joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513e3c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070bc
mov eax, dword [ebp - 8]
call fcn.004070bc
mov eax, dword [ebp - 0xc]
call fcn.004070bc
mov eax, dword [ebp + 0xc]
call fcn.004070bc
xor eax, eax
push ebp
push 0x513fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00407b68
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 3
mov eax, 0x513fbc
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00407b68
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x513f83
xor edx, edx
push ebp
push 0x513f7c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00407b68
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407b68
push eax
movzx eax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectW
test eax, eax
je 0x513f65
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x513f5c
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x513f60
xor eax, eax
jmp 0x513f62
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513f83
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513fad
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407038
lea eax, [ebp + 0xc]
call fcn.00406fd8
ret
Function at 0x513fcc
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070bc
mov eax, dword [ebp - 8]
call fcn.004070bc
xor eax, eax
push ebp
push 0x5140e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x3c], 4
mov eax, dword [ebp - 8]
call fcn.00407b68
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], 2
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00407b68
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5140cb
xor eax, eax
push ebp
push 0x5140c4
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x5140a4
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x5140a8
xor eax, eax
jmp 0x5140aa
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5140cb
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5140ed
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407038
ret

Function at 0x5140f8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x5141c0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x5141c4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x5141c0
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5141b7
xor eax, eax
push ebp
push 0x5141b0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5141b7
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5158cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x515af6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x105
mov eax, dword [ebp - 0x20]
call fcn.00404444
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x51594d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x515937
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00407bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515954
mov eax, dword [ebp - 0x10]
call fcn.00404460
ret

Function at 0x51b09c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov bl, 2
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x14
call fcn.00404d68
push 0x14
lea eax, [ebp - 0x14]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
je 0x51b0d7
cmp word [ebp - 0x14], 0x31
jne 0x51b0d5
mov bl, 1
jmp 0x51b0d7
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51d688
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004872ec
test al, al
je 0x51d747
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x51d725
cmp word [esi + 0x67a], 0
je 0x51d6d9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x67c]
call dword [esi + 0x678]
movzx eax, byte [esi + 0x670]
or al, byte [ebp - 9]
jne 0x51d6fc
cmp dword [ebp - 4], 0
jbe 0x51d6f8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x51d6fc
xor ebx, ebx
jmp 0x51d6fe
mov bl, 1
test bl, bl
jne 0x51d747
mov eax, dword [0x53ee50]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x51d747
mov eax, dword [0x53ee50]
mov eax, dword [eax]
call fcn.004d5504
push 1
call sub.kernel32.dll_Sleep_2
test esi, esi
je 0x51d747
cmp byte [esi + 0x610], 0
jne 0x51d747
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004e1170
cmp eax, 4
jne 0x51d6b6
mov byte [esi + 0x670], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x526568
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x545374
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x52658a
shr eax, 1
xor eax, 0xedb88320
jmp 0x52658c
shr eax, 1
dec edx
jne 0x526578
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x526571
mov byte [0x545774], 1
pop esi
pop ebx
ret
Function at 0x5265a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x545774], 0
jne 0x5265bf
call fcn.00526568
mov eax, edi
dec eax
test eax, eax
jl 0x5265e7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x545374]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5265c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x529374
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x52940e.0
jmp dword [ecx*4 + 0x5293a7]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5293d9
sub dl, 8
je 0x5293e8
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x52901c
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529074
jmp case.0x52940e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x52940e.0
movzx ecx, byte [ecx + 0x529415]
jmp dword [ecx*4 + 0x529426]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529120
jmp case.0x52940e.0
cmp dl, 3
jne 0x529453
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529178
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529134
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5291bc
jmp case.0x52940e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52947e
sub dl, 8
je 0x52948a
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5291e8
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529254
jmp case.0x52940e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5294a9
sub dl, 8
je 0x5294b5
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529310
jmp case.0x52940e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x529338
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x529557
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00528520
test eax, eax
je 0x529557
mov eax, ebx
call fcn.00529560
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5294f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x529560
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x529591
dec al
je 0x5295cc
dec al
je 0x529611
dec al
je 0x52967a
jmp 0x529704
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x529704
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5295a1
jmp 0x529704
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x529704
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5295dc
jmp 0x529704
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x529704
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x529640
xor ebp, ebp
jmp 0x529650
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x529659
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x529621
jmp 0x529704
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x529704
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5296d3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005265f0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52968e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x438cac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
sub ebx, ebx
add ebx, ebx
call fcn.00438ce7
sub ebx, 0x11a39898
xor dword [eax], ecx
sub edx, 0x20eae7c6
sub ebx, ebx
sub edx, 1
inc eax
add ebx, 0x171162a9
cmp eax, esi
jne fcn.00438cac
add ebx, 0x4f0ea467
dec ebx
ret

Function at 0x633951
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.006339d0
jae 0x63395d
xor ecx, ecx
call fcn.006339d0
jae 0x633987
xor eax, eax
call fcn.006339d0
jae 0x633998
mov al, 0x10
call fcn.006339d0
adc al, al
jae 0x633979
jne 0x6339c5
stosb byte es:[edi], al
jmp 0x63395e
call fcn.006339dc
dec ecx
loop 0x6339a4
mov eax, ebp
call fcn.006339da
jmp 0x6339c6
lodsb al, byte [esi]
shr eax, 1
je 0x6339ec
adc ecx, 2
mov ebp, eax
jmp 0x6339c6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.006339da
cmp eax, 0x7d00
jae 0x6339c4
cmp eax, 0x500
jae 0x6339c5
cmp eax, 0x7f
ja 0x6339c6
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x63395e
pop ebp
ret 8
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x40bf63
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x40bf9b
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x40bf89
mov al, 1
jmp 0x40bfe5
cmp dword [ebx + 0x54], ecx
jne 0x40bf92
mov al, 2
jmp 0x40bfe5
cmp dword [ebx + 0x7c], ecx
jne 0x40bfe5
mov al, 3
jmp 0x40bfe5
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x40bfb0
mov al, 4
jmp 0x40bfe5
cmp ecx, 5
jne 0x40bfd0
cmp ebx, 0
jne 0x40bfbe
mov al, 5
jmp 0x40bfe5
cmp ebx, 1
jne 0x40bfc7
mov al, 6
jmp 0x40bfe5
cmp ebx, 2
jne 0x40bfd0
mov al, 7
jmp 0x40bfe5
cmp ecx, 6
jne 0x40bfdc
cmp ebx, 0
jne 0x40bfde
mov al, 8
jmp 0x40bfe5
cmp ebx, 1
jne 0x40bfe5
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405b20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b86
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404208
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b70
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b8d
lea eax, [ebp - 0x10]
call fcn.00403f98
ret

Function at 0x40ad44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ad7d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404088
jmp 0x40ad86
mov eax, ebx
mov edx, esi
call fcn.00403fec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad90
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40adb1
mov al, byte [esp]
jmp 0x40adb3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b438
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b2b0
mov eax, dword [0x4699fc]
cmp byte [eax], 0
je 0x40b4b4
mov eax, dword [0x46980c]
call fcn.00402af0
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040847c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b4fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b4ea
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4697b8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46a664]
call fcn.00405034
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bd50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40be26
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404030
lea eax, [ebp - 8]
call fcn.004044a8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404458
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40be10
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40be09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404458
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bdf3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40be38
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bdf3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be10
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be2d
lea eax, [ebp - 8]
call fcn.00403f98
ret

Function at 0x40c330
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c394
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404208
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407f90
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c39b
lea eax, [ebp - 0xc]
call fcn.00403f98
ret

Function at 0x41a524
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46a884
cmp dword [edi], 0
jne 0x41a5a0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46a880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46846c
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a4fc
lea eax, [esi + 5]
call fcn.0041a51c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a51c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a575
mov dword [0x46a880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41bb24
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41bb2a
ret
Function at 0x41dfc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e011
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41dff8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41dfe8
jmp 0x41e011
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41dff9
pop ebx
mov esp, ebp
pop ebp
ret