joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6234e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0062fe0a
or dword [edi], esi
mov bl, 0xdd
xchg ebx, eax
and bl, byte [ebx]
add edi, dword [ebx]
sbb dword [ecx], ebx
das
pop es
pushfd
cld
mov bh, 0xb2
fdivr st(0)
adc al, 0x13
das
cmp al, 0xbe
push ds
jmp 0x6208a6
mov esi, 0x5f4f1cff
inc ecx
cmp al, 0x9a
xlatb
mov ecx, 0x7f876d3e
sub al, 0x86
pop edi
pushfd
sar dh, 0x86
or eax, 0x13ceeffd
imul ebx, dword [edi + 1], 0xc758c847
sub edx, dword [esi - 0x4264b111]
xor byte [ebx - 0x80], cl
xchg dword [edi - 0x54], ebp
push es
mov ecx, dword [esi - 0x76e8b901]
push ebx
int3
sets ah
cwde
sbb ah, dl
dec ah
push ebp
lahf
rcl ah, cl
mov ebp, esp
aaa
xor ah, dh
mov ah, 0x17
sub esp, 0x10
btr eax, 0xa
clc
push esi
rcl ax, cl
push edi
xor ax, 0x8ed8
push ebx
lahf
lahf
clc
neg ax
push edx
stc
stc
mov eax, dword [ebp + 8]
cmc
jnp 0x62087f
stc
test eax, eax
pushal
lea esp, [esp + 0x20]
je 0x62c22b
sbb dx, 0x2281
rcr dl, cl
pushal
neg dl
mov esi, dword [eax + 0x3c]
movzx edx, bl
xor dh, 0xdd
add esi, eax
neg dh
dec dl
cmp al, 0x32
shr dl, 6
mov edx, dword [esi + 0x78]
clc
push esp
bt bx, di
test edx, edx
call fcn.00547c76
add byte [eax], al
inc edi
je 0x6234b7
outsd dx, dword [esi]
jb 0x6234d9
jb 0x6234e6
jne 0x6234e7
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [ebx + 0x72], al
popal
je 0x6234ee
push ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [edx + eax*2 + 0x72], 0x687375
add byte [eax], al
push edx
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x656c6150
je 0x623517
add byte gs:[ebp - 0x1cc71701], al
invalid
dec edi
inc edx
jb 0x623551
jae 0x623546
dec edi
jb 0x623548
inc ebp
js 0x6234e4
pushfd
lea esp, [esp + 0x50]
and al, 0x50
and al, 0x50
ja 0x547ec4
invalid
clc
call fcn.00549594
add byte [eax], al
inc edi
je 0x62353e
ror byte [0x99e387a9], cl
test eax, 0xf099e387
shr dword [eax + edx*2 + 0x3b], 0x4b

Function at 0x62d0a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx cx, cl
not ecx
mov ecx, dword [edx + 0x18]
pushfd
push 0xd613dcad
cmp ecx, dword [ebp - 8]
call fcn.0062f27d

Function at 0x62d21a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x167a0509
cmp dx, 0xad41
Function at 0x62d8d2
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0x9acfee25
add ecx, edx
pushal
sub esp, 0xffffffd8
jge 0x62d9a3
cmp dh, cl
pushfd
mov dword [ebp - 0x10], ecx
mov ch, bh
btc cx, bx
mov ecx, dword [ebp + 0xc]
test ebp, 0x7348e94
clc
cmp ecx, 0xffff
jmp 0x549792
bt di, dx
clc
mov dword [ebp - 0x10], ecx
or cx, bx
pushal
mov ecx, dword [ebp + 0xc]
mov byte [esp], al
test bh, ch

Function at 0x62e62b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x62e612
movzx ax, al
sub edx, edx
bts eax, 0x1b
push 0xdee446ab
mov eax, edx
add esp, 4
mov byte [esp + 4], 0xea
lea esp, [esp + 0x60]
ja 0x62d4d6
call 0x622521
call fcn.0054845b
btc bx, sp
shld bx, si, cl
mov ebx, eax
cmc
clc
cmc
pushfd
cmp byte [edi], 0x23
push dword [esp]
lea esp, [esp + 8]
jne 0x54be70
sar al, 3
inc ah
jmp 0x62d4e2

Function at 0x62f229
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bt sp, 2
test bh, ah
add edx, eax
pushal
mov byte [esp + 0x10], 0x2f
mov byte [esp], cl
lea esp, [esp + 0x28]
jmp 0x62d4f6

Function at 0x632941
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
ja 0x62d0ce
call fcn.0054971c
adc bl, bh
jg 0x632974
jmp 0x63298e
push ebp
sal byte fs:[ebx], 1
shr dword [edi], 0x76
adc eax, dword [ebx - 0x76c5b92f]
enter 0xffffffffffffa164, 0x61
add eax, 0xdd750b9e
invalid
aam 0x79
mov esp, 0xe7c31ec1
xchg esi, eax
jp 0x63295d
and eax, 0x5d65a9d
movsd dword es:[edi], dword [esi]
arpl cx, bx
push ebx
xchg byte [edx + 0x1eb67ddf], bh
push ds
fistp qword [ebx - 0x30]
shl dword ss:[edx], 0x50
test eax, 0x78b61c80
ljmp 0xa101

Function at 0x632af1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0xe7
lea esp, [esp + 8]
ja 0x62d4d6
push 0xe73035e0
lea esp, [esp + 4]
jb 0x5478ca
bt si, 2
cmc
clc
cmp byte [edi - 1], 0
call fcn.0062d187
Function at 0x4031d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41b008], 0x8088405
inc edx
mov dword [ebx + 0x41b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403804
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41b024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40389c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40387c
xor eax, eax
push ebp
push 0x403875
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40387c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x41b024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41b024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404718
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41c04c], 0
je 0x404779
cmp word [0x41c328], 0xd7b2
jne 0x404741
cmp dword [0x41c330], 0
jbe 0x404741
mov eax, 0x41c324
call dword [0x41c340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41b030], 0
jne 0x404795
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406e5c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00406e48
add esp, 0x208
pop ebx
ret

Function at 0x40be58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40be91
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00405118
jmp 0x40be9a
mov eax, ebx
mov edx, esi
call fcn.00404fdc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bea4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40bec6
movzx eax, word [esp]
jmp 0x40bec8
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x40c775
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0040c464
mov esi, eax
mov eax, dword [0x41bd58]
cmp byte [eax], 0
je 0x40c71d
mov eax, dword [0x41bc6c]
call fcn.0040326c
call fcn.0040305c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40c62c]
call fcn.00405e68
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x40c790
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c759
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x41bc4c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41eb48]
call fcn.00405f20
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c77c
lea eax, [ebp - 4]
mov edx, dword [0x40c62c]
call fcn.00405e74
ret
Function at 0x40e00f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404bd0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40e032
mov eax, edi
add eax, eax
call fcn.00402ef4
mov esi, eax
jmp 0x40e034
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40e06d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40e057
mov eax, esp
cmp esi, eax
je 0x40e07a
mov eax, esi
call fcn.00402f10
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40e0b4
cmp bl, 0
je 0x40e0b0
cmp bl, 0x41
jl 0x40e0ab
cmp bl, 0x5a
jg 0x40e0ab
or bl, 0x20
xor al, bl
inc esi
jmp 0x40e08f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40dff4

Function at 0x413890
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4138d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004137a0
mov eax, dword [ebp - 4]
call fcn.00405068
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4138dd
lea eax, [ebp - 4]
call fcn.00404fcc
ret

Function at 0x413af4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x413b8b
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x413b3f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00405118
jmp 0x413b75
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x413b58
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405030
jmp 0x413b6b
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004139b4
mov ebx, eax
test esi, esi
je 0x413b6b
dec esi
jmp 0x413b46
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413b92
lea eax, [ebp - 4]
call fcn.00404fcc
ret

Function at 0x413b9c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00409184
add esp, 0x208
pop ebx
ret

