joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4650a4
Capabilities:
Encode data using base64

Disassembly:
jmp 0x4650e6
mov ebp, esp
jmp 0x46519d
lea esp, [esp + 4]
push ebp
lea ebp, [esi*4]
shl edx, 0x1e
bswap ebp
jmp 0x4650d0
mov dword [esp], eax
cmc
sub esp, 0x11
lea esp, [esp + 1]
lea esp, [esp + 0x10]
popal
jmp 0x465170
sub esp, 0x40
push edi
stc
pushal
jmp 0x465116
bswap edx
shr eax, 3
call 0x465134
lea esp, [esp + 0xc]
lea edx, [ecx + edi*8]
pushfd
jmp 0x465180
push esi
mov word [esp + 1], sp
pushfd
pop eax
mov eax, ecx
jmp 0x46514a
lea esp, [esp + 4]
and eax, 0x3f
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0x4651e4
mov ecx, dword [esi]
mov edx, dword [esp]
bsr dx, di
add edx, 0x2f7669e0
jmp 0x46512c
cmp edx, ecx
lea esp, [esp + 0x1c]
jae 0x465058
call fcn.004651c7

Function at 0x471c06
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], ax
jmp 0x471c2b
pushal
pop dword [esp + 0xc]
mov byte [esp + 4], ah
mov dword [esp + 0x60], ebp
pushal
mov word [esp + 0x14], si
jmp 0x471c7b
mov word [esp + 0xe], ax
mov dword [esp + 0x7c], esi
push esi
push word [esp + 3]
je 0x471c57
jne 0x471c57

Function at 0x477d1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x477d26
add bl, 0x20
setp dl
xchg edx, eax
mov ax, 0xb59e
bsf eax, ebx
jle 0x477d7e
bsr ax, dx
rdtsc
jmp 0x477d80
bsr ax, dx
rdtsc
jmp 0x477d80
jmp 0x477d68
rol bl, 0
jns 0x477dba
mov dl, 0x66
jmp 0x477da4
xchg dl, al
sub esp, 0x1a
jmp 0x477dc1
mov dl, 0x66
xchg dl, al
sub esp, 0x1a
call 0x477dc7
sub eax, 0x3e5
lea esp, [esp + 0x20]
dec bl
lea edx, [ecx*4]
lea edx, [esi + ebp]
mov dx, si
jmp 0x477f8b
rcr dx, cl
call fcn.00477f5d
or dword [edi + reloc.MSVCRT.dll_strncpy], eax
mov cl, 0x38
scasb al, byte es:[edi]
leave
cmp byte [ebp + 0x148d0495], cl
adc bh, dh
invalid
lea edx, [edx + edx]
inc dh
jle 0x477df7
rcr dx, cl
jmp 0x477dfa
pushal
mov dword [esp + 0x1c], ebx
popal
jmp 0x477e0d
bsr eax, edx
jno 0x477e29
jo 0x477e29
mov dx, 0xe8ff
lea edx, [ecx - 0x8d]
lea ecx, [ecx + 1]
mov dx, 0x9278
dec dh
jmp 0x4780b5
mov byte [esp], cl
lea esp, [esp + 2]
push dword [esp + 4]
ret 8
rcl edx, cl
sete dh
xchg dword [esp + 4], ecx
push edx
lea esp, [esp]
pop word [esp]
jmp 0x478050

Function at 0x47fad4
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x466c2e
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x466c45
pop ebx
ret
mov dword [esp], edx
mov ch, 0x82
mov dh, byte [esp]
mov edx, dword [esp]
lea edx, [esi - 0x9e]
push esi
jmp 0x47fae3
mov cx, word [esp + 1]
lea ecx, reloc.MSVCRT.dll_strncpy
bswap ecx
jmp 0x47fab6
mov ch, byte [esp]
lea edx, [edx + ebx]
xchg edx, esi
xchg esi, edx
setnp ch
xchg cx, si
jmp 0x47fb20
not cx
mov ecx, 0x6f51b92
mov ecx, ebx
sete ch
jmp 0x47fb33
pop esi
bswap ecx
mov cx, word [esp]
lea edx, [edx*4]
pop edx
mov ch, dl
jmp 0x47fb0a
lea ecx, [ebx*4]
pop ecx
jmp 0x466c22
Function at 0x48011e
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x4663a3
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x4663bd
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x4663ac
pop esi
jmp 0x4663c8
ret 4
push edi
bswap ebx
mov ebx, dword [esp + 8]
lea esp, [esp + 0xc]
pushfd
lea esp, [esp + 4]
jmp 0x466396
jmp 0x480108
Function at 0x401451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147f
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x40149a
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ee
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ee
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f2
xor eax, eax
jmp 0x401504
cmp dword [ebp - 4], edi
je 0x401501
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x401944
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
xor esi, esi
call edi
test eax, eax
jbe 0x40197b
push ebx
mov ebx, ebp
sub ebx, 0x404418
mov al, byte [ebx + esi + 0x404418]
push ebp
xor al, 1
mov byte [esi + 0x404418], al
inc esi
call edi
cmp esi, eax
jb 0x401963
pop ebx
and byte [esi + 0x404418], 0
pop edi
pop esi
mov eax, 0x404418
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.00401507
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x45f1fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x45f20d
pop dword [ebp - 0x14]
mov eax, 0xc779a88d
add eax, 0x38cc4980
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x49114
push 0
mov eax, 0xb3c06661
add eax, 0x4c874d3b
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xd37288d
sub ecx, 0xd36dab3
mov edx, eax
mov ebx, 0x3ef61e9a
add ebx, 0xc15d4566
add ebx, dword [ebp - 0x14]
mov esi, 0xfec2e9a7
sub esi, 0x980d4787
mov dword [ebp - 0x10], 0x8f66e714
mov edi, dword [ebx]
xor dword [ebp - 0xc], 0x544b6da4
sub edi, esi
xor dword [ebp - 0xc], 0x4256a961
mov dword [edx], edi
add dword [ebp - 0x10], 0xa167750b
add edx, 4
add ebx, 4
loop 0x45f26c
add eax, 0x130b56c3
add eax, 0xecf5d378
xor ebx, ebx
add ebx, eax
add eax, 0x9d208c5f
sub eax, 0x9d208c5a
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401647
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405120], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40508e], ecx
mov dword [0x405124], 0x30
mov dword [0x405128], 3
mov dword [0x405130], 0
mov dword [0x405134], 0
mov dword [0x40512c], 0x403148
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x405086], ebx
mov dword [0x405138], ebx
mov dword [0x405144], 0xf
mov dword [0x40514c], 0x405067
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40513c], eax
mov dword [0x405150], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x405140], eax
push 0x405124
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x405086]
push 0
push 0
push 0x2bc
push 0x1f4
push 0xa0
push 0x12c
push 0x40000
push str.Hello_word
push str.2class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x405118], eax
push 0
push dword [0x405118]
call sub.user32.dll_ShowWindow
push dword [0x405118]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0x405154
call sub.user32.dll_GetMessageA
or eax, eax
je 0x40176b
push 0x405154
call sub.user32.dll_TranslateMessage
push 0x405154
call sub.user32.dll_DispatchMessageA
jmp 0x401741
mov eax, dword [0x40515c]
mov esi, dword [0x4051b4]
lea ecx, [0x405086]
add esi, eax
call esi
ret
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x13bc2291
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xc665ffc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
push str.VirtualAlloc
push str.Kernel32.dll
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 4
push 0x3000
push 0x1dcd6500
mov edi, eax
push esi
call edi
test eax, eax
je 0x404fee
mov ecx, 0x1dcd6500
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x404eb1
push ebx
lea ebx, [ecx + 0xd]
mov edi, edi
mov al, byte [ecx + section..data]
ror al, 3
xor al, byte [esi + str.wowvrujkovyon]
inc ecx
mov byte [ecx + 0x424fff], al
lea eax, [esi + 1]
cdq
idiv ebx
mov esi, edx
cmp ecx, 0x1718
jb 0x404ec0
push 0x40
push 0x3000
push 0x1718
push 0
call edi
mov edi, section..data
mov edx, eax
sub edi, eax
mov esi, 0x1718
pop ebx
mov cl, byte [edi + edx]
mov byte [edx], cl
lea edx, [edx + 1]
dec esi
jne 0x404f05
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov eax, dword [0x428280]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x4282b0]
mov esi, dword [esi]
mov ecx, esi
mov eax, dword [esi]
mov dword [ebp - 4], esi
call dword [eax + 4]
lea eax, [ebp - 4]
push eax
call fcn.00401240
mov edx, dword [esi]
add esp, 4
mov ecx, esi
mov edi, eax
call dword [edx + 8]
test eax, eax
je 0x404f54
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov eax, dword [edi]
push 0xa
mov eax, dword [eax + 0x20]
mov ecx, edi
call eax
mov byte [ebp - 4], al
push dword [ebp - 4]
lea eax, [ebp - 0x34]
push eax
push 0x428280
call fcn.00401040
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.004030a0
lea ecx, [ebp - 0x1c]
call fcn.00403e80
push eax
mov ecx, 0x428350
call fcn.004017f0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404b30
mov ecx, esi
call fcn.00404680
cmp dword [ebp - 8], 0x10
jb 0x404fcb
push dword [ebp - 0x1c]
call fcn.00406b83
add esp, 4
cmp dword [ebp - 0x20], 0x10
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
jb 0x404fee
push dword [ebp - 0x34]
call fcn.00406b83
add esp, 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413f36
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040ad8f
mov dword [ebp - 0x14], eax
cmp dword [0x4293e4], edi
jne 0x414027
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x413fb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x414107
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x414107
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414107
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4293e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4293e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4293ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4293f4], eax
test eax, eax
je 0x414024
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4293f0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41404c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41403f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x414061
push 4
pop eax
jmp 0x414109
cmp dword [ebp - 0x14], edi
je 0x414061
push dword [0x4293e4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x414046
mov eax, dword [0x4293f0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4140bf
cmp dword [0x4293f4], esi
je 0x4140bf
push eax
call ebx
push dword [0x4293f4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4140bf
test eax, eax
je 0x4140bf
call ecx
test eax, eax
je 0x4140b4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4140b4
test byte [ebp - 8], 1
jne 0x4140bf
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4140ef
mov eax, dword [0x4293e8]
cmp eax, esi
je 0x4140ec
push eax
call ebx
test eax, eax
je 0x4140ec
call eax
mov edi, eax
test edi, edi
je 0x4140ec
mov eax, dword [0x4293ec]
cmp eax, esi
je 0x4140ec
push eax
call ebx
test eax, eax
je 0x4140ec
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4293e4]
call ebx
test eax, eax
je 0x414107
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x414109
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040943b
leave
ret
Function at 0x4165fe
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040e4ca
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x416636
xor eax, eax
jmp 0x416662
cmp esi, dword [ebp - 4]
je 0x41665f
cmp dword [ebp + 0xc], 0
je 0x41665f
push dword [edi + 0x9c]
call fcn.0041620c
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040b13c
pop ecx
pop ecx
cmp esi, eax
je 0x416632
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x402220
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee9ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
test eax, eax
je 0x4023e4
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x402325
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax + eax]
cmp dword [0x530b6c], 0x10
mov ecx, 0x530b58
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x530b58]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00402910
inc esi
cmp esi, 4
jl 0x4022f0
mov edx, dword [ebp - 0x1c]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x402290
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4023e4
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
cmp esi, 3
jge 0x402366
push eax
lea eax, [ebp - 0x14]
add eax, esi
push 0
push eax
call fcn.004cacb0
mov dl, byte [ebp - 0x12]
add esp, 0xc
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x402369
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4023d0
xor esi, esi
cmp dword [0x530b6c], 0x10
mov ecx, 0x530b58
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x530b58]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00402910
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x4023a3
mov esi, dword [ebp - 0x1c]
cmp esi, 3
jge 0x4023e4
push 0x3d
mov ecx, edi
call fcn.00402910
sub dword [ebp + 8], 1
jne 0x4023d5
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eec5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004b13cd
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x403a26
push eax
push esi
call fcn.004b170e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004b0cb0
int3
Function at 0x40b450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0296
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov word [ebp - 0xf], 0xfded
mov byte [ebp - 0xd], 0
nop
movzx eax, byte [ebp + ecx - 0xf]
push eax
call fcn.00459470
mov byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 2
jb 0x40b4c0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xf]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004ceb20
mov edi, eax
add esp, 8
test edi, edi
je 0x40b55c
push 2
push 0
push edi
call fcn.004d28f6
push edi
call fcn.004ce6ab
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.004d28f6
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x40b530
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b527
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x40b53f
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0045a6d0
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b549
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.004d739f
push edi
call fcn.004d23a8
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00402890
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b8c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x40b908
mov edx, ecx
push esi
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x40b8d0
sub edx, esi
pop esi
je 0x40b908
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b902
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x40b902
cmp eax, 0x20
je 0x40b902
cmp eax, 0x45
je 0x40b902
cmp eax, 0x24
jne 0x40b908
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret