joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.00408151
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.00408151
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.00408151
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00408151
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.00408151
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00408151
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.00408151
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x408151
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408160
pop dword [ebp - 0x14]
mov eax, 0x408160
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x40aa9
push 0
mov eax, 0x5170fef9
add eax, 0xaed1531f
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xd939a16e
sub ecx, 0xd9394dea
mov ebx, eax
mov edx, 0x2a6cfca
sub edx, 0x2637bca
add edx, dword [ebp - 0x14]
mov edi, 0x872c6a34
sub dword [ebp - 4], ebx
mov esi, dword [edx]
add dword [ebp - 8], edx
xor esi, edi
sub dword [ebp - 0x10], edi
mov dword [ebx], esi
add ebx, 0xea66c9b5
add ebx, 0x1599364f
add edx, 0x3454ac68
add edx, 0xcbab539c
loop 0x4081b4
add eax, 0xf0153b44
add eax, 0xfec059f
xor ebx, ebx
add ebx, eax
add eax, 0xe6095474
add eax, 0x19f6ab91
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404d5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x404d6c
pop dword [ebp - 0x30]
mov eax, 0x404d6c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x47107997
sub dword [ebp - 0x40], 0xf8be344c
mov dword [ebp - 0x3c], 0xf36464e0
sub dword [ebp - 0x3c], 0xc131189b
mov dword [ebp - 0x38], 0x36702a9a
add dword [ebp - 0x38], 0x15dc1994
mov dword [ebp - 0x34], 0x56f53a5f
add dword [ebp - 0x34], 0xa90ac5a1
lea eax, [ebp - 0x40]
push eax
mov eax, 0x19d13bd6
add eax, 0xe66f9476
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x80c99575
sub dword [ebp - 0x40], 0xc572c1f
mov dword [ebp - 0x3c], 0xdfb795bb
sub dword [ebp - 0x3c], 0x9e4b3446
mov dword [ebp - 0x38], 0x22bcbb5b
sub dword [ebp - 0x38], 0xbf4d4eef
mov dword [ebp - 0x34], 0xaa145786
sub dword [ebp - 0x34], 0xaa145786
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xc80bbb14
sub eax, 0xc7caeacc
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39747
push 0
call eax
mov ecx, 0x8404bdad
sub ecx, 0x840475a9
mov edi, eax
mov ebx, 0xbc84e3d3
add ebx, 0x43bccc2d
add ebx, dword [ebp - 0x30]
mov edx, 0x7c762d1f
add edx, 0x127577e
add dword [ebp - 0x14], ecx
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x3e6e5cb1
sub esi, edx
add dword [ebp - 0x1c], 0x848a09f7
mov dword [edi], esi
add dword [ebp - 0x24], edi
add edi, 0x9a6f0e68
sub edi, 0x9a6f0e64
add ebx, 0xf4a8e61
sub ebx, 0xf4a8e5d
loop 0x404e89
add eax, 0x112e3
mov ebx, eax
add eax, 0xea6f642e
add eax, 0x15909bd7
mov ecx, 0x5eba6f0b
sub ecx, 0x5e7a6f0b
add ecx, dword [ebp - 0x30]
call ebx

Function at 0x401910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401923
push esp
mov dword [ebp - 0x24], 0x401640
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019c2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019a3
pop ebp
ret 0x10
Function at 0x406802
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x406811
pop dword [ebp - 8]
mov eax, 0x406811
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1fdbb320
add dword [ebp - 0x18], 0x2e76922b
mov dword [ebp - 0x14], 0x20b1b526
sub dword [ebp - 0x14], 0xee7e68e1
mov dword [ebp - 0x10], 0x4ab1c72c
sub dword [ebp - 0x10], 0xfe6582fe
mov dword [ebp - 0xc], 0x63139303
sub dword [ebp - 0xc], 0x63139303
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x608be75
add dword [ebp - 0x18], 0x6e69aae1
mov dword [ebp - 0x14], 0x14bf6085
add dword [ebp - 0x14], 0x2cad00f0
mov dword [ebp - 0x10], 0x7211da1c
add dword [ebp - 0x10], 0xf15d9250
mov dword [ebp - 0xc], 0xe08ccb5b
add dword [ebp - 0xc], 0x1f7334a5
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9bec9245
add eax, 0x64544e43
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3c476
push 0
call eax
mov ecx, 0x5a4e
mov ebx, eax
mov esi, 0xa55b0dbd
sub esi, 0xa5191dbd
add esi, dword [ebp - 8]
mov edi, 0x3db47815
add edi, 0x26e4e3f1
xor dword [ebp - 4], ecx
mov edx, dword [esi]
mov dword [ebp - 4], 0xed137473
xor edx, edi
sub dword [ebp - 4], ebx
mov dword [ebx], edx
sub dword [ebp - 4], edi
add ebx, 0xcf8d7b9d
sub ebx, 0xcf8d7b99
add esi, 0xdaaa65cd
add esi, 0x25559a37
loop 0x406923
add eax, 0x15c0b
mov ebx, eax
add eax, 0x8ee7557e
add eax, 0x7118aa87
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x406b16
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x40d6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x110]
lea eax, [ebp]
mov edi, dword [ebp + 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406bb4
cmp eax, ebx
jae 0x406bb4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004060ea
pop ecx
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
jmp 0x406ba7
push esi
lea ecx, [edi + 0x18]
call fcn.00403db8
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x406b9b
lea ecx, [ebp - 0x18]
call fcn.0040422a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0040baa8
add ebp, 0x108
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x406e52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x406e61
pop dword [ebp - 0x20]
mov eax, 0x728d2378
sub eax, 0x724cb517
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x376f1
push 0
mov eax, 0x772c7a14
add eax, 0x891466c4
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x8bc02b94
add ecx, 0x744014f5
xor esi, esi
add esi, eax
mov edx, 0x