Function at 0x413bfc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00409184
add esp, 0x208
pop ebx
ret
Function at 0x413d74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x413eb1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x413e9b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x413dd1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x413e9b
cmp dword [ebp - 0x14], 0
jne 0x413de8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404fdc
mov bl, 1
jmp 0x413e9b
cmp dword [ebp - 0x14], 0x70000000
jb 0x413df6
call fcn.0040c7bc
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00405118
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004057f0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x413d9a
test eax, eax
jne 0x413e9b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x413e44
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x413e9b
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x413e4c
dec esi
test esi, esi
je 0x413e60
lea eax, [ebp - 4]
call fcn.00404a90
cmp word [eax + esi*2 - 2], 0
je 0x413e4b
cmp dword [ebp - 0x10], 7
jne 0x413e6b
test esi, esi
je 0x413e6b
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405244
cmp dword [ebp - 0x10], 7
jne 0x413e8e
test esi, esi
je 0x413e8e
lea eax, [ebp - 4]
call fcn.004057f0
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404fdc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413eb8
lea eax, [ebp - 4]
call fcn.00404fcc
ret
Function at 0x413fe4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x41bac0
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4141aa
xor eax, eax
push ebp
push 0x4141a3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4141b4
push 0x4141e0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00406bc0
mov ebx, eax
test ebx, ebx
je 0x414065
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x41418c
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x41418c
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4140b6
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x414097
call fcn.0040428c
jmp 0x4141aa
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4140b6
call fcn.0040428c
jmp 0x4141aa
xor eax, eax
push ebp
push 0x414185
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4140f9
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x4140f9
call fcn.0040428c
call fcn.0040428c
jmp 0x4141aa
mov eax, dword [ebp - 0x14]
call fcn.00402ef4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x41412b
call fcn.0040428c
call fcn.0040428c
jmp 0x4141aa
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x414166
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x414162
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x414162
mov byte [ebp - 1], 1
jmp 0x414166
inc ebx
dec esi
jne 0x414138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41418c
mov eax, dword [ebp - 0x18]
call fcn.00402f10
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4141aa
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414b70
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x420e74
mov eax, esi
mov edx, 8
test al, 1
je 0x414b8c
shr eax, 1
xor eax, 0xedb88320
jmp 0x414b8e
shr eax, 1
dec edx
jne 0x414b7f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x414b78
pop esi
ret
Function at 0x414ba4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x420e70], 0
jne 0x414bc7
call fcn.00414b70
push 1
push 0x420e70
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x414bf2
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x420e74]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x414bcd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4166b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00416668
test al, al
jne 0x4166d5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x416721
xor eax, eax
push ebp
push 0x416711
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405068
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416718
lea eax, [ebp - 0xc]
call fcn.004166a4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416e94
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x416ead
xor eax, eax
jmp 0x416f01
lea eax, [esp + 8]
push eax
push 0x416f08
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x416ef2
xor eax, eax
jmp 0x416f01
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x416f30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x416f8a
inc esi
xor edi, edi
cmp edi, 1
jne 0x416f56
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x416f64
cmp edi, 1
jle 0x416f64
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004166b4
test eax, eax
jne 0x416f8a
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x416f8a
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x416f8a
inc edi
dec esi
jne 0x416f46
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x416f94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x416fb8
mov eax, dword [ebp - 4]
jmp 0x416fbb
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x416fc0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x41700d
xor ebx, ebx
jmp 0x417002
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00408494
test eax, eax
jne 0x417001
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4170b7
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x416fe3
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x417019
je 0x417022
jmp 0x41702b
call fcn.00414208
mov esi, eax
jmp 0x41702d
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x41702d
xor esi, esi
test si, si
je 0x4170b7
xor ebx, ebx
jmp 0x417053
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x417052
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4170b7
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x41703a
xor ebx, ebx
jmp 0x4170ac
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x4170ab
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x4170a0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.00416f94
push eax
mov eax, esi
call fcn.00416f94
pop edx
cmp edx, eax
jne 0x4170ab
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4170b7
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x417062
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4174a8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41757f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41759c
push ebx
push 0x4175ac
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405480
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403340
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405068
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x41752a
mov ax, 0x83
call fcn.004170c4
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0041747c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x417533
call fcn.0041747c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417586
lea eax, [ebp - 4]
call fcn.00404fcc
ret
Function at 0x41769c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x417767
jmp 0x41775b
cmp dword [esi + 0x10], 0x1000
jne 0x417747
test byte [esi + 0x15], 1
jne 0x417747
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4176f8
cmp ebp, 2
je 0x4176f8
cmp ebp, 0x10
je 0x4176f8
cmp ebp, 0x20
jne 0x417714
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x417714
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x417725
mov eax, dword [esi]
add eax, ebx
call fcn.00417694
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x417718
cmp byte [esp + 4], 0
je 0x417747
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x417767
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4176cd
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret