joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d150
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4a75f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0049a8ec
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x53c450
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x53c398
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4a9080]
push eax
mov ecx, edi
call fcn.0049ff82
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004a1598
test eax, eax
je 0x45d26c
mov ecx, dword [esp + 0x3c]
call fcn.0049ffaf
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4a95c4]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45d230
push edi
mov ecx, esi
call fcn.0049d617
mov ecx, esi
call fcn.0045d410
cmp dword [esp + 0x38], 1
jne 0x45d265
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0049d752
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x45f450
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45f483
push esi
call fcn.0046d810
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45f47c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45f509
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45f4f2
mov eax, dword [esi + 8]
test eax, eax
je 0x45f4a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45f4ee
cmp eax, 2
je 0x45f4f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45f49a
cmp eax, 3
je 0x45f4cd
cmp eax, 1
jne 0x45f49a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45f49a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45f49a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045f530
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45f518
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045f530
add esp, 4
pop esi
ret
Function at 0x5e8acf
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e8aea
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124add0f]
pop edx
test eax, eax
je 0x5e8bbc
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e8bab
test dword [ebp - 0x2a8], 1
jne 0x5e8bab
and dword [ebp - 0x2a8], 0x100
jne 0x5e8bab
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3860]
pop edx
pop esi
test eax, eax
je 0x5e8b4e
jmp 0x5e8bab
cmp word [esi], 0x5a4d
jne 0x5e8bab
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e8bab
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3a30]
pop edx
test eax, eax
je 0x5e8bab
lea eax, [ebp - 0x28c]
push eax
call fcn.005e8a2b
test eax, eax
jne 0x5e8ba4
jmp 0x5e8bab
mov eax, esi
jmp 0x5e8bbc
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e8aea
pop esi
leave
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x10005da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034aa1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e8
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x1f3]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x1f4], 0
call fcn.10014a20
add esp, 0xc
lea eax, [ebp - 0x34]
add edi, 0x4140
mov edx, 0x5c
mov esi, 0x6c
push eax
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x60], 0
mov byte [edi], 0
mov dword [ebp - 0x1e], 0x690061
mov dword [ebp - 0x18], 0x2e0079
mov dword [ebp - 0x2a], 0x610062
mov dword [ebp - 0x22], 0x64005c
mov dword [ebp - 0x26], 0x650073
mov dword [ebp - 0x32], 0x610044
mov word [ebp - 0x1a], si
mov dword [ebp - 0x14], 0x6c0063
mov word [ebp - 0x34], dx
mov dword [ebp - 0x10], 0x64
mov dword [ebp - 0x2e], 0x610074
call fcn.10009330
mov esi, eax
push 0x100603c8
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call fcn.10009330
push esi
push eax
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 1
call fcn.10007b70
add esp, 0xc
lea ecx, [ebp - 0xdc]
call fcn.10009780
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 4
call fcn.10009780
lea ecx, [ebp - 0x7c]
call fcn.1000c5a0
push eax
call fcn.1000ee70
add esp, 4
test eax, eax
jne 0x10005f6d
mov word [ebp - 0x36], ax
mov eax, 0x5c
mov word [ebp - 0x5c], ax
mov eax, 0x63
mov word [ebp - 0x3c], ax
mov eax, 0x73
mov word [ebp - 0x4e], ax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x48], 0x610064
mov dword [ebp - 0x3a], 0x640076
mov dword [ebp - 0x4c], 0x5c0065
mov dword [ebp - 0x40], 0x2e0079
mov dword [ebp - 0x5a], 0x610044
mov dword [ebp - 0x56], 0x610074
mov dword [ebp - 0x44], 0x6c0069
mov dword [ebp - 0x52], 0x610062
call fcn.10009330
mov esi, eax
push 0x100603c8
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 5
call fcn.10009330
push esi
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 6
call fcn.10007b70
add esp, 0xc
lea ecx, [ebp - 0x7c]
push eax
call fcn.10009950
lea ecx, [ebp - 0x94]
call fcn.10009780
lea ecx, [ebp - 0xc4]
call fcn.10009780
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 4
call fcn.10009780
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x7c]
call fcn.1000c5a0
push eax
call fcn.1000edb0
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x10005fe0
push 0
lea eax, [ebp - 0x60]
push eax
push 0x100
lea eax, [ebp - 0x1f4]
push eax
push esi
call dword [0x1006066c]
push esi
call fcn.1000ecf0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1d1]
push 0x100367ec
push eax
call fcn.1001262c
add esp, 0x10
test eax, eax
je 0x10005fe0
push 0xffffffffffffffff
push eax
push 0x10
push edi
call fcn.10012588
add esp, 0x10
lea ecx, [ebp - 0x7c]
call fcn.10009780
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40f380
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x6d7470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x6d746c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x6d7470], edx
cmp eax, 0x26f
jl 0x40f388
mov dword [0x5f40a0], 0x270
ret

Function at 0x40f3c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x6d7474]
mov ebx, dword [eax*4 + 0x6d7470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6d7aa4]
mov dword [eax*4 + 0x6d7470], edx
cmp eax, 0xe2
jl 0x40f3c8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x6d7474]
mov ebx, dword [eax*4 + 0x6d7470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6d70e4]
mov dword [eax*4 + 0x6d7470], edx
cmp eax, 0x26e
jl 0x40f418
mov edx, dword [0x6d7470]
mov ecx, dword [0x6d7e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x6d7aa0]
mov dword [0x6d7e2c], eax
mov dword [0x5f40a0], 0
pop ebx
ret

Function at 0x40f4a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x5f40a0]
add dword [0x5f40a0], 1
mov eax, dword [0x6d6020]
cmp eax, dword [0x5f37f0]
jne 0x40f4c3
cmp ebx, 0x271
jb 0x40f4e4
mov eax, dword [0x6d6020]
call fcn.0040f380
not dword [0x6d6020]
mov eax, dword [0x6d6020]
mov dword [0x5f37f0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40f500
call fcn.0040f3c0
xor ebx, ebx
mov dword [0x5f40a0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x6d7470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410ff0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x5f3530]
cmp ax, 0xcb
je 0x4110fc
cmp ax, 0xcc
je 0x4110fc
lea esi, [esi]
mov edx, dword [0x6d8070]
test edx, edx
je 0x411025
mov eax, dword [0x6d7f20]
call edx
mov ebx, eax
jmp 0x41102a
mov ebx, 0x6d7f24
cmp word [0x6d7f10], 0
jle 0x411050
mov eax, 0x6d7ef0
call fcn.004112b0
mov eax, ebx
call fcn.00410bb0
mov eax, ebx
call fcn.00410c20
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x411072
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41106d
mov edx, edi
mov eax, ebx
call fcn.00410020
jmp 0x411070
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x411058
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x6d7f10], 0
jle 0x4110fc
mov edx, 0x6d7e30
mov eax, ebx
call fcn.00410160
mov edi, eax
test edi, edi
je 0x4110cc
mov eax, dword [0x6d7ec4]
mov dword [edi + 0xc], eax
cmp dword [0x6d7ec4], 0
je 0x4110c0
mov eax, dword [0x6d7ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x6d7ec4], eax
nop
sub word [0x6d7f10], 1
cmp word [0x6d7f10], 0
sete bl
mov eax, 0x6d7ef0
call fcn.004112d0
test bl, bl
je 0x4110fc
mov eax, 0x6d7ef0
call fcn.004112a0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x413be0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x6d7260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413dc0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x6d7260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403680
