joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5718
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4fa788]
cmp dword [eax + 0x30], 0
je 0x4c57c2
cmp dword [ebx + 0x94], 0
jne 0x4c57bc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4c56a8
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4c57bc
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x4c5782
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4c57bc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00479cec
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4c5791
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4c62a0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4c62d5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0049b108
jmp 0x4c62e2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0049b06c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4c721c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4c725d
mov eax, esi
call fcn.004d645c
test al, al
je 0x4c725d
mov eax, dword [ebx + 0x84]
call fcn.004d6158
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4c725d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004d6158
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret
Function at 0x4cd5bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4fa82c], 0
je 0x4cd70b
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4f9330]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x4cd70b
mov eax, dword [0x4fa830]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4fa82c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4cd6da
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4fa82c]
call fcn.00479cec
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4cd6d2
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x4cd6d2
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4cd6d2
mov eax, dword [ebp - 0x14]
call fcn.004d6158
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4cd6d2
push ebp
call fcn.004cd578
pop ecx
test al, al
jne 0x4cd6d2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x4cd68e
mov eax, dword [ebp - 0x14]
call fcn.004d4cb4
dec eax
jle 0x4cd6d2
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.0049a4c4
cmp byte [ebp - 1], 0
je 0x4cd6d2
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x4cd6d2
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4fa830]
call fcn.004ccd40
inc edi
dec ebx
jne 0x4cd621
mov eax, dword [0x4fa830]
cmp dword [eax + 8], 0
jle 0x4cd6f2
mov eax, dword [0x4fa830]
call fcn.004ccdd0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4cd70b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004cd3e0
pop ecx
test al, al
jne 0x4cd70b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d0cc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x4d0d14
mov eax, esi
call fcn.004bd83c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d0d14
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x4d0d14
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4d0e53
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4d0d54
cmp eax, 0x108
ja 0x4d0d54
mov eax, esi
call fcn.004bd83c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d0e4a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x4d0e53
jmp 0x4d0e4a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4d0e33
cmp eax, 0x20a
ja 0x4d0e33
test byte [esi + 0x50], 0x80
jne 0x4d0d86
sub eax, 0x203
je 0x4d0d83
sub eax, 3
je 0x4d0d83
sub eax, 3
jne 0x4d0d86
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4d0d9a
dec eax
je 0x4d0daf
dec eax
je 0x4d0dcc
dec eax
je 0x4d0daf
jmp 0x4d0dd3
mov ecx, ebx
mov eax, dword [0x4f9330]
mov eax, dword [eax]
mov edx, esi
call fcn.004c70d4
jmp 0x4d0e4a
cmp byte [esi + 0x5d], 1
jne 0x4d0dc5
mov eax, esi
mov si, 0xffed
call fcn.0049a4c4
jmp 0x4d0e53
or word [esi + 0x54], 1
jmp 0x4d0e4a
and word [esi + 0x54], 0xfffe
jmp 0x4d0e4a
mov eax, dword [0x4fa7e8]
cmp byte [eax + 0x20], 0
je 0x4d0e4a
mov eax, dword [0x4fa7e8]
cmp dword [eax + 0x1c], 0
je 0x4d0e4a
mov eax, dword [ebx]
mov edx, dword [0x4fa7e8]
cmp eax, dword [edx + 0x1c]
jne 0x4d0e4a
lea eax, [ebp - 0x114]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.004bd780
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.0049a4c4
jmp 0x4d0e53
cmp eax, 0xb00b
jne 0x4d0e4a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.004cf5f4
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4350
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4d436c
cmp dword [esi + 4], 0
je 0x4d4399
test byte [ebx + 0x55], 1
jne 0x4d438b
mov eax, ebx
call fcn.004d2fa8
test eax, eax
jne 0x4d438b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4d44a9
mov edx, esi
mov eax, ebx
call fcn.004d3e70
jmp 0x4d44a9
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d44a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004d6158
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004d0bfc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004d4350
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004d6158
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d44a9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4da9c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4f9100]
cmp byte [eax + 0xc], 0
je 0x4dab2d
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dab26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fa83c], 0
jne 0x4daa14
push 0x4dab34
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x4dab3c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa83c], eax
cmp dword [0x4f5708], 0
jne 0x4dab0f
push 0x4dab4c
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x4f5708], eax
cmp dword [0x4f5708], 0
je 0x4dab0f
push 0x4dab58
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa840], eax
push 0x4dab68
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa844], eax
push 0x4dab7c
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa848], eax
push 0x4dab94
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa84c], eax
push 0x4dabac
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa850], eax
push 0x4dabc0
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa854], eax
push 0x4dabd8
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa858], eax
push 0x4dabf0
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa85c], eax
push 0x4dac0c
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa860], eax
push 0x4dac18
mov eax, dword [0x4f5708]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4fa864], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dab2d
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4dfe68
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4dfeca
call fcn.004dfe18
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004dc0f0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004dc0f0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4dff48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4f734c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4e0022
cmp dword [0x4f7348], 0
jne 0x4e0022
cmp dword [0x4f752c], 0
je 0x4dffdc
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004dfd18
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4dffc2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004dfd18
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4dffc2
lea ebx, [ebp - 0x84]
jmp 0x4dffc3
inc ebx
call fcn.004dff04
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4e005d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4f7350
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004dc0f0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4f7353
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4e005d
cmp dword [0x4f7348], 0
je 0x4e003c
cmp dword [0x4f7348], 0xffffffff
je 0x4e005d
push esi
call dword [0x4f7348]
pop ecx
mov eax, dword [0x4f734c]
test eax, eax
je 0x4e005d
cmp dword [0x4f734c], 0xffffffff
je 0x4e005d
cmp byte [eax], 0
je 0x4e005d
push esi
push eax
call fcn.004dfe68
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e07f4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4fb0f8], 0
jne 0x4e0875
cmp dword [0x4fb118], 0
jne 0x4e0824
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4fb118], eax
test eax, eax
jne 0x4e0824
push str.GetEnvironmentStrings_failed
call fcn.004e0074
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4fb118]
jmp 0x4e0838
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004dc0f0
pop ecx
mov edi, eax
test eax, eax
jne 0x4e0830
lea edi, [ebp + 1]
push edi
call fcn.004db9f4
pop ecx
mov ebx, eax
mov dword [0x4fb0fc], ebx
test ebx, ebx
jne 0x4e0862
xor eax, eax
jmp 0x4e0938
push edi
mov edx, dword [0x4fb118]
push edx
push ebx
call fcn.004dbfa0
add esp, 0xc
jmp 0x4e0895
xor esi, esi
mov ebx, dword [0x4fb0f8]
jmp 0x4e088f
push eax
call fcn.004dc0f0
pop ecx
test eax, eax
jne 0x4e088b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4e087f
lea ebx, [esi + 4]
push 4
mov dword [0x4fb100], ebx
inc ebx
push ebx
call fcn.004db4cc
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4e08b8
xor eax, eax
jmp 0x4e0938
cmp dword [0x4fb0f8], 0
jne 0x4e08e9
xor esi, esi
mov ebx, dword [0x4fb0fc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4e08da
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004dc0f0
pop ecx
mov edi, eax
test eax, eax
jne 0x4e08d0
jmp 0x4e091a
xor esi, esi
mov ebx, dword [0x4fb0f8]
mov eax, dword [esp]
mov edi, eax
jmp 0x4e0914
push eax
call fcn.004dc0f0
pop ecx
test eax, eax
je 0x4e0909
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4e090d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4e08f8
mov eax, dword [0x4fb0f8]
test eax, eax
je 0x4e092a
push eax
call fcn.004dba04
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4fb0f8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call fcn.10008d10
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10008d10
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call fcn.10008d10
pop ecx
jmp 0x10018771
push esi
call fcn.10008d10
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x298273e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x298273f0
pop dword [ebp - 0x2c]
mov eax, 0x28a3abea
add eax, 0xdec806
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xeaa8d4aa
sub dword [ebp - 0x3c], 0x9c568f5f
mov dword [ebp - 0x38], 0xff8d04bc
sub dword [ebp - 0x38], 0xcd59b877
mov dword [ebp - 0x34], 0x3e34427e
sub dword [ebp - 0x34], 0xf1e7fe50
mov dword [ebp - 0x30], 0xe1c23cde
sub dword [ebp - 0x30], 0xe1c23cde
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xe593e48a
sub eax, 0xbc0e63ca
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xba931859
add dword [ebp - 0x3c], 0xb9df50fd
mov dword [ebp - 0x38], 0x683042e1
add dword [ebp - 0x38], 0xd93c1e94
mov dword [ebp - 0x34], 0xd609c9a6
sub dword [ebp - 0x34], 0x729a5d3a
mov dword [ebp - 0x30], 0x558cd3b2
sub dword [ebp - 0x30], 0x558cd3b2
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x2444af30
sub eax, 0xfabf2e78
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x45ab3
push 0
call eax
mov ecx, 0x9c3d3d6
sub ecx, 0x9c39612
mov ebx, eax
mov esi, 0x29897400
add esi, dword [ebp - 0x2c]
mov edx, 0xc7eb4229
xor dword [ebp - 0x10], 0x96921930
mov edi, dword [esi]
xor dword [ebp - 0xc], eax
sub edi, edx
mov dword [ebx], edi
xor dword [ebp - 0x10], 0xf7d45344
add ebx, 4
add esi, 0xf61ba7d2
add esi, 0x9e45832
loop 0x29827506
add eax, 0xe499e373
sub eax, 0xe498f990
mov ebx, eax
add eax, 5
mov ecx, 0x29800000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411580
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x4115ab
mov al, byte [edx + ecx]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [esp + 8]
jb 0x41158c
ret

Function at 0x403599
Capabilities:
Terminate process

Disassembly:
jmp 0x450c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x450c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0040583f
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4036bb
Capabilities:
Query environment variable

Disassembly:
jmp 0x497a90
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x497aa1
pop esi
ret
push ebx
push edi
push esi
call fcn.00497977
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403f5d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x497ac9
push ebx
push esi
push edi
call fcn.0040563c
add esp, 0xc
push 0
call fcn.00406168
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4056f5
Capabilities:
Parse pe header

Disassembly:
jmp 0x43f959
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43f998
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43f998
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43f998
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43f998
cmp dword [ecx + 0x74], 0xe
jbe 0x43f998
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43dc1f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00403724
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x43dc5e
sub eax, 1
je 0x43dc59
sub eax, 1
je 0x43dc55
xor eax, eax
leave
ret
push 3
jmp 0x43dc60
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x48da22
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401d7a
mov eax, dword [0x522940]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405d80
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x48da64
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x48dbc0
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00405eca
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x526238]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403247
mov ecx, dword [esi*4 + 0x526238]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x48dbb9
cmp eax, dword [edi + ecx + 0x24]
jne 0x48dbb9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48dbb9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403247
add esp, 0x14
test edx, edx
jl 0x48dbb9
jg 0x48db2f
test eax, eax
jb 0x48dbb9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x48dbb9
jl 0x48db49
cmp dword [ebp - 0x1008], eax
ja 0x48dbb9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x48db67
test ebx, ebx
je 0x48dba0
cmp ecx, edi
jae 0x48dba0
mov al, byte [ecx]
cmp al, 0xd
jne 0x48db81
lea eax, [edi - 1]
cmp ecx, eax
jae 0x48db8d
cmp byte [ecx + 1], 0xa
jne 0x48db8d
inc ecx
jmp 0x48db8d
movzx eax, al
movsx eax, byte [eax + 0x522c90]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x48db67
cmp edx, ebx
jne 0x48db67
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x48dbbe
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403021
leave
ret