0x414e88]
call fcn.00408538
ret
Function at 0x415c24
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415cfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406cb8
lea eax, [ebp - 4]
call fcn.00407614
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406cf0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x415ce4
mov eax, ebx
call fcn.004030b4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x415cdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406cf0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x415cc7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x415d0c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x415cc7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415ce4
mov eax, dword [ebp - 0x10]
call fcn.004030d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415d01
lea eax, [ebp - 4]
call fcn.00406c54
ret

Function at 0x41729b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406090
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x4172be
mov eax, edi
add eax, eax
call fcn.004030b4
mov esi, eax
jmp 0x4172c0
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4172f9
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4172e3
mov eax, esp
cmp esi, eax
je 0x417306
mov eax, esi
call fcn.004030d0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x417340
cmp bl, 0
je 0x41733c
cmp bl, 0x41
jl 0x417337
cmp bl, 0x5a
jg 0x417337
or bl, 0x20
xor al, bl
inc esi
jmp 0x41731b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x417280
Function at 0x4196a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406470
xor eax, eax
push ebp
push 0x41975f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
call fcn.00408250
mov esi, eax
cmp dword [ebp - 4], 0
jne 0x4196f0
test esi, esi
jle 0x4196f0
lea eax, [ebp - 4]
lea edx, [esi + esi*2]
mov ecx, dword [ebx + 0x30]
mov edx, dword [ecx + edx*8 - 8]
call fcn.00405d8c
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x30]
mov ecx, 1
mov edx, dword [0x419390]
call fcn.00408418
add esp, 4
lea edi, [esi + esi*2]
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x38]
mov dword [eax + edi*8], edx
mov edx, dword [ebx + 0x3c]
mov dword [eax + edi*8 + 4], edx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebp + 8]
mov dword [eax + edi*8 + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + edi*8 + 0xc], edx
mov eax, dword [ebx + 0x30]
lea eax, [eax + edi*8 + 0x10]
mov edx, dword [ebp - 4]
call fcn.00405d30
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add dword [ebx + 0x38], eax
adc dword [ebx + 0x3c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419766
lea eax, [ebp - 4]
call fcn.00405cdc
ret