joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a9c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408b9f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x467b88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x467ba0]
jne 0x408ae8
mov eax, esi
mov edx, 0x467ba2
mov ecx, 0x55
call fcn.00407174
push 0x467b88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408b89
push 0x467b88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.004066b8
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408b57
cmp byte [0x467b84], 0
je 0x408b1c
mov edx, esi
mov eax, ebx
call fcn.00408980
jmp 0x408b57
mov edx, esi
mov eax, ebx
call fcn.00408784
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408b57
cmp dword [esi], 0
je 0x408b40
mov eax, esi
mov edx, 0x408bb8
call fcn.004072cc
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408784
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004072cc
push 0x467b88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x467ba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.004070e0
push eax
push 0x467ba2
call sub.kernel32.dll_lstrcpynW
push 0x467b88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ba6
lea eax, [ebp - 4]
call fcn.004066b8
ret
Function at 0x408dd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040679c
xor eax, eax
push ebp
push 0x408ff9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408e14
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408e2e
push 0x105
mov eax, dword [ebp - 4]
call fcn.004070e0
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408fe3
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409008
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408efd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409008
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408efd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409044
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408efd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409044
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408efd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409078
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408efd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4090ac
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408fe3
xor eax, eax
push ebp
push 0x408fdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408be0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408f6c
mov eax, dword [ebp - 0x10]
call fcn.004045a4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407138
jmp 0x408fb7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4090ec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408fb7
mov eax, dword [ebp - 0x10]
call fcn.004045a4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4090ec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408fe3
cmp dword [ebp - 8], 0
je 0x408fd2
mov eax, dword [ebp - 8]
call fcn.004045c0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409000
lea eax, [ebp - 4]
call fcn.004066b8
ret
Function at 0x4092dc
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040679c
xor eax, eax
push ebp
push 0x40939c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407174
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407324
mov eax, dword [ebx]
call fcn.004091a4
test al, al
jne 0x409379
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407174
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407324
mov eax, dword [ebx]
call fcn.004091a4
test al, al
jne 0x409379
mov eax, ebx
call fcn.004066b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093a3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406718
lea eax, [ebp - 4]
call fcn.004066b8
ret

Function at 0x409dac
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x418610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x418669
test eax, edx
je 0x41866c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x418627
movzx eax, word [eax]
sub eax, ecx
jmp 0x41864e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41864f
add ecx, 4
js 0x41863f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41864c
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41864e
xor eax, eax
ret
test eax, eax
je 0x418678
test edx, edx
jne 0x418618
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x418b8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov byte [esp], 0
mov eax, ebp
test eax, eax
je 0x418ba4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x418bac
mov al, 1
jmp 0x418bc9
movzx esi, word [ebp]
mov eax, esi
call fcn.0040b224
test al, al
jne 0x418bc5
cmp si, 0x5f
je 0x418bc5
xor eax, eax
jmp 0x418bc7
mov al, 1
xor al, 1
test al, al
jne 0x418c59
test bl, bl
je 0x418c19
mov eax, ebp
test eax, eax
je 0x418be0
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x418c55
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0040b2b0
test al, al
jne 0x418c0d
cmp di, 0x5f
je 0x418c0d
cmp di, 0x2e
je 0x418c0d
xor eax, eax
jmp 0x418c0f
mov al, 1
test al, al
je 0x418c59
inc esi
dec ebx
jne 0x418bed
jmp 0x418c55
mov eax, ebp
test eax, eax
je 0x418c24
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x418c55
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0040b2b0
test al, al
jne 0x418c4b
cmp di, 0x5f
je 0x418c4b
xor eax, eax
jmp 0x418c4d
mov al, 1
test al, al
je 0x418c59
inc esi
dec ebx
jne 0x418c31
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41d380
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41d3b9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406810
jmp 0x41d3c2
mov eax, ebx
mov edx, esi
call fcn.00406a68
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41d3cc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41d3ee
movzx eax, word [esp]
jmp 0x41d3f0
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41e0c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41e1e9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041decc
mov esi, eax
mov eax, dword [0x464ba0]
cmp byte [eax], 0
je 0x41e191
mov eax, dword [0x464960]
call fcn.00404920
call fcn.004046f8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41e094]
call fcn.00408204
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41e204
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41e1cd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x464904]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x467c50]
call fcn.004082c8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e1f0
lea eax, [ebp - 4]
mov edx, dword [0x41e094]
call fcn.00408210
ret

Function at 0x41fa80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406b84
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00409d8c
mov edi, eax
cmp edi, 0x104
jbe 0x41fa27
mov eax, edi
add eax, eax
call fcn.004045a4
mov esi, eax
jmp 0x41fa29
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00409d8c
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41fa64
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41fa4e
mov eax, esp
cmp esi, eax
je 0x41fa71
mov eax, esi
call fcn.004045c0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41faac
cmp bl, 0
je 0x41faa8
cmp bl, 0x41
jl 0x41faa3
cmp bl, 0x5a
jg 0x41faa3
or bl, 0x20
xor al, bl
inc esi
jmp 0x41fa87
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41f9e8

Function at 0x420294
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407174
add esp, 0x800
pop ebx
ret
Function at 0x451028
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x45108c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00407174
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.004192a8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451093
lea eax, [ebp - 0x14]
call fcn.004066b8
ret

Function at 0x4528a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4528b5
add esp, 0xfffffff0
call fcn.00405414
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00404dec
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00406a68
mov eax, esi
call fcn.004070e0
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x452909
mov ecx, dword [0x464bfc]
mov dl, 1
mov eax, dword [0x452470]
call fcn.0044a800
call fcn.00405e20
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452930
call fcn.0040546c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x454488
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45453e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.004070e0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x454528
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040724c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.004070e0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x454528
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x454550
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x454528
cmp dword [ebp - 0xc], 0x34
jne 0x454528
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454545
lea eax, [ebp - 4]
call fcn.004066b8
ret
Function at 0x4579c8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457bc8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00454b74
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x4647c4], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4647c8], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4647cc], eax
mov eax, dword [0x464ce8]
cmp dword [eax], 2
sete byte [0x463fa5]
push 0x457bd4
call sub.kernel32.dll_GetModuleHandleW_1
lea edx, [ebp - 4]
call fcn.00454274
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x463fa5], 0
jne 0x457a57
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00454488
test al, al
je 0x457a57
mov eax, dword [ebp - 0x4c]
mov dword [0x4eb598], eax
jmp 0x457a5e
xor eax, eax
mov dword [0x4eb598], eax
call fcn.004576a4
and eax, 0x7f
cmp eax, 0x14
ja case.0x457a6f.0
jmp dword [eax*4 + 0x457a76]
mov byte [0x463fa0], 1
jmp case.0x457a6f.0
mov byte [0x463fa1], 1
jmp case.0x457a6f.0
mov byte [0x463fa2], 1
jmp case.0x457a6f.0
mov byte [0x463fa3], 1
jmp case.0x457a6f.0
mov byte [0x463fa4], 1
jmp case.0x457a6f.0
mov byte [0x463fa6], 1
mov byte [0x463fa7], 1
jmp case.0x457a6f.0
mov byte [0x463fa6], 1
mov byte [0x463fa8], 1
jmp case.0x457a6f.0
mov byte [0x463fa6], 1
mov byte [0x463fa8], 1
mov byte [0x463fa9], 1
jmp case.0x457a6f.0
mov byte [0x463faa], 1
jmp case.0x457a6f.0
mov byte [0x463fab], 1
jmp case.0x457a6f.0
mov byte [0x463fac], 1
jmp case.0x457a6f.0
mov byte [0x463fad], 1
jmp case.0x457a6f.0
mov byte [0x463fae], 1
jmp case.0x457a6f.0
mov byte [0x463faf], 1
jmp case.0x457a6f.0
mov byte [0x463fb0], 1
jmp case.0x457a6f.0
mov byte [0x463fb1], 1
jmp case.0x457a6f.0
mov byte [0x463fb2], 1
jmp case.0x457a6f.0
mov byte [0x463fb3], 1
jmp case.0x457a6f.0
mov byte [0x463fb4], 1
jmp case.0x457a6f.0
mov byte [0x463fb5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457bcf
lea eax, [ebp - 4]
call fcn.004066b8
ret

Function at 0x4582d4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp eax, 1
sbb eax, eax
inc eax
cmp dword [esp + 0x10], 2
sete byte [0x4eb5b1]
cmp dword [esp + 4], 6
setae byte [0x4eb5b0]
add esp, 0x114
ret
Function at 0x4027f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov edi, eax
mov eax, dword [esi + 4]
bswap eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebx + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x402814
mov ebx, dword [ebp + 8]
mov edx, 0xfd1228e0
mov esi, 0x20
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx - 0x57e89147]
sub edi, ecx
sub esi, 1
jne 0x402830
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4059fb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
leave
ret

Function at 0x405cb1
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
leave
ret

Function at 0x40d01f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x40d038
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40d057
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40d04e
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40d046
mov eax, ebx
leave
ret

Function at 0x40d099
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x40d0bb
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x40d0c7
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x40d116
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40d102
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x40d0ec
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40f1aa
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x40f1c3
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40f1e2
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40f1d9
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40f1d1
mov eax, ebx
leave
ret

Function at 0x40f224
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x40f246
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x40f252
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x40f2a1
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40f28d
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x40f277
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4106f7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4107aa
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]