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5f35b0], eax
mov ebx, eax
jmp 0x413d83
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413c68
cmp byte [ebx], 0
je 0x413d8c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413ce3
mov al, byte [ebx]
cmp al, 1
jb 0x413cd8
sub al, 0x20
jbe 0x413ca8
sub al, 2
je 0x413cbc
jmp 0x413cd8
mov al, byte [ebp - 0x114]
test al, al
je 0x413ce8
add dword [ebp - 0x110], 1
jmp 0x413ce0
cmp byte [ebx + 1], 0x22
je 0x413cd3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413ce0
add ebx, 1
jmp 0x413ce0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413c98
test dword [ebp - 0x10c], 0xffffffff
je 0x413d7c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413dc0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x6d7260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413d73
mov al, byte [ebx]
cmp al, 1
jb 0x413d68
sub al, 0x20
jbe 0x413d38
sub al, 2
je 0x413d4c
jmp 0x413d68
mov al, byte [ebp - 0x114]
test al, al
je 0x413d78
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413d70
cmp byte [ebx + 1], 0x22
je 0x413d63
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413d70
add ebx, 1
jmp 0x413d70
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413d28
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413c6b
mov ebx, dword [ebp - 0x10c]
mov dword [0x6d7250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x6d7260
call fcn.00410e30
mov eax, dword [0x6d7260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x43019c
mov eax, 0x6d72f0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4301af
and eax, 0x10
sete al
jmp 0x4301b1
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4301c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x4301cc
mov eax, 0x6d72f0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4301df
and eax, 0x10
seta al
jmp 0x4301e1
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x430450
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
test eax, eax
jne 0x43045e
mov eax, 0x6d72f0
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x43046c
xor ebx, ebx
jmp 0x430473
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430970
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040de90
call fcn.00404010
push eax
test eax, eax
jne 0x430a2c
xor ebx, ebx
add ebx, 1
lea eax, [ebx*4 + 0x6d883c]
xor edx, edx
call fcn.00408a30
mov dword [ebx*4 + 0x6d885c], 0xffffffff
cmp ebx, 7
jl 0x4309a0
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x430a2c
lea esi, [esi]
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00409410
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.00426c80
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x430a2c
push 4
push ebx
push esi
mov eax, 0x430840
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x4308d0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
call fcn.0040e100
lea eax, [ebp - 0x38]
call fcn.00403b50
pop eax
test eax, eax
je 0x430a43
call fcn.0040e230
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431160
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040de90
call fcn.00404010
push eax
test eax, eax
jne 0x43128d
mov eax, ebx
lea edx, [ebp - 0x34]
call fcn.004263e0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00408a30
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.0040a060
mov eax, dword [ebp - 0x40]
xor edx, edx
call fcn.00408a30
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x44], eax
mov ebx, eax
jmp 0x43127c
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.00409370
mov eax, dword [ebp - 8]
test eax, eax
je 0x431207
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.0040a060
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.00409990
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00409830
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.004263e0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.004095d0
test eax, eax
jne 0x431274
push dword [ebp - 0x40]
mov eax, dword [ebp - 8]
test eax, eax
je 0x431263
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.00409830
jmp 0x431285
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x4311f0
push dword [ebp - 0x44]
call sub.kernel32.dll_FreeEnvironmentStringsA
call fcn.0040e100
lea eax, [ebp - 0x3c]
call fcn.00403b50
lea eax, [ebp - 0x38]
call fcn.00403b50
lea eax, [ebp - 0x34]
call fcn.00403b50
lea eax, [ebp - 4]
call fcn.00403b50
lea eax, [ebp - 8]
call fcn.00403b50
pop eax
test eax, eax
je 0x4312c4
call fcn.0040e230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4312d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040de90
call fcn.00404010
push eax
test eax, eax
jne 0x4313c5
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.0040af60
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042cef0
jmp 0x4313b8
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040af10
mov edx, dword [ebp - 4]
mov ecx, 1
mov al, 0x3d
call fcn.0040b9c0
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx - 1]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b7f0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0042cef0
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040b5c0
test eax, eax
jne 0x4313a8
push dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x431396
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.0040b7f0
jmp 0x4313bf
mov eax, esi
call fcn.00404780
shl eax, 1
add eax, esi
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x431340
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040e100
lea eax, [ebp - 0x38]
call fcn.0040ac60
lea eax, [ebp - 0x34]
call fcn.0040ac60
lea eax, [ebp - 4]
call fcn.0040ac60
lea eax, [ebp - 8]
call fcn.0040ac60
pop eax
test eax, eax
je 0x4313f4
call fcn.0040e230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431c50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov edx, eax
mov ebx, dword [edx + 0x30]
mov eax, 0xdeadbeef
mov ecx, dword [edx + 0x34]
mov edx, ecx
shr edx, 0x1f
add ecx, edx
sar ecx, 1
sub ecx, 1
test ecx, ecx
jl 0x431c88
mov esi, 0xffffffff
lea esi, [esi]
add esi, 1
movzx edx, word [ebx + esi*2]
xor eax, edx
add eax, 0xc
cmp ecx, esi
jg 0x431c78
pop esi
pop ebx
ret

Function at 0x431cd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
mov edx, eax
mov ebx, dword [edx + 0x30]
mov eax, 0xcececece
mov ecx, dword [edx + 0x34]
mov edx, ecx
shr edx, 0x1f
add ecx, edx
sar ecx, 1
sub ecx, 1
test ecx, ecx
jl 0x431d08
mov esi, 0xffffffff
lea esi, [esi]
add esi, 1
movzx edx, word [ebx + esi*2]
xor eax, edx
sub eax, 0x4d
cmp ecx, esi
jg 0x431cf8
pop esi
pop ebx
ret
Function at 0x43c180
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x43c22a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x43c246
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x43c246
sub dx, 0x20
je 0x43c220
sub dx, 0x80
je 0x43c220
sub dx, 0x1f62
jb 0x43c246
sub dx, 1
jbe 0x43c220
sub dx, 6
je 0x43c220
sub dx, 0x26
jne 0x43c246
nop
jmp 0x43c220
cmp eax, dword [ebp - 0x20]
jg 0x43c1c8
lea esi, [esi]
jmp 0x43c246
cmp dword [ebp - 0x1c], 2
jne 0x43c23a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x43c246
mov al, byte [ebp - 0xc]
call fcn.0040b250
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x43c2c4
sub ax, 0x21
je 0x43c2d8
sub ax, 0x17
je 0x43c2e4
sub ax, 0x222
je 0x43c2f0
sub ax, 0x392
je 0x43c2f8
sub ax, 1
je 0x43c300
sub ax, 0x1996
je 0x43c308
sub ax, 1
je 0x43c310
sub ax, 6
je 0x43c318
sub ax, 0xb
je 0x43c328
sub ax, 0x1b
je 0x43c320
sub ax, 0x367
je 0x43c330
jmp 0x43c338
mov ax, word [ebp - 0x24]
call fcn.0040b2f0
mov byte [ebp - 0x10], al
jmp 0x43c340
mov byte [ebp - 0x10], 0x20
jmp 0x43c340
mov byte [ebp - 0x10], 0x2e
jmp 0x43c340
mov byte [ebp - 0x10], 0x27
jmp 0x43c340
mov byte [ebp - 0x10], 0x2c
jmp 0x43c340
mov byte [ebp - 0x10], 0x27
jmp 0x43c340
mov byte [ebp - 0x10], 0x20
jmp 0x43c340
mov byte [ebp - 0x10], 0x20
jmp 0x43c340
mov byte [ebp - 0x10], 0x20
jmp 0x43c340
mov byte [ebp - 0x10], 0x20
jmp 0x43c340
mov byte [ebp - 0x10], 0x2d
jmp 0x43c340
mov byte [ebp - 0x10], 0x27
jmp 0x43c340
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x44ea70
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x44ea8c
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret