joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e1ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42e1c9
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42e1d7
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42e2f9
test ebx, ebx
jl 0x42e2f9
test esi, esi
jle 0x42e2f9
mov eax, dword [ebp - 8]
call fcn.0040ac3c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040ac3c
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42e296
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42e2f9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42e27b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42e24a
inc dword [ebp - 0x14]
jmp 0x42e25a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42e25a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42e265
or eax, 0xffffffff
jmp 0x42e27b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42e278
inc eax
jmp 0x42e27b
or eax, 0xffffffff
test eax, eax
jl 0x42e283
cmp esi, eax
jg 0x42e238
cmp esi, eax
jg 0x42e28e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42e2fc
inc edx
dec dword [ebp - 0x1c]
jne 0x42e234
jmp 0x42e2f9
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42e2f9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42e2e0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42e2bf
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42e2ca
or eax, 0xffffffff
jmp 0x42e2e0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42e2dd
inc eax
jmp 0x42e2e0
or eax, 0xffffffff
test eax, eax
jl 0x42e2e8
cmp esi, eax
jg 0x42e2a8
cmp esi, eax
jg 0x42e2f3
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42e2fc
inc edx
dec dword [ebp - 0x1c]
jne 0x42e2a4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e510
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43e518
mov eax, edx
pop esi
pop ebx
ret

Function at 0x478d84
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x478dc7
cmp byte [ebx + 0x11], 0
jne 0x478dc7
cmp byte [ebx + 0x24], 0
jne 0x478dc7
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x478dde
mov ecx, dword [0x4e5f54]
mov dl, 1
mov eax, dword [0x44bbbc]
call fcn.00428c18
call fcn.004097f4
pop ebx
ret
mov ecx, dword [0x4e5f54]
mov dl, 1
mov eax, dword [0x44bbbc]
call fcn.00428c18
call fcn.004097f4
pop ebx
ret
Function at 0x47974c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x47979a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00478c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4797b3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4797bc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00478c30
dec esi
jne 0x4797de
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x491f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x491fa7
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x491f97
mov eax, ecx
pop ebx
ret

Function at 0x4a43b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4a43c4
add esp, 0xfffffff0
call fcn.00408924
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x49e334]
call fcn.004c2a98
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x4a3380]
call fcn.004c584c
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x4a3380]
call fcn.004c584c
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x4a4419
call fcn.0040897c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2334
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call fcn.004d22dc
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
push eax
mov eax, 0x4ed990
mov ecx, 1
mov edx, dword [0x4d21e8]
call fcn.0040d068
add esp, 4
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jl 0x4d248f
inc edi
xor esi, esi
mov eax, dword [esp + 8]
cmp dword [eax + 0x10], 0
jne 0x4d2408
mov ebp, dword [esp + 0x44]
test ebp, ebp
jle 0x4d23f9
push 0x40
push 0x1000
push ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.004d2250
push eax
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov eax, dword [0x4ed990]
mov dword [eax + esi*8], ebx
mov eax, dword [0x4ed990]
mov dword [eax + esi*8 + 4], ebp
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
mov edx, ebp
mov eax, ebx
xor ecx, ecx
call fcn.00407bbc
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.004d2220
jmp 0x4d2487
push 0x40
push 0x1000
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.004d2250
push eax
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov eax, dword [0x4ed990]
mov dword [eax + esi*8], ebx
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [0x4ed990]
mov dword [edx + esi*8 + 4], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.004d2250
mov edx, dword [esp + 8]
mov edx, dword [edx + 0x10]
mov ecx, edx
mov edx, ebx
call fcn.004071e0
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.004d2220
inc esi
dec edi
jne 0x4d239d
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d2914
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x4d2929
or edx, 0x200
test eax, 0x20000000
je 0x4d295c
test eax, 0x40000000
je 0x4d2948
test eax, 0x80000000
je 0x4d2943
or edx, 0x40
jmp 0x4d2983
or edx, 0x20
jmp 0x4d2983
test eax, 0x80000000
je 0x4d2957
or edx, 0x80
jmp 0x4d2983
or edx, 0x10
jmp 0x4d2983
test eax, 0x40000000
je 0x4d2974
test eax, 0x80000000
je 0x4d296f
or edx, 4
jmp 0x4d2983
or edx, 2
jmp 0x4d2983
test eax, 0x80000000
je 0x4d2980
or edx, 8
jmp 0x4d2983
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x4d3128
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
mov eax, dword [esp]
mov dword [esp + 8], eax
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esp + 4]
mov edx, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x4d31eb
mov edx, dword [esp + 8]
lea edi, [edx + ecx]
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edi, byte [esi + ebx + 1]
shr edi, 4
add edx, edi
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, dword [esp + 8]
mov byte [edi + ecx + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
shl edx, 2
movzx edi, byte [esi + ebx + 2]
shr edi, 6
add edx, edi
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, dword [esp + 8]
mov byte [edi + ecx + 2], dl
mov edx, dword [esp + 8]
lea edx, [edx + ecx + 3]
push edx
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop edi
mov byte [edi], dl
add ecx, 4
add ebx, 3
dec eax
jne 0x4d315c
mov edi, dword [esp + 4]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [edx + edx*2]
sub edi, edx
dec edi
je 0x4d320d
dec edi
je 0x4d3252
jmp 0x4d32b2
mov eax, dword [esp + 8]
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx], dl
mov eax, dword [esp + 8]
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx + 1], dl
mov eax, dword [esp + 8]
mov byte [eax + ecx + 2], 0x3d
mov eax, dword [esp + 8]
mov byte [eax + ecx + 3], 0x3d
jmp 0x4d32b2
mov eax, dword [esp + 8]
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx], dl
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [esp + 8]
mov byte [edx + ecx + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
shl edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ecx + 2], dl
mov eax, dword [esp + 8]
mov byte [eax + ecx + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov edx, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d332c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4d334b
add edx, 3
sar edx, 2
test edx, edx
jle 0x4d3458
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4d3380
je 0x4d33c3
sub ecx, 0x2b
je 0x4d33b9
sub ecx, 4
je 0x4d33be
dec ecx
sub ecx, 0xa
jb 0x4d33ab
jmp 0x4d33c6
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4d3392
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4d339d
jmp 0x4d33c6
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4d33c6
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4d33c6
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4d33c6
mov byte [eax], 0x3e
jmp 0x4d33c6
mov byte [eax], 0x3f
jmp 0x4d33c6
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4d3363
movzx eax, byte [esp + 4]
shl eax, 2
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4d3416
cmp byte [esp + 7], 0xff
jne 0x4d3416
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4d344d
cmp dl, 0xff
je 0x4d344d
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4d335a
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4d5340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4d5361
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4d534e
pop edi
pop esi
pop ebx
ret
Function at 0x4d92d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd84
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x419cb4]
call fcn.0040b1a4
xor eax, eax
push ebp
push 0x4d947e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x278]
call fcn.004d8fd8
lea eax, [ebp - 0x278]
mov edx, 0x4d949c
call fcn.0040ae34
mov eax, dword [ebp - 0x278]
call fcn.0040ac3c
mov edx, eax
lea eax, [ebp - 0x274]
call fcn.0040ac9c
mov eax, dword [ebp - 0x274]
mov edx, 0x4d94c0
call fcn.004d9080
push 0
push 0
mov eax, dword [0x4ed9bc]
call fcn.0046943c
mov dl, 1
mov eax, dword [0x4486a4]
call fcn.00408318
mov ebx, eax
mov edx, dword [0x4ed9bc]
mov eax, ebx
call fcn.0046b864
push 0
push 0
mov eax, ebx
call fcn.0046943c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov dword [0x4ed9b4], eax
mov eax, dword [0x4ed9b4]
push eax
call fcn.00410140
pop ecx
mov dword [0x4ed9b0], eax
mov edx, dword [0x4ed9b0]
mov ecx, dword [0x4ed9b4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x18]
mov eax, ebx
call fcn.00408348
mov eax, dword [0x4ed9b4]
cdq
push edx
push eax
mov cl, 1
mov dl, 0x11
mov eax, dword [0x4ed9b0]
call fcn.004d2af0
mov dword [0x4ed9b8], eax
cmp dword [0x4ed9b8], 0
je 0x4d93eb
mov eax, dword [0x4ed9b8]
call fcn.004d2fe8
lea eax, [ebp - 0x27c]
call fcn.004d8fd8
lea eax, [ebp - 0x27c]
mov edx, 0x4d94d0
call fcn.0040ae34
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00421f1c
test eax, eax
jne 0x4d9442
push 6
mov eax, dword [ebp - 0x25c]
call fcn.0040ac3c
push eax
call sub.kernel32.dll_SetFileAttributesW
lea eax, [ebp - 0x270]
call fcn.00421f6c
test eax, eax
je 0x4d9420
lea eax, [ebp - 0x270]
call fcn.00421f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9485
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040a1ec
lea eax, [ebp - 0x270]
mov edx, dword [0x419cb4]
call fcn.0040b590
pop eax
jmp eax
Function at 0x403360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d6020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033d8
xor eax, eax
push ebp
push 0x4033d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403414
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d6020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d6020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040dc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e3048], 0
je 0x40413d
cmp word [0x4e321c], 0xd7b2
jne 0x404105
cmp dword [0x4e3224], 0
jbe 0x404105
mov eax, 0x4e3218
call dword [0x4e3234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d606c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404164
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d6030], 0
jne 0x404159
push 0
push 0x4d6064
push 0x4d606c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4042b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a54
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4e3049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404280
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406364
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063ca
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404574
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f18
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4063b4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063d1
lea eax, [ebp - 0x10]
call fcn.00404304
ret

Function at 0x40b7b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7f1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004043f4
jmp 0x40b7fa
mov eax, ebx
mov edx, esi
call fcn.00404358
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b804
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b825
mov al, byte [esp]
jmp 0x40b827
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bebc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bd24
mov eax, dword [0x4e2578]
cmp byte [eax], 0
je 0x40bf38
mov eax, dword [0x4e2208]
call fcn.00402d48
call fcn.00402be0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408ebc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bf80
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bf6e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4e2198]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e3664]
call fcn.004057d0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c7dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c8b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040439c
lea eax, [ebp - 8]
call fcn.00404814
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004047c4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c89c
mov eax, ebx
call fcn.00402a54
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c895
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004047c4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c87f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c8c4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c87f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c89c
mov eax, dword [ebp - 0x10]
call fcn.00402a84
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8b9
lea eax, [ebp - 8]
call fcn.00404304
ret

Function at 0x40cd8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cdf0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404574
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040895c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cdf7
lea eax, [ebp - 0xc]
call fcn.00404304
ret

Function at 0x41a61c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041a448
dec esi
jne 0x41a63e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x41b780
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4e3888
cmp dword [edi], 0
jne 0x41b7fc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4e3884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4d6408
mov ecx, 2
call fcn.00402c74
mov edx, 0x41b758
lea eax, [esi + 5]
call fcn.0041b778
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b778
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b7d1
mov dword [0x4e3884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41ca18
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ca1e
ret

Function at 0x41ee90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41eee1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41eec8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41eeb8
jmp 0x41eee1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41eec9
pop ebx
mov esp, ebp
pop ebp
ret