joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c5b8
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040ff50
lea eax, [esp + 0x20]
push eax
call fcn.00438396
add esp, 4
test al, al
jne 0x44c5e3
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44c607
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.004143ca
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret

Function at 0x44c661
Capabilities:
Copy file
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.0040ff50
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.0040ff50
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x44c6e0
test bl, bl
je 0x44c709
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.0041455e
add esp, 8
test eax, eax
je 0x44c6d6
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.00438396
add esp, 4
test al, al
je 0x44c709
lea ecx, [esp + 0x24]
push ecx
call fcn.00438396
add esp, 4
test al, al
je 0x44c713
test bl, bl
jne 0x44c735
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.00438037
add esp, 4
test al, al
je 0x44c709
lea eax, [esp + 0x24]
push eax
call fcn.00438396
add esp, 4
test al, al
je 0x44c709
lea ecx, [esp + 0x230]
push str..
push ecx
call fcn.00412518
lea edx, [esp + 0x238]
push edx
call fcn.004143ca
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.004143ca
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x419291
Capabilities:
Encode data using xor

Disassembly:
retf 0x712b
std
insd dword es:[edi], dx
out dx, eax
jg 0x4192a1
xchg ebp, eax
xchg byte [edi - 0x71a6a211], ah
stc
bound edi, qword ds:[ebx + 0x53c0851e]
mov ebx, 0x53c0851e
sbb ebp, dword [ecx]
ja 0x41925f
and eax, 0x40b3dae6
test al, 0xa4
pop eax
sbb esp, edx
dec esp
pop esp
invalid

Function at 0x44a4a1
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [eax]
dec edi
xor bl, ah
pop edi
mov bh, byte [esi - 0x46]
dec ebx
lahf
jb 0x44a4a4
cmp dword [esp + ecx*4], eax
fsub st(6)
stosb byte es:[edi], al
pop eax
and dword [ebx - 0x3533e550], 0xffffffef
into
mov edi, 0xae286968
fnstenv [eax + 0x2a]
cmpsd dword [esi], dword es:[edi]
in al, 0x1b
rcr byte [edx], cl
salc
push dword [edx]
add al, 0x56
movsd dword es:[edi], dword [esi]

Function at 0x44a751
Capabilities:
Encode data using xor

Disassembly:
sahf
dec ebp
loop 0x44a6e0
add ch, byte [edx - 0x2c]
movsd dword es:[edi], dword [esi]
xor bh, byte [eax + 0x46]
sbb dword [eax + 0x2c56fff8], ebp
sub byte [edx], bl
sbb eax, 0xe0599477
invalid
wait
xlatb
inc edx
pop ds
mov cl, bl
out 0x14, eax
dec edi
outsd dx, dword [esi]
and dword [ebx + 0x5c], eax
dec edi
mov al, byte [0x198f0489]
cmpsd dword [esi], dword es:[edi]
test dword [edx], edx
invalid
or edx, dword [ebp - 0x5ea265c9]
dec ecx
mov eax, dword [0x7303ba4c]
sub ebx, dword [ebx + edi*8 - 0x4b]
jge 0x44a6c6
jle 0x44a73e
invalid
push es
mov eax, 0x2898808c
dec ecx
pop esi
mov word [eax + 0x5e492898], es
cwde
sub byte [ecx + 0x5e], cl
wait
sbb bl, byte [ebx + 0x4acfea04]
aam 0x17
inc edx
sub ebx, dword [eax - 0x17405aaa]
push esi
movsd dword es:[edi], dword [esi]
mov edi, 0xad2435e8
js 0x44a76a
push esi
movsd dword es:[edi], dword [esi]
mov edi, 0xad2435e8
js 0x44a76a
sub dh, al
fadd qword [eax + 0x1a]
jns 0x44a740
and dword [edi + 0x1fa329a0], eax
aad 0xf3
jp 0x44a70f
movsb byte es:[edi], byte [esi]
fnstcw word [esi]
xor esi, dword [ebx]
inc ebx
pop ds
jne 0x44a73c
adc esi, dword [edx - 9]
iretd

Function at 0x47b25d
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xe4bb8074
xor eax, 0xaccb9135
xchg ecx, eax
retf
lodsb al, byte [esi]
push eax
fisub word [esi + edx + 0x2bb4ec4b]
in al, dx
mov ah, 0x2b
mov ecx, 0x91a1d71c
jbe 0x47b246
dec dword [ebx]
xchg esp, eax
mov al, 0xb6
invalid
Function at 0x47b501
Capabilities:
Encode data using xor

Disassembly:
les esp, [edi + 0x14]
cmp eax, 0xccdf6899
cli
mov dh, byte [edi - 0x3315c82a]
and al, 6
loop 0x47b3a5
test byte [ecx + 0x41], bl
dec ecx
mov byte [0xe504e410], al
mov esi, 0xb043f6ac
push eax
push ecx
jmp 0x47b48a
xchg ebx, eax
cmc
add byte [eax + ecx - 0x3e45194c], bl
jbe 0x47b47e
xor cl, byte [edx + 0x6b]
sbb byte fs:[ecx], cl
jo 0x47b49d
dec edx
imul esp, dword [eax + ebx + 9], 0x70
dec edx
dec edx
adc dword [edi - 0x1c], esi
cmpsb byte [esi], byte es:[edi]
jo 0x47b44b
int1
pop edi
xor byte [edi + 0x531133e6], 0xbf
cmovp ecx, dword [edi + 0x22]
mov eax, dword [edx]
and eax, 0xf52fce74
or bl, byte [ebx]
popfd
xchg esi, eax
pop ecx
jmp dword [edi - 0x2b5f3c6]
jne 0x47b418
cmp bl, cl
adc eax, dword [edi]
push 0xb20c1fe6
lcall 0xa331, 0xa7e6f515
or ebx, dword [eax + edx*8]
sbb eax, 0xcbe8ec7e
jl 0x47b4b0
adc eax, 0x31a7e6f5
mov dword [0x1dd01c0b], eax
jle 0x47b482
call 0x335e3166
jne 0x47b4c5
xor esi, dword [ebp + 0x28]
sbb dword [eax - 0x426dccc7], eax
ret
xchg edi, eax
pushfd
jp 0x47b4f2
xchg esi, eax
mov bh, 0xa7
push ss
add byte [esi - 0x80], 0x18
sbb dh, byte [ebp - 0x7e]
inc esi
sbb byte [eax], 0x1a
jne 0x47b441
fcomp qword [edx - 0x18]
out dx, al
movsd dword es:[edi], dword [esi]
push ss
out dx, eax
out 0x28, eax
jle 0x47b459
fsub qword [esi]
insb byte es:[edi], dx
jns 0x47b4d1
xor byte [ecx - 0x16], bl
idiv byte [eax]
dec esp
aam 0xcd
xchg esi, eax
pop edx
lds eax, [edi - 0x43]
pop esi
mov gs, word [edx + 0x461fc855]
xchg ebp, eax
sal dword [esi - 0x5c837807], 0x79
add eax, 0xf6fb1a8c
xor byte [ebx], cl
jno 0x47b544
ljmp 0x96cd:0xd44c38f6
or esi, dword [ecx + 0x4f]
sbb dword [ebx + ebx*2], edi
invalid
jge 0x47b4b9
adc dword [eax - 0x4f], 0xc2ad672e
sub dh, byte [eax + ebp + 0x3d]
das
pop ecx
mov dh, bl
fsubr dword [edx]
xor dword [edi + 0x3434ef62], esp
adc eax, eax
xor cl, byte [ecx + 0x704ff7e1]
jns 0x47b536
inc esp
pop esp
add esi, dword [esi + 0x2c]
adc eax, 0xb607a0bb
dec edx
lds esp, [edx + 0x1ecdd34c]
dec esp
ror ebp, cl
push ds
adc esp, dword [edx - 0x1799f51d]
mov byte [0xe8660ae3], al
adc al, 0xb
aam 0x39
xor eax, 0x4d9507ba
sbb eax, 0x1916031c
in eax, 0x73
jecxz 0x47b5b0
inc ebp
adc byte [esi + 0x2e2a4f70], ch

Function at 0x494f91
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [0x1a5ae7e3]
loope 0x494fa3
pop eax
xchg esp, eax
mov gs, word [edi - 0xdc2819a]
rcl byte [ecx], 0x9c
mov ebp, dword [ebp - 0x76]
invalid
adc edi, dword [eax]
pop esi
test eax, 0x97e538c2
cmp ch, ah
xchg edi, eax
call 0x58f3467c
push ss
inc ebp
jno 0x494fb9
inc ebp
inc edi
xchg ebp, eax
pushal
daa
aam 0x78
sal al, cl
aad 0x6e
jns 0x494f96
out dx, al
xor edi, ebx
xor edi, ecx
mov esi, 0x84a18aaf
jns 0x494fcf
jge 0x494f72
int 0xbc
lodsb al, byte [esi]
mov al, byte [0xe98b53c3]
sahf
inc ebp
invalid
xchg ecx, eax
inc esp
and dl, bl
add edi, edx
lahf
cmp dword [eax], ebp
or bh, byte [eax + 0xfc40fd4]
cmp eax, dword [eax]
fldenv [edx]
invalid
Function at 0x49511d
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xc7511198
leave
outsb dx, byte [esi]
xor esi, edx
and al, byte [eax + 0x3703e2be]
mov dword [0x77076a45], eax
mov cl, 0xa8
outsb dx, byte [esi]
add bl, byte [eax]
invalid

Function at 0x4c8031
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d2400
cmp edx, dword [eax]
je 0x4c8053
add eax, 8
inc ecx
cmp eax, 0x4d2490
jl 0x4c8044
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d2400]
jne 0x4c8181
mov eax, dword [0x4d7e30]
cmp eax, 1
je 0x4c815b
test eax, eax
jne 0x4c8084
cmp dword [0x4d2328], 1
je 0x4c815b
cmp edx, 0xfc
je 0x4c8181
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c80bb
lea eax, [ebp - 0x1a4]
push 0x4cde30
push eax
call fcn.004c8a10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8ea0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c80fe
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8ea0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cde2c
push edi
call fcn.004cad70
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cde10
push eax
call fcn.004c8a10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c8a20
lea eax, [ebp - 0xa0]
push 0x4cde0c
push eax
call fcn.004c8a20
push dword [esi + 0x4d2404]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c8a20
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cdde4
push eax
call fcn.004cace4
add esp, 0x2c
pop edi
jmp 0x4c8181
lea eax, [ebp + 8]
lea esi, [esi + 0x4d2404]
push 0
push eax
push dword [esi]
call fcn.004c8ea0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41c998
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_CryptAcquireContextA
add esp, 0xc
test eax, eax
je 0x41c9d4
sub esp, 0xc
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
push dword [ebx]
call sub.ADVAPI32.DLL_CryptCreateHash
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x13c
mov eax, dword [0x404008]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionOpenWith
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push reloc.OLEAUT32.dll_SysReAllocString
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401191
mov esi, dword [esp + 8]
test esi, esi
je 0x401191
push pe_nt_image_headers32
push eax
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x1c], pe_nt_image_headers32
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x403224
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401191
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401130
sub ecx, edx
sar ecx, 1
cmp ecx, 0x26
jne 0x401191
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x401191
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x6a283fe2
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4599ecfa
push eax
push 4
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x9e8c491
push eax
mov dword [esp + 0x2c], 0x267b1357
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004012f0
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00401080
mov ebx, eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
push str..pdf
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x401232
mov edi, dword [ebx]
push 4
push esi
push dword [ebp - 4]
mov edi, dword [edi + 0xc]
mov ecx, edi
push ebx
call dword [0x403110]
call edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x403110]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00401030
int3
Function at 0x404ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x140], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404ef0
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x140]
call 0x48cbf7
mov ecx, 3
mov dword [ebp - 0x118], 0
cmp dword [ebp - 0x130], ecx
lea eax, [ebp - 0x140]
mov dword [ebp - 0x114], 0xf
cmovb ecx, dword [ebp - 0x130]
cmp dword [ebp - 0x12c], 0x10
push ecx
cmovae eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x128]
push eax
mov byte [ebp - 0x128], 0
call 0x48cc45
sub esp, 0x18
mov ecx, esp
push 0x431cdc
call 0x48c8f4
lea ecx, [ebp - 0x158]
call 0x47b87f
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call 0x48cdbd
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x404fbf
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404fb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405057
push edx
push ecx
call 0x48e265
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x405010
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405006
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405057
push edx
push ecx
call 0x48e2b6
add esp, 8
mov edx, dword [ebp - 0x144]
cmp edx, 0x10
jb 0x405046
mov ecx, dword [ebp - 0x158]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40503c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405057
push edx
push ecx
call 0x48e2ec
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call 0x48dc8a
mov esp, ebp
pop ebp
ret
call 0x491753
int3
Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x4034e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40357c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40355c
xor eax, eax
push ebp
push 0x403555
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403598
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40355c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46b020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404278
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46d048], 0
je 0x4042d9
cmp word [0x46d21c], 0xd7b2
jne 0x4042a1
cmp dword [0x46d224], 0
jbe 0x4042a1
mov eax, 0x46d218
call dword [0x46d234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46b06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404300
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46b030], 0
jne 0x4042f5
push 0
push 0x46b064
push 0x46b06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40607c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4060e2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040466c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030a8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4060cc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060e9
lea eax, [ebp - 0x10]
call fcn.004043fc
ret

Function at 0x40b668
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b6a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044ec
jmp 0x40b6aa
mov eax, ebx
mov edx, esi
call fcn.00404450
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b6b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b6d5
mov al, byte [esp]
jmp 0x40b6d7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bd6c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bbd4
mov eax, dword [0x46c454]
cmp byte [eax], 0
je 0x40bde8
mov eax, dword [0x46c250]
call fcn.00402f14
call fcn.00402bcc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d08
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40be30
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40be1e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46c1f4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46d664]
call fcn.004054e8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c68c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c762
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404494
lea eax, [ebp - 8]
call fcn.0040490c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048bc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c74c
mov eax, ebx
call fcn.00402a40
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c745
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048bc
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c72f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c774
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c72f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c74c
mov eax, dword [ebp - 0x10]
call fcn.00402a70
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c769
lea eax, [ebp - 8]
call fcn.004043fc
ret

Function at 0x40cd48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cdac
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040466c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408790
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cdb3
lea eax, [ebp - 0xc]
call fcn.004043fc
ret

Function at 0x41b1bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46d884
cmp dword [edi], 0
jne 0x41b238
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46d880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46b46c
mov ecx, 2
call fcn.00402c60
mov edx, 0x41b194
lea eax, [esi + 5]
call fcn.0041b1b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b1b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b20d
mov dword [0x46d880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c7f4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c7fa
ret