joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x409fcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x10
test edi, edi
jne 0x409ea5
or ebx, 0x8000000
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00405744
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], di
mov dword [ebp - 0x2c], 1
cmp dword [ebp + 8], 0
je 0x409ed1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x409ee7
mov eax, dword [ebp - 8]
call fcn.00403fa8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403ba4
cmp dword [ebp - 0x14], 0
je 0x409f2b
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x22
je 0x409f2b
mov edx, dword [ebp - 0x14]
mov eax, 0x409fe8
call fcn.00404048
test eax, eax
jle 0x409f2b
push 0x409ff4
push dword [ebp - 0x14]
push 0x409ff4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403e68
cmp dword [ebp - 0x14], 0
je 0x409f42
test esi, esi
je 0x409f42
lea eax, [ebp - 0x14]
mov edx, 0x409fe8
call fcn.00403db0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
push 0
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, esi
mov edx, dword [ebp - 0x14]
call fcn.00403df4
mov eax, dword [ebp - 0x6c]
call fcn.00403fa8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x409faf
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x409f98
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x409fa6
cmp dword [ebp + 8], 0
je 0x409fa6
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x68]
mov dword [eax], edx
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409fd4
lea eax, [ebp - 0x6c]
call fcn.00403b0c
lea eax, [ebp - 0x14]
call fcn.00403b0c
ret

Function at 0x40b818
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40b824
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x40b83d
push eax
je 0x40b83e
call dword [0x43b118]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x43b118]
ret
Function at 0x40ce3c
Capabilities:
Get file attributes

Disassembly:
call fcn.00405c18
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40ce50
dec eax
and al, 0x10
sete al
ret

Function at 0x40ce8c
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403ce8
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00406670
ret

Function at 0x40d670
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, eax
push esp
call sub.kernel32.dll_QueryPerformanceFrequency
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push 0
mov eax, dword [0x4479d4]
push eax
mov eax, dword [0x4479cc]
push eax
push 8
call dword [0x447934]
push ebp
call sub.kernel32.dll_Sleep
push 0
mov eax, dword [0x4479d4]
push eax
mov eax, dword [0x4479d0]
push eax
push 8
call dword [0x447934]
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0xc]
jne 0x40d6db
cmp eax, dword [esp + 8]
jbe 0x40d6f7
jmp 0x40d6dd
jle 0x40d6f7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jmp 0x40d721
mov eax, dword [esp]
mov edx, dword [esp + 4]
push edx
push eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esp + 0x18]
sbb edx, dword [esp + 0x1c]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
push 0
push 0x186a0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00404654
push edx
push eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
call fcn.00404654
mov ebp, eax
xor esi, esi
mov al, byte [0x447910]
dec eax
test al, al
jb 0x40d79b
inc eax
mov byte [esp + 0x20], al
mov bl, 0
mov eax, ebp
xor edx, edx
push edx
push eax
xor eax, eax
mov al, bl
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
mov eax, dword [0x4479d0]
mov edx, dword [eax + edi*8 + 4]
mov eax, dword [eax + edi*8]
push edx
push eax
mov eax, dword [0x4479cc]
mov edx, dword [eax + edi*8 + 4]
mov eax, dword [eax + edi*8]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00404654
add esi, eax
inc ebx
dec byte [esp + 0x20]
jne 0x40d759
xor eax, eax
mov al, byte [0x447910]
push eax
mov eax, esi
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov esi, eax
cmp esi, 0x64
jbe 0x40d7b8
mov esi, 0x64
mov eax, esi
push eax
mov al, 0x64
pop edx
sub al, dl
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d7c8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov al, byte [esp + 0x14]
mov byte [0x447910], al
mov eax, dword [esp + 4]
mov dword [0x447914], eax
add esp, 0x24
ret
Function at 0x40ddc0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40deca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 9
push 0
mov eax, esi
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40de97
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x40de8e
cmp dword [ebp - 0x10], 1
jae 0x40de33
mov dword [ebp - 0x10], 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404090
xor edi, edi
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403fa8
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x40de8e
mov eax, dword [ebp - 8]
call fcn.00403fa8
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00403ce8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ddc0
test al, al
jne 0x40de40
inc edi
jmp 0x40de40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, esi
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ded1
lea eax, [ebp - 0x14]
call fcn.00403b0c
lea eax, [ebp - 8]
call fcn.00403b0c
ret

Function at 0x40e640
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00403fa8
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, esi
mov edx, esp
mov ecx, 0x105
call fcn.00403d60
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x40e6f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00403f98
xor eax, eax
push ebp
push 0x40e823
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x40e7f7
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x40e6cc]
call fcn.004048a4
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40e838
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e7f7
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 8]
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
mov eax, esi
call fcn.00405740
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, word [ebx + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebx + 0xc]
call fcn.00405740
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [ebx + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x40e844
call fcn.0040ce04
mov edx, dword [ebp - 0x20]
mov eax, edi
call fcn.00403b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e82a
lea eax, [ebp - 0x20]
call fcn.00403b0c
lea eax, [ebp - 0x18]
mov edx, dword [0x40e6cc]
call fcn.004048b0
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret

Function at 0x40e95c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov bl, 1
mov eax, dword [0x447a00]
call fcn.00403fa8
push eax
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x40e9de
push 4
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [esp], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [esp + 4], eax
push 0
push 0
push 0x10
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
push 0xbb8
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x40e9de
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x40e9e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x40ea5a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x447a28], 0
je 0x40ea0f
mov eax, dword [0x447a28]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
lea eax, [ebp - 4]
mov ecx, dword [0x447a00]
mov edx, 0x40ea6c
call fcn.00403df4
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40ea7c
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x40f110
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f343
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x40f358
mov eax, dword [0x4479f0]
call fcn.00406828
mov edx, dword [ebp - 4]
mov eax, 0x447a18
call fcn.00403b60
mov edx, 0x4479f8
mov eax, dword [0x447a18]
call fcn.0040e6f0
cmp edx, dword [0x447a20]
jne 0x40f16c
cmp eax, dword [0x447a1c]
jb 0x40f1b3
jmp 0x40f16e
jl 0x40f1b3
push 0x50040
push dword [0x447a10]
push 0x40f374
push 0x40f384
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 8]
call fcn.00403fa8
push eax
push 0x40f390
mov eax, dword [0x4478a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x447a08], 0
je 0x40f1c2
call dword [0x447a08]
call fcn.0040e95c
test al, al
jne 0x40f1d2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
mov eax, dword [0x447a18]
call fcn.00403fa8
push eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004064c8
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x40f261
push 0x50030
push dword [0x447a10]
push 0x40f374
push 0x40f3cc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x18]
call fcn.00405c48
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x40f3e0
call fcn.00403df4
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
mov eax, dword [0x4478a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x80
mov eax, dword [0x447a18]
call fcn.00403fa8
push eax
call sub.kernel32.dll_SetFileAttributesA
push dword [0x447a24]
push 0x40f408
push 0x40f41c
push dword [0x447a00]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00403e68
mov edx, dword [ebp - 0x1c]
mov eax, 0x80000002
call fcn.00406758
mov ebx, eax
push 0
push 0x400
mov eax, dword [0x447a18]
call fcn.0040661c
call fcn.00404654
mov ecx, eax
mov edx, 0x40f428
mov eax, ebx
call fcn.0040688c
mov ecx, dword [0x4479f4]
mov edx, 0x40f440
mov eax, ebx
call fcn.004068c4
mov eax, ebx
call fcn.00406904
push 0x50040
push dword [0x447a10]
push 0x40f374
push 0x40f384
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x20]
call fcn.00403fa8
push eax
push 0x40f450
mov eax, dword [0x4478a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.0040e9e8
Function at 0x40f474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f5f5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e95c
test al, al
jne 0x40f49f
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
push 0
push 0x40f60c
push dword [0x447a00]
push 0x40f624
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40f628
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 8]
mov ecx, dword [0x447a00]
mov edx, 0x40f63c
call fcn.00403df4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.0040ddc0
push dword [0x447a24]
push 0x40f650
push 0x40f664
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e68
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.00406728
mov ebx, eax
mov edx, dword [0x447a00]
mov eax, ebx
call fcn.00406910
mov eax, ebx
call fcn.00406904
push 0x50040
push dword [0x447a10]
push 0x40f670
push 0x40f680
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
push 0x40f68c
mov eax, dword [0x4478a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
push 0
push 0x40f6c0
push dword [0x4479fc]
push 0x40f6d8
lea edx, [ebp - 0x18]
mov eax, dword [0x4479fc]
call fcn.00406684
push dword [ebp - 0x18]
push 0x40f6ec
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403e68
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x40f6f8
call fcn.0040e640
mov eax, dword [ebp - 0x1c]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1

Function at 0x40f700
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40f7b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x40f7c4
mov eax, dword [0x4479f0]
call fcn.00406828
mov edx, dword [ebp - 8]
mov eax, 0x447a18
call fcn.00403b60
mov eax, dword [0x447a00]
call fcn.00403fa8
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x447a28], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x40f76a
push 0
call sub.kernel32.dll_ExitProcess_1
push 4
push 0
push 0
push 0xf001f
mov eax, dword [0x447a28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
mov eax, dword [0x4478a8]
call fcn.0040d070
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f7b8
lea eax, [ebp - 8]
call fcn.00403b0c
ret
Function at 0x411a34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411a6d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403bfc
jmp 0x411a76
mov eax, ebx
mov edx, esi
call fcn.00403b60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411a80
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411aa1
mov al, byte [esp]
jmp 0x411aa3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412138
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x411fa0
mov eax, dword [0x446444]
cmp byte [eax], 0
je 0x4121b4
mov eax, dword [0x4463a0]
call fcn.00402ab4
call fcn.0040298c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00410f08
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4121fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4121ea
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x446380]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x447660]
call fcn.0040495c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x412bd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x412c3c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403d60
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00410dd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412c43
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret
Function at 0x42601c
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
push 4
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
push 0
push 0
call fcn.00402b74
fild qword [ebx + 0x58]
fmulp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0x18]
call fcn.00406208
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov eax, dword [ebx + 0x50]
dec eax
xor edx, edx
not eax
not edx
and eax, dword [esp]
and edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_SetFilePointerEx
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_ReadFile
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_VirtualFree_1
add esp, 0x10
pop ebx
ret
Function at 0x4303a4
Capabilities:
Create process on windows

Disassembly:
push ebx
mov bl, byte [0x447c74]
xor bl, 1
test bl, bl
je 0x4303ee
push 0x50044
mov eax, dword [0x447c80]
call fcn.00403fa8
push eax
push 0x4303f4
mov eax, dword [0x4478a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
cmp eax, 6
jne 0x4303ee
push 5
push 0
push 0
push 0x430458
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop ebx
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4ff91f81
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x72704cac
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x72882950
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
push dword [0x7288a034]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 0x18]
mov edx, dword [esi]
mov dword [esp + 0xc], eax
mov eax, dword [eax]
push eax
push edi
push ebx
mov ecx, esi
mov dword [esp + 0x14], eax
call dword [edx + 0x10]
test al, al
je 0x728829a8
mov esi, dword [esi + 0x30]
test esi, esi
je 0x728829a3
push dword [edi + 4]
push dword [edi]
mov edi, esi
push dword [ebx + 4]
push dword [ebx]
push 0
push dword [esp + 0x1c]
call fcn.728830fa
xor eax, eax
inc eax
jmp 0x728829e8
mov edx, dword [esp + 8]
cmp byte [edx + esi + 0x34], 0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
jne 0x728829bf
sub eax, 1
sbb ecx, 0
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edi, dword [esi + 0x30]
test edi, edi
je 0x728829dd
mov eax, dword [esi + 0x18]
mov esi, dword [esi + 0x1c]
push esi
push eax
push esi
push eax
push 1
push edx
call fcn.728830fa
mov eax, dword [esp + 0xc]
call fcn.728846e8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x72884026
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x72884039
pop es
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x72884078

Function at 0x728846e8
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [eax + 0x18]
mov byte [eax + 0x1c], 0
lea eax, [ecx + 4]
or edx, 0xffffffff
lock xadd dword [eax], edx
mov eax, dword [ecx]
jne 0x72884726
call dword [eax + 0xc]
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
add eax, 0x1c
cmp ecx, eax
je 0x72884725
mov eax, dword [ecx]
push 1
call dword [eax]
ret
jmp dword [eax + 8]