joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100699a8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1009c5d8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100699ee
cmp word [ebx], dx
jne 0x100699ee
or byte [eax + edi + 0x28], 4
jmp 0x100699f3
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10069b56
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10069b36
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10069a34
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10069a6a
cmp eax, edx
jae 0x10069a78
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10069a0f
jmp 0x10069b56
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10069b31
cmp dword [ebp - 0x18], 0
je 0x10069b31
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1009c5d8]
test byte [eax + edi + 0x28], 0x48
je 0x10069b07
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10069acb
mov word [esi], cx
jmp 0x10069b02
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1009c5d8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1009c5d8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1009c5d8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10069b56
pop eax
cmp word [ebp - 4], ax
jne 0x10069b17
cmp esi, ebx
jne 0x10069b17
mov word [esi], ax
jmp 0x10069b53
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100691c5
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10069b56
push 0xd
pop eax
jmp 0x10069b12
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1009c5d8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10069b50
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10069b56
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1006cffc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1006d099
push ebx
push esi
call fcn.1006cfc5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1006b760
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1006d046
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1006d098
push edi
push eax
call fcn.100662ff
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1006d066
call fcn.1006448f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1006d097
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1006b760
add esp, 0x20
test eax, eax
jne 0x1006d085
push edi
call fcn.1006448f
jmp 0x1006d08d
push ebx
call fcn.1006448f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1006d09c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1006d0ad
pop esi
ret
push ebx
push edi
push esi
call fcn.1006cfc5
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100662ff
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1006d0d5
push ebx
push esi
push edi
call fcn.100543d0
add esp, 0xc
push 0
call fcn.1006448f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1006d4a5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006d0ea

Function at 0x1006f72a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10064833
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1006f799
cmp esi, dword [ebp - 4]
je 0x1006f794
cmp dword [ebp + 0xc], 0
je 0x1006f794
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1006f771
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1006f27c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1006f79b
xor eax, eax
inc eax
jmp 0x1006f79b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1006f800
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10099040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10064833
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10064833
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1006f877
cmp word [ecx], dx
je 0x1006f877
mov eax, dword [0x10081734]
push edi
dec eax
push eax
push 0x10081620
call fcn.1006f79f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1006f8ea
cmp word [eax], dx
je 0x1006f8ea
mov eax, dword [edi]
test eax, eax
je 0x1006f89b
cmp word [eax], dx
je 0x1006f89b
lea eax, [ebp - 0x10]
push eax
call fcn.1006f182
jmp 0x1006f8a4
lea eax, [ebp - 0x10]
push eax
call fcn.1006f21d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1006f914
mov eax, dword [0x1008161c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10081310
call fcn.1006f79f
add esp, 0xc
test al, al
je 0x1006f914
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1006f8df
cmp word [eax], di
je 0x1006f8df
lea eax, [ebp - 0x10]
push eax
call fcn.1006f182
pop ecx
jmp 0x1006f916
lea eax, [ebp - 0x10]
push eax
call fcn.1006f21d
jmp 0x1006f8dc
mov eax, dword [edi]
test eax, eax
je 0x1006f901
cmp word [eax], dx
je 0x1006f901
lea eax, [ebp - 0x10]
push eax
call fcn.1006f137
pop ecx
jmp 0x1006f914
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1006f9df
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1006f624
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1006f9df
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1006f9df
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1006f9df
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1006f96c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10067bab
test ebx, ebx
je 0x1006f9da
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10067bab
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1006f9df
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1006f9df
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10072c01
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1006f9e1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052d14
leave
ret
Function at 0x10074920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1007494d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007494d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x411efe
Capabilities:
Encode data using xor

Disassembly:
push esi
add bl, dl
jbe 0x411f05
les ecx, [ebp - 0x79096dbf]
mov ah, 0xd7
das
cmc
daa
lea eax, [ecx - 0x6e]
inc ecx
xchg edx, eax
test byte [esi - 0xad0284c], 0x27
xor al, 0x68
fsub st(7)
pop esi
salc
stosb byte es:[edi], al
or eax, dword [edi + 0x17f67be6]
outsd dx, dword [esi]
popal
test byte [edi], bh
adc eax, 0xa3e62458
mov byte [ebx - 0x41], dh
sbb cl, dh
mov eax, dword [0x339a502]
cmp esp, dword [ebx - 0xa924a89]
je 0x411f04
mov esi, 0x17289fbd
mov eax, 0x20956d91
iretd

Function at 0x437049
Capabilities:
Encode data using xor

Disassembly:
sub edi, dword [ecx + edi*2 + 0x71]
dec ebp
mov ch, 0xf6
xchg edi, eax
pop edx
dec ebp
push 0x52
invalid
or eax, 0x69b0002c
sub eax, 0xe4acce0
or al, 0x2e
push 0x8d263bb1
adc al, 0xa9
out 0x56, eax
pop ds
test eax, 0x73febeee
cmp dword [ecx + 0x1b2d41de], edx
xchg esi, eax
or eax, 0x2816b252
in eax, dx
xchg ecx, eax
jl 0x437015
sub bh, al
push edx
cmp ebx, esp
cdq
and al, byte [edi - 0x7e]
mov ecx, 0x6ad2e8e1
invalid
Function at 0x61f2e4
Capabilities:
Encode data using xor

Disassembly:
iretd
xor ah, byte [edx - 0x70]
jbe 0x61f2d1
adc esp, dword [eax - 0x6c120595]
add eax, 0xd3faa9a9
mov ebp, 0x3395c8c2
out dx, eax
cdq
or esp, eax
mov cl, 0x5a
mov edi, 0x83a001d6
jecxz 0x61f23c
jnp 0x61f2b5
xchg ecx, eax
sahf
enter 0xffffffffffff8162, 0xffffffffffffff90
sub al, 0x8f
xchg edx, eax
mov cl, 0xb4
invalid
and eax, 0x96510dd1
xchg esi, eax
in eax, dx
dec ebx
nop
retf
mov dh, byte [ebx - 0x63]
and esp, edi
int1
push esp
ror esp, 1
and byte [ebp - 0x4df573f8], ch
adc dword [edx - 0x70], 0xffffffab
mov dl, 0x83
push edx
nop
stosd dword es:[edi], eax
pop edi
mov edi, ds
xchg byte [ecx + 0x17a3819b], ch
pop ecx
movsb byte es:[edi], byte [esi]
dec esp
xchg edi, eax
imul ebx, dword [edi - 0x19], 0xfffffff0
pop edi
out 0xf0, eax
pop edi
out 0xf0, eax
add eax, 0xf4fc42e8
jge 0x61f36c
push es
mov fs, word [edx - 0x80]
outsd dx, dword [esi]
add byte [esi], al
loope 0x61f2c2
jg 0x61f27a
mov al, byte [0x2ca63474]
pop esp
sbb al, ah
or dword [esi + ecx + 0x1a35e1e5], edi
jnp 0x61f32f
cdq
cli
sets byte [ebx + ebx*8 + 0x24]
adc al, 0xd0
push eax
movsd dword es:[edi], dword [esi]
test esi, 0x82c9facf
or eax, 0xd19f798c
pushal
scasd eax, dword es:[edi]
outsb dx, byte [esi]
xor ch, byte [edx]
dec esp
or dl, ah
cli
out 0x66, al
jne 0x61f347
rcl dword [ebx + 0x5c], cl
push ebx
pop esp
das
jbe 0x61f335
jmp 0x61f391
pop ebx
loopne 0x61f2b9
retf 0xc332
pop esi
push esi
inc edx
sbb eax, 0x23cb184c
cli
leave
movsd dword es:[edi], dword [esi]
mov ebx, 0xd85c967
popfd
test al, 0xc9
cdq
pushal
push es
in eax, dx
invalid
enter 0x482c, 0x35
call 0x6a82250d
fbld tbyte [eax]
jmp 0x61f3a3
push 0x1d
invalid
js 0x61f3fd
fbstp tbyte [ebx]
pop esp
add ebx, dword [eax]
arpl word [ecx + 0x39], di
in al, 0x17
xor byte [eax], 0x97
adc dword [edx + ebp*2 + 0x6d], ebp
insd dword es:[edi], dx
xchg ebx, eax
in eax, dx
push ds
mov dl, 0x2e
dec ebx
add ah, byte [esi + 0x38]
mov ch, 0xbd
outsb dx, byte [esi]
cmc
jns 0x61f3e1
cld
cli
and edi, dword [ebx]
push es
sbb eax, 0x1fab808e
push esi
imul esp, dword [edx + 0x53], 0xb9466a0
pop esi
fucomp st(4)
mov dword [ebp - 0x602a39db], edi
xor eax, 0x3ae6e26b
movsd dword es:[edi], dword [esi]
jae 0x61f360
add eax, 0x5b9434f
cwde
cdq
clc
rcr byte [edx - 0x18], 0xf
sub byte [edx - 0x5c], ah
call 0xa4c41bf5
movsd dword es:[edi], dword [esi]
push es
mov ss, word [edx - 0x65f3c735]
sal esi, 1
and dword [esi], 0x23d2563
aaa
dec byte [eax + edx + 0x31591adc]
xor dword [edi + ebp*8], ebx
sbb al, 0xef
aas
and al, 0x44
adc eax, 0x715f569d
xor eax, 0xdf46ee6c
movsd dword es:[edi], dword [esi]
cdq
or byte [edi], dl
mov ebp, 0x2e5fbe60
outsd dx, dword [esi]
xchg ebp, eax
xchg ecx, eax
mov al, 0x3b
jo 0x61f3fe
mov es, esi
adc byte [edx + 4], 0x97
in al, dx
jge 0x61f476
int3
int3

Function at 0x627d21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313d0
Function at 0x4ecf30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7e000]
push edi
or ebp, 0xffffffff
jmp 0x4ecf52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ecf59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ecf48
mov eax, 1
add ebx, ebx
jne 0x4ecf6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ecf60
jne 0x4ecf7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ecf60
xor ecx, ecx
sub eax, 3
jb 0x4ecf90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ed002
mov ebp, eax
add ebx, ebx
jne 0x4ecf9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4ecfa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4ecfcc
inc ecx
add ebx, ebx
jne 0x4ecfb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ecfad
jne 0x4ecfc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ecfad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ecfec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ecfdd
jmp 0x4ecf4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ecfec
add edi, ecx
jmp 0x4ecf4e
pop esi
mov edi, esi
mov ecx, 0x3303
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ed00a
cmp byte [edi], 0x1e
jne 0x4ed00a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ed00f
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4ed087
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeda20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xedb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ed03c
mov ecx, edi
jns 0x4ed06b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xedb28]
or eax, eax
je 0x4ed081
mov dword [ebx], eax
add ebx, 4
jmp 0x4ed059
call dword [esi + 0xedb30]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ed0b8
cmp al, 0xef
ja 0x4ed0ab
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ed08d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ed09a
mov ebp, dword [esi + 0xedb2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ed0ec
sub esp, 0xffffff80
jmp 0x4768a2
Function at 0x5e0578
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x6bc00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x228], eax
push esi
mov ax, word [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov ax, word [ebx + 8]
push edi
mov word [ebp - 0x12], ax
call esi
mov word [ebp - 0x10], ax
mov edi, 0x4e4
mov ax, word [ebx + 8]
mov word [ebp - 0xe], ax
mov ax, word [ebx + 4]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], di
call esi
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], di
push dword [ebp - 0x224]
movzx eax, word [ebp + ecx*2 - 0x12]
lea edi, [ecx + 2]
push eax
movzx eax, word [ebp + ecx*2 - 0x14]
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00403e80
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x22c]
add esp, 0x1c
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebx]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x5e0647
mov esi, dword [ebp - 0x220]
test esi, esi
jne 0x5e0661
mov ecx, edi
cmp edi, 8
jb 0x5e05e3
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049b637
leave
ret 8
push esi
call fcn.005f0fb8
pop ecx
mov ecx, dword [ebp - 0x228]
push eax
push esi
call fcn.005e06dd
mov al, 1
jmp 0x5e0650

Function at 0x600439
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006002b8

Function at 0x606350
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00606010
Function at 0x560457
Capabilities:
Encode data using xor

Disassembly:
pushfd
bt si, di
cmc
add edi, eax
call fcn.0055d71c
sbb cl, byte [esi - 0x46]
fmul qword [esi + 0x6c]
dec ebx
jb 0x5604de
cwde
and eax, 0xffcf9b9b
pop esi
adc edi, edi
sub dl, ch
in eax, 0x12
aam 0x9e
mov cl, 0x8d
pushal
daa
inc ebx
in eax, dx
jg 0x5604a4
sub bh, byte [ecx]
popal
enter 0x4ec8, 0x43
popal
cmp bl, byte [esi + 0x1b8dc6fd]
inc esi
push ebx
jl 0x5604f9
ret 0x7943
daa
push ds
sub al, 0x9a
jo 0x560501
xchg ebx, eax
bnd retf
sub al, 0x97
invalid
mov ch, 0xa2
push ss
hlt
jge 0x560525
lock sbb byte [ecx - 0x50], bl
lcall 0xac86, 0xd1fed9e0
pop eax
push es
add byte [edx - 7], dl
fsin
rol dword [esi + 0x658ac], 1
push edx
stc
movsb byte es:[edi], byte [esi]
mov dl, 0x44
cwde
jae 0x56058b
lahf
xchg byte [ebp + edx*2 - 0x6a0a7b45], al
mulps xmm1, xmmword [esi]
dec edx
mov esp, 0x6983792e
push esi
les eax, [ebp + 0x17]
pop ss
adc dword [edi + 0x21bb5103], 0xc7f87218
xor edx, esp
sub cl, cl
wait
mov edx, 0x2268691b
jne 0x5604cf
pop ecx
pushal
mov dh, 0x52
test dword es:[esp + eax], edi
outsb dx, byte [esi]
pmaxsw mm2, mm1
mov edi, 0xbb51cb96
lodsb al, byte [esi]
pop esi
mov ss, word [edx + 0x47]
push ecx
mov ebx, 0x528e5eac
inc edi
adc dword [edx + esi*2], 0x7c192627
in al, dx
sbb al, 0xc
cmp byte [ebp - 0x56011350], 0x5a
cdq
mov al, byte [0x184e9eca]
xor byte [eax], dl
jp 0x56054b
sub al, 0x75
xchg esi, eax
invalid
fild qword [ecx + 0x1c6ee52c]
daa
cli
push ecx
or al, 0xff
and al, 0x1d
or ecx, dword [ebp + 0x1e]
push 0xdd4e9030
sbb dword [ebx + 0x5b4d74d5], ebp
scasd eax, dword es:[edi]
dec eax
stosd dword es:[edi], eax
sal byte [0xcc901120], 0x1c
push ds
sbb al, 0x1e
mov eax, dword [0x22c309db]
add dword [bp + 0x4c], eax
jne 0x560614
test esi, 0x6545ec3a
add eax, 0xf8556be4
inc ebx
mov eax, dword [0x8749da30]
mov dh, byte [eax + 0x54f65758]
or edx, eax
loope 0x5605af
out 0xa5, al
adc bh, byte [edx - 0x3ec49001]
retf
ja 0x560687
int 0x22
invalid
inc eax
scasb al, byte es:[edi]
cwde
leave
dec eax
enter 0x5817, 0xffffffffffffffbe
cmpsb byte [esi], byte es:[edi]
and al, 0x7b
invalid
Function at 0x562f5d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x657961
mov esi, ecx
inc ebp
ret 0x9970
push esp
aas
or dword [esi], ecx
aaa
inc esp
jle 0x6578cc
daa
sub edi, dword [edx + 0x75]
and al, 0x39
int 0x12
jns 0x657937
pushal
bound eax, qword [esi + ecx*2]
add eax, dword [ebx + 0xd]
mov dword [0x2dca05d], eax
push edx
std
inc edi
int3
dec edx
ret
call 0x6362d2ff
pop esi
wait
in al, 0xc3
cli
js 0x657901
loop 0x657993
sbb eax, 0x189994e9
sahf
movsd dword es:[edi], dword [esi]
mov eax, dword [0xdf10147f]
