joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460870
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x48351a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call fcn.00450330
xor eax, eax
mov dword [esp + 0x1b0], eax
lea esi, [ebx + 0x14]
mov dword [esp + 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov edi, dword [esp + 0x1b8]
mov byte [esp + 0x1b0], 2
push edi
call fcn.00439f97
lea ebp, [edi + eax*2]
add esp, 4
mov eax, ebp
mov ecx, esi
sub eax, edi
sar eax, 1
inc eax
push eax
call fcn.00450230
mov eax, dword [esi]
push eax
push ebp
push edi
call fcn.0044e970
xor edi, edi
mov dword [esi + 4], eax
mov word [eax], di
lea esi, [ebx + 0x20]
mov dword [esp + 0x1c], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
push 0x10
mov byte [esp + 0x1c0], 5
call fcn.004180ea
lea ecx, [eax + 0x10]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov word [eax], di
mov word [esp + 0x28], di
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x2a]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edx, [esp + 0x18]
mov dword [ebx], 0x48cc24
push edx
push 0x102
stosw word es:[edi], ax
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a4
ret 4

Function at 0x460c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x483558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00450330
mov ecx, dword [esp + 0x2c]
mov dx, word [esp + 0x30]
mov edi, dword [sym.imp.ole32.dll_IIDFromString]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esi + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
push ecx
push str.00001101_0000_1000_8000_00805f9b34fb
mov word [esi + 0x18], dx
mov dword [esi], 0x48cc34
mov dword [esp + 0x20], eax
call edi
lea edx, [esp + 0xc]
push edx
push str.0850302A_B344_4fda_9BE9_90576B8D46F0
call edi
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00451490
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x463440
Capabilities:
Encode data using xor

Disassembly:
push edi
mov di, word [esp + 0x10]
xor cl, cl
test di, di
jbe 0x46346f
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov bl, byte [eax]
xor bl, dl
inc cl
xor dx, dx
mov byte [eax], bl
inc eax
mov dl, cl
inc esi
cmp dx, di
jb 0x463457
pop esi
pop ebx
pop edi
ret
Function at 0x466b80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x466b96
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x466ba1
mov eax, 0xfffff400
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
cmp ecx, 1
push edi
jne 0x466c1e
test eax, eax
jle 0x466c87
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
add eax, 7
shr eax, 3
mov dword [esp + 0x24], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 8
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x466bd9
mov edx, dword [esp + 0x1c]
push esi
push esi
push edx
call fcn.004668b0
mov ecx, dword [esp + 0x34]
mov eax, dword [esi]
add esp, 0xc
add edi, 8
mov dword [ecx], eax
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x24]
add esi, 8
dec eax
mov dword [ecx + 4], edx
mov dword [esp + 0x24], eax
jne 0x466bcc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
test eax, eax
jle 0x466c87
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
add eax, 7
shr eax, 3
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push edi
push esi
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.004668b0
mov ecx, ebp
add esp, 0xc
mov eax, edi
sub ecx, edi
mov edx, 8
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x466c5f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x24]
add esi, 8
add edi, 8
dec eax
mov dword [ebp + 4], ecx
mov dword [esp + 0x24], eax
jne 0x466c38
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x46b730
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0043c850
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x46b795
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x46b795
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00441ac5
add eax, 0x40
push eax
call fcn.004805e6
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043671a
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.0048015e
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x46b824
call fcn.0046b650
test eax, eax
je 0x46b824
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043671a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043671a
add esp, 0x108
ret
Function at 0x46f310
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0043c850
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x38]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jle 0x46f375
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.0046ae60
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0043671a
add esp, 0x28
ret
cmp ebp, 0x29
jge 0x46f3a3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.0046ae60
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0043671a
add esp, 0x28
ret
push 0x37
lea eax, [ebp - 0x14]
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x18], eax
call fcn.0046ac30
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x46f3eb
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.0046ae60
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0043671a
add esp, 0x28
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.00474ee0
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x58]
push 0
push edi
push eax
push ecx
call fcn.00474df0
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.0043aba0
mov edx, dword [esp + 0x3c]
mov ecx, edi
sub ecx, ebx
add ebp, ecx
push ebx
mov byte [ebp - 0x15], 1
push edx
add ebp, 0xffffffec
push ebp
call fcn.0043ca10
push 0x14
push esi
call fcn.0046d690
add esp, 0x38
test eax, eax
jg 0x46f45f
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0043671a
add esp, 0x28
ret
call fcn.00474ee0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
push eax
push 0x14
push esi
push ebx
push ebp
call fcn.0046f1d0
add esp, 0x14
test ebx, ebx
jle 0x46f48f
mov eax, edi
sub ebp, edi
mov ecx, ebx
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x46f484
call fcn.00474ee0
push eax
push ebx
push edi
lea eax, [esp + 0x2c]
push 0x14
push eax
call fcn.0046f1d0
lea ecx, [esp + 0x34]
lea edi, [esp + 0x35]
lea ebp, [esp + 0x36]
lea edx, [esp + 0x37]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x38]
add esp, 0x14
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x46f4d0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0046ade0
mov ecx, dword [esp + 0x38]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043671a
add esp, 0x28
ret
Function at 0x46fb20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x46fbec
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x46fb41
cmp al, 0x6b
jne 0x46fbec
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x46fbad
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x46fb61
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x46fb61
cmp al, 0xbb
jne 0x46fb8a
inc ecx
cmp ecx, esi
jl 0x46fb51
sub esi, ecx
test ecx, ecx
jne 0x46fbb0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0046ae60
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0046ae60
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x46fbd9
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0046ae60
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0043ca10
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0046ae60
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x497f98
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405890
xor eax, eax
push ebp
push 0x4980d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4980a9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004058a0
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a42c
test al, al
jne 0x498019
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403880
lea eax, [ebp - 0x1d0]
call fcn.0040361c
call fcn.004030b8
push dword [0x5a3e9c]
push 0x4980f0
push dword [0x5a3ea0]
push 0x4980f0
push dword [0x5a3ea4]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004057a4
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.0049c038
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405bc0
call fcn.00403f78
call fcn.004030b8
lea eax, [ebp - 0x1d0]
call fcn.00403948
call fcn.004030b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4980b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4980e0
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405434
lea eax, [ebp - 4]
call fcn.00405410
ret
Function at 0x49987c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405890
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4999e4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004990ec
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.0049910c
mov ebx, eax
jmp 0x4999b6
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405680
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a9c0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004096e8
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004096e8
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405838
je 0x499996
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405680
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004096e8
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004096e8
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405838
jne 0x4999ab
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.0049912c
mov ebx, eax
test ebx, ebx
jne 0x4998f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4999eb
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405434
lea eax, [ebp - 4]
call fcn.00405410
ret
Function at 0x499d93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x499ded
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x499de8
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x499de7
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x499db4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49acb8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405890
xor eax, eax
push ebp
push 0x49ad92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x49ada8
mov edx, dword [ebp - 4]
call fcn.00405728
mov eax, dword [ebp - 8]
call fcn.004058a0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x49ad02.0
jmp dword [eax*4 + 0x49ad09]
mov eax, ebx
mov edx, 0x49adb4
call fcn.00405464
jmp 0x49ad77
mov eax, ebx
mov edx, 0x49adc8
call fcn.00405464
jmp 0x49ad77
mov eax, ebx
mov edx, 0x49add8
call fcn.00405464
jmp 0x49ad77
mov eax, ebx
mov edx, 0x49adec
call fcn.00405464
jmp 0x49ad77
mov eax, ebx
mov edx, 0x49adfc
call fcn.00405464
jmp 0x49ad77
mov eax, ebx
mov edx, 0x49ae10
call fcn.00405464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ad99
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405434
ret
Function at 0x49cdfc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405890
mov eax, dword [ebp - 8]
call fcn.00405890
xor eax, eax
push ebp
push 0x49cfc6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49cf8e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x418010]
call fcn.0041c908
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49ce94
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a42c
test al, al
je 0x49ce8a
mov eax, dword [ebp - 8]
call fcn.004058a0
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.00405608
mov eax, dword [ebp - 0x1c]
call fcn.004058a0
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ce9e
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004058a0
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x418010]
call fcn.0041c908
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49cf7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov cx, 2
mov edx, 0xfffffffc
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041c680
mov edx, dword [ebp - 0x14]
add edx, 8
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041c680
mov edx, dword [ebp - 0x14]
add edx, 8
add edx, dword [ebp - 0x18]
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041c6f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cf84
mov eax, dword [ebp - 0x10]
call fcn.00404530
mov eax, dword [ebp - 0xc]
call fcn.00404530
ret
Function at 0x4059d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a3a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a24
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a41
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40abe0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac19
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40ac22
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac2c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac4d
mov al, byte [esp]
jmp 0x40ac4f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b2d4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b14c
mov eax, dword [0x46fa9c]
cmp byte [eax], 0
je 0x40b350
mov eax, dword [0x46f8a4]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408454
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b398
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b386
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46f850]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x470664]
call fcn.00404ee8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bbec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bcc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ee4
lea eax, [ebp - 8]
call fcn.0040435c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bcac
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bc8f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bcd4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bc8f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bcac
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bcc9
lea eax, [ebp - 8]
call fcn.00403e4c
ret

Function at 0x40c1cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c230
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407f9c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c237
lea eax, [ebp - 0xc]
call fcn.00403e4c
ret

Function at 0x41a370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x470884
cmp dword [edi], 0
jne 0x41a3ec
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x470880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46e3ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a348
lea eax, [esi + 5]
call fcn.0041a368
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a368
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a3c1
mov dword [0x470880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b980
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b986
ret