joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4038da
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
test esi, esi
jle 0x403932
mov eax, dword [0x41219c]
test eax, eax
je 0x40390c
push eax
call fcn.00404c60
pop ecx
lea eax, [ebp + esi - 0x104]
push str.mozregistry.dat
push eax
call fcn.00404550
lea eax, [ebp - 0x104]
push eax
call fcn.0040b09c
add esp, 0xc
mov dword [0x41219c], eax
pop esi
leave
ret

Function at 0x4091cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a10
cmp edx, dword [eax]
je 0x4091ef
add eax, 8
inc ecx
cmp eax, 0x411aa0
jl 0x4091e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a10]
jne 0x40931d
mov eax, dword [0x412214]
cmp eax, 1
je 0x4092f7
test eax, eax
jne 0x409220
cmp dword [0x40f7a4], 1
je 0x4092f7
cmp edx, 0xfc
je 0x40931d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409257
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404550
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404640
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40929a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404640
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d574
push edi
call fcn.0040a790
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404550
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404560
lea eax, [ebp - 0xa0]
push 0x40d554
push eax
call fcn.00404560
push dword [esi + 0x411a14]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404560
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040a707
add esp, 0x2c
pop edi
jmp 0x40931d
lea eax, [ebp + 8]
lea esi, [esi + 0x411a14]
push 0
push eax
push dword [esi]
call fcn.00404640
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x440687
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x15cec095
and al, byte [ebp - 0x5aede2fb]
adc byte [ebp - 0x28], 0x8f
adc ah, byte [ebp - 0x7027aa7e]
scasb al, byte es:[edi]
leave
ror byte [eax - 0x3e], cl
aad 0x46
invalid
cmp dl, cl
movsb byte es:[edi], byte [esi]
std
fild dword [ebx]
mov word [esi], gs
add byte [ecx + ebp*2 + 0x36], al
scasd eax, dword es:[edi]
mov dword [0x5ebca601], eax
xlatb
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
inc esp
imul esi, dword [esi], 0xa601a3af
mov esp, 0xa6a7d75e
jb 0x440598
bound esi, qword [ecx - 0x693f7f3a]
jbe 0x4405a1
sbb byte [ecx + 0x104bcbb2], ah
sbb esp, dword [esi - 0x62fd2dd9]
pop ebx
salc
dec ebx
iretd
push ebp
out dx, al
pop edi
fucom st(5)
inc edi
jns 0x4405c8
leave
and bh, byte [ecx + 0x25870d8b]
jbe 0x4405c0
cmpsd dword [esi], dword es:[edi]
fistp word [ebp + ebx*2 - 0x77]
dec edx
test dword [ecx + esi*8], esi
js 0x440613
enter 0x56d5, 0xffffffffffffffc5
jp 0x4405c9
add ebp, ecx
push ds
adc al, 0x4e
or eax, 0xb952a932
insd dword es:[edi], dx
ror dh, cl
lds esi, [ecx + 0x31]
xchg esi, eax
sbb byte [edx + 0x23447d44], al
outsd dx, dword [esi]
push es
mov eax, 0x193394a0
mov dword [0x6ffad3f4], eax
enter 0xffffffffffffa5a6, 0xffffffffffffffec
add byte [eax + 0x75], 0x92
push esp
mov ecx, 0x8fb6a848
je 0x4406b6
inc ecx
mov cl, 0x85
mov dword [0x8e8d325], eax
xlatb
xor eax, 0x1b38e346
adc bh, al
salc
and eax, dword [eax]
dec esi
mov ecx, 0xccbca8ea
popal
movsb byte es:[edi], byte [esi]
push ebx
std
pop eax
invalid
jb 0x44060e
invalid
jne 0x4406dd
fcom dword [eax]
and ebx, dword gs:[edx]
invalid
aas
salc
and dword [edx], 0x77a742b7
xchg edi, eax
push 0xffffffffffffffa2
adc byte [eax + eax + 0x65a4a792], dl
invalid

Function at 0x44aad0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x214
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push 0x104
push eax
push ecx
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44ab92
cmp eax, 0x104
jne 0x44ab15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44ab92
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44ab92
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x44ab92
mov ecx, dword [esp + 0x10]
push ebx
push esi
push edi
lea edx, [esp + 0x24]
push ecx
push edx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44ab7a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44ab7a
mov edx, dword [esp + 0x10]
mov ebx, 1
mov ax, word [edx]
mov word [ebp], ax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x214
ret 8
Function at 0x480ac2
Capabilities:
Encode data using xor

Disassembly:
into
push 0x53
mov ds, eax
clc
in al, dx
test al, 0x11
sub esi, ebx
cld
cmpsd dword [esi], dword es:[edi]
pushfd
adc eax, 0x8e2a47e9
sub cl, byte [esi + 0x713601a3]
in al, dx
jmp 0xa3d6350c
inc edi
sub cl, byte [esi + 0x713601a3]
in al, dx
and al, 0x10
loopne 0x480aaf
fsub dword [ecx + 0x31]
push esi
xor dword [ecx - 0x1c75f170], eax
mov esi, 0xf28ae2d8
dec esi
or eax, 0x184cf1ba
push ecx
or byte [edx + 0x43d9b96d], bl
push es
push ebx
js 0x480abe
pushfd
int 0x71
fadd qword [ebx]
and ecx, dword [esi + 0x1b]
cld
pop ebx
call dword fs:[eax + 0x78]
push esi
sahf
in al, 0xa5
je 0x480b39
shl dword [esi + ebp*4], 0x4e
loopne 0x480ac0
mov eax, ebx
sub eax, 0x7e74d77c
and ah, byte [ecx]
inc ecx
pop edi
shr ch, 0x5a
push dword [edi]
sahf
shr byte [edx + 0x5a21a3dc], cl
aas
xchg ecx, eax
mov es, word [ecx]
or byte [eax - 0x12], ah
add dword [eax], ecx
pushal
out dx, al
add esi, edi
jle 0x480ac1
loope 0x480b79
push ecx
mov bl, 0xf3
les edi, [0x8f61375a]
invalid
fidivr word [edi + 0x10]
mov bl, 0x97
int3
dec dword [edx + 0x32]
loop 0x480b8a
enter 0xffffffffffffe328, 0xffffffffffffffbf
loope 0x480bc8
cmc
invalid
invalid
add esi, dword [ebp - 0x14]
jg 0x480b25
sal byte [ebx], 0x7e
mov gs, word [eax - 0x6b346c51]
cdq
mov edx, 0xb13b6749
xor ch, byte [esi - 0x75d35420]
sbb edi, dword [edi]
int 0x40
and esi, ebx
and dword [ebp - 0x21], esp
mov dword [0x68fb238c], eax
pushal
cli
in eax, dx
dec edi
mov bl, 0x7b
mov ebx, fs
int 0xbe
sub byte [edx - 0x7e], al
stc
jecxz 0x480b8e
mov esi, 0xf9824228
out 0xc, eax
loop 0x480bbf
out 5, al
sub al, 0xcf
push esi
cmp byte [edx + edx], bh
inc ebx
or al, 0xe4
mov bl, 0x1e
enter 0x4c3a, 0x5f
jg 0x480c18
pop eax
mov esp, 0x6c99bafd
mov esp, 0x5340ae95
mov cl, 0x5f
push 0x37
rol dword [ebx + 0x6315913e], 1
fld xword [esi + 0x1a]
cld
rcl dword [ecx + 0x7736cd2], cl
mov byte [0xf13eafa5], al
cmc
mov dl, 0x7d
out 0x6b, eax
sbb eax, 0x9140b9a3
xchg ebp, eax
movsb byte es:[edi], byte [esi]
xchg ecx, eax
or byte [esi - 0x4fec7ecc], 0xb1
fisttp qword [0x6e0e4b23]
and ecx, dword [ebx + 0xe]
outsb dx, byte [esi]
mov dword [0xc3048eef], eax
pop ds
or al, 0xbf
push ecx
mov edi, 0xc5dcd32
sal ch, cl
inc ebx
mov eax, dword [0x7c771150]
xchg edx, eax
xor ecx, dword [ecx]
movlps xmm1, qword [ebx + 0x32]
mov gs, word [ebp - 0x63512c9d]
jne 0x480c5e
invalid
loope 0x480c99
invalid
pop ss
pop edx
cdq
or dword [edx + 0x189fa913], edi
stc
inc edi
xrelease xchg byte [esp + ecx], dl
xchg esi, eax
dec edi
mov edx, 0x6fbe750f
outsd dx, dword [esi]
mov bh, 0xae
kunpckwd k5, k2, k4
inc edx
jmp 0xc37bee5f

Function at 0x49ff30
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
fstp xword [esi]
cmp dl, byte [esi]
cmp ebx, dword [esi]
add dh, byte [ebx - 0x49f3b090]
or ebx, ebx
aam 0xf1
pushfd
enter 0xfffffffffffff38d, 0xffffffffffffffdb
ficomp dword [ebx - 0x20e6444b]
pop ecx
movsb byte es:[edi], byte [esi]
jp 0x49ff3d
fisttp qword [edx + ebx*8 + 0x53]
or byte [ebp + 0x2386c566], ch
xchg esp, eax
sub al, 0
push ebp
invalid
Function at 0x4ca3a2
Capabilities:
Encode data using xor

Disassembly:
mov byte [ecx - 0x1b], bh
invalid
mov ah, 0x4b
and al, 0x9f
invalid
stc
stosd dword es:[edi], eax
cmp byte [esi - 0x34d87e45], dh
push ss
mov word [ebx], gs
push esi
mov ebx, 0x1b51049e
fisttp qword [ebp + 0x43]
dec ecx
mov al, 0x6d
push ds
cmpsb byte [esi], byte es:[edi]
xor byte [0x38cdbd72], bl
xchg edx, eax
jns 0x4ca326
push ebp
and ebx, dword [eax]
bound eax, qword [esi - 0x2d58c860]
loop 0x4ca2cf
add ch, byte [edx + 0x42]
jg 0x4ca2e2
add eax, 0x4127f250
std
mov al, byte [0x87044729]
and byte [edx], 0x3b
mul dword [edx + 0x45]
mov byte [edi - 0x7f], al
salc
jb 0x4ca266
popal
add edx, ecx
loopne 0x4ca288
stc
jmp 0xd6b40545
pop ss
loopne 0x4ca26c
wait
mov esi, esi
dec ebx
test cl, 0xe
hlt
inc edx
mov eax, dword [0x3f5dd7cb]
mov esp, 0xa036349f
push esp
cld
pop edx
pushfd
out 0xc5, eax
mov bl, 0x40
test dword [edx - 0x50d530cc], edx
and dword [ecx + ecx*8 - 0x4e], ebx
xor dword [edx + 0x5b], 0x24
in al, 0xf0
jp 0x4ca2bf
sub dl, al
or al, ch
inc esi
sbb dword [0x916d8175], ecx
cmp dword [eax], eax
salc
imul ebp, dword gs:[eax + 0x4265e81b], 0xc
xor ecx, dword [ebx - 0xe]
cmp dword [edx - 0x2fa61df8], ebx
div byte es:[esi + 0x38]
or al, 0x57
pop edi
inc edi
jo 0x4ca3c6
and ebx, dword [ebx + 0xc180fc6]
cmpsd dword [esi], dword es:[edi]
or al, 0xa7
jnp 0x4ca37b
sbb byte [ebx - 0x70], bl
or dl, bh
imul edi, dword [ebp - 0x3f46a3dc], 0x32
dec ebp
or dword [edx], edx
sbb dword [ebx + 0x48f95006], ebp
jo 0x4ca2fd
push edx
int1
pop ss
ret
pop esp
mov al, byte [0xb4b247d0]
or al, 0x59
enter 0xffffffffffffddaf, 0xffffffffffffff8b
popfd
inc esp
mov gs, word [0xee5d424d]
mov ebx, dword [ebp + 0x4d2d8e44]
inc edx
pop ebp
out dx, al
jmp 0x4ca3c6
imul ecx, dword [ebp + 0x78], 0x4f98186
inc edx
sbb al, 0x85
and al, 0x9f
lahf
jnp 0x4ca353
cwde
xchg edx, eax
salc
xchg esp, eax
call 0x91579415
int3
in al, dx
popal
xlatb
sbb al, 0x4b
inc edx
loopne 0x4ca386
xor ah, al
out 0xdb, eax
mov bh, 0x72
xor al, 0x9c
loopne 0x4ca3e8
jmp 0x4ca414
dec esi
popfd
loope 0x4ca3ad
jae 0x4ca3d0
cmpsd dword [esi], dword es:[edi]
push eax
rcr dword [ebp + 0x23], cl
cmp al, 0x39
invalid
leave
pushfd
pop ebp
pop ebp
push esp
push 0x65
fidiv word [esi + 0x79]
or eax, 0xda46fda2
or eax, 0xdbe0d206
fstp qword [ecx + 0x4c93095d]
inc eax
dec ecx
pushfd
and bh, byte [ebx - 0x6e]
push esp
sub eax, 0x73c4fa59
ret 0xc07b

Function at 0x4f298e
Capabilities:
Encode data using xor

Disassembly:
fidivr dword [ebx]
or al, 0xa7
int3
pop eax
pop ebx
xor ebx, ecx
add eax, dword [edx - 4]
fld dword [ebx]
inc edx
cld
jne 0x4f2930
or byte [ebx], cl
and ch, al
fdiv st(2), st(0)
std
sahf
cmp al, 0xd6
xor byte [esi], ch
mov esi, 0x1f5e004e
push edi
push ecx
cmpsb byte [esi], byte es:[edi]
loopne 0x4f2900
invalid
jecxz 0x4f29d7
fcom qword [ebp - 0x12]
je 0x4f2933
aas
invalid
ret
Function at 0x402a6c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045c0
test esi, esi
jne 0x402aa2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004046b0
jmp 0x402ac0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402980
mov edi, eax
test esi, esi
je 0x402ac0
cmp dword [ebx], 0
je 0x402ac0
dec esi
jmp 0x402aa9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40361c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403694
xor eax, eax
push ebp
push 0x40368d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403694
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x483020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043c0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48804c], 0
je 0x404421
cmp word [0x488220], 0xd7b2
jne 0x4043e9
cmp dword [0x488228], 0
jbe 0x4043e9
mov eax, 0x48821c
call dword [0x488238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x483070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404448
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x483030], 0
jne 0x40443d
push 0
push 0x483068
push 0x483070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404574
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402744
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x48804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40453c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405ba4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405dd4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c27
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405dd4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c27
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405df0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405cb0
xor eax, eax
push ebp
push 0x405ca9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004059ec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c8e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405e10
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c8e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405cb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405dca
cmp byte [ebp - 0xd], 0
jne 0x405cf7
cmp byte [ebp - 0x12], 0
je 0x405dca
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405d10
dec ebx
cmp byte [ebx], 0x2e
je 0x405d1f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405d0f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405dca
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405d5c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405dca
cmp byte [ebp - 0xd], 0
je 0x405dca
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405dca
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4064ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406552
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404830
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403054
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40653c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406559
lea eax, [ebp - 0x10]
call fcn.004045c0
ret

Function at 0x40be18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40be51
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004046b0
jmp 0x40be5a
mov eax, ebx
mov edx, esi
call fcn.00404614
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40be64
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40be85
mov al, byte [esp]
jmp 0x40be87
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c50c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c384
mov eax, dword [0x4871b0]
cmp byte [eax], 0
je 0x40c588
mov eax, dword [0x486f50]
call fcn.00402eb4
call fcn.004028ac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409130
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c5d0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c5be
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x486eec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x488668]
call fcn.004059b0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40ce6c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cf42
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404658
lea eax, [ebp - 8]
call fcn.00404ad0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a80
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cf2c
mov eax, ebx
call fcn.00402744
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cf25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a80
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cf0f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cf54
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cf0f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf2c
mov eax, dword [ebp - 0x10]
call fcn.00402764
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf49
lea eax, [ebp - 8]
call fcn.004045c0
ret

Function at 0x40d4cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d530
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404830
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408bac
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d537
lea eax, [ebp - 0xc]
call fcn.004045c0
ret

Function at 0x422428
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00422280
dec esi
jne 0x42244a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x42358c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48888c
cmp dword [edi], 0
jne 0x423608
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x488888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x483528
mov ecx, 2
call fcn.00402940
mov edx, 0x423564
lea eax, [esi + 5]
call fcn.00423584
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00423584
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4235dd
mov dword [0x488888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424bac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424bb2
ret

Function at 0x427100
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x427151
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x427138
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x427128
jmp 0x427151
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x427139
pop ebx
mov esp, ebp
pop ebp
ret