xor ebx, dword [ecx - 1]
aaa
push dword [edi]
pop dword [esp + 4]
mov word [esp], 0x3f31
cmp edi, ebx
push 0x21c70412
pushfd
call fcn.00560d2a
fmul st(3), st(0)
jg 0x65795a
xchg ebp, eax
loopne 0x6579a0
and byte [edi], cl
inc ebp
loop 0x657945
cmp al, 0x15
adc eax, 0x618e1bad
fiadd dword ss:[eax - 0x7c456845]
loopne 0x6579dc
and eax, 0x46
jge 0x6579c8
push eax
aad 0xec
mov esi, eax
invalid
mov dh, 0x68
xchg edx, eax
and dword [eax + ecx*8], edi
cmp bh, ch
push edx
sub byte [edi + edi*4 - 0x1f509d3], cl
out 0x46, al
sbb dword [edx + 0x3c], eax
insd dword es:[edi], dx
mov edx, 0x37e15bda
sbb ah, byte [ebp - 0x41d33702]
push esi
aaa
mov ebx, 0xa2803469
xchg edx, eax
xchg edx, eax
adc al, 0xc3
and eax, 0x74390a7e
jbe 0x6579e9
ret
or bh, dh
sahf
dec edx
adc eax, 0xaf0abeba
mov al, byte [0xc4420c1d]
in eax, 0x71
mov edx, 0xaef930ed
inc edx
les esp, [edi - 0x1b]
jno 0x65799c
in eax, dx
xor cl, bh
scasb al, byte es:[edi]
push ebp
mov ah, 0xc7
fisubr dword [esi + eax*2]
mov ebx, 0x64acf173
daa
sti
scasb al, byte es:[edi]
lodsb al, byte [esi]
pop edi
invalid
Function at 0x4043cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45f07c]
jne 0x4043d9
repz ret
jmp fcn.00404efa

Function at 0x409ccc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45f07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405a1d
and dword [ebp - 0x14], 0
cmp dword [0x461724], 0
mov dword [ebp - 0x18], eax
jne 0x409d7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409e27
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409e27
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x461724], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x461728], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46172c], eax
call edi
push eax
call esi
mov dword [0x461734], eax
test eax, eax
je 0x409d7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x461730], eax
mov eax, dword [0x461730]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409dd8
cmp dword [0x461734], ecx
je 0x409dd8
push eax
call esi
push dword [0x461734]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409dd8
test ebx, ebx
je 0x409dd8
call edi
test eax, eax
je 0x409dcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409dcf
test byte [ebp - 8], 1
jne 0x409dd8
or dword [ebp + 0x10], 0x200000
jmp 0x409e0b
mov eax, dword [0x461728]
cmp eax, dword [ebp - 0x18]
je 0x409e0b
push eax
call esi
test eax, eax
je 0x409e0b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409e0b
mov eax, dword [0x46172c]
cmp eax, dword [ebp - 0x18]
je 0x409e0b
push eax
call esi
test eax, eax
je 0x409e0b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x461724]
call esi
test eax, eax
je 0x409e27
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409e29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043cf
leave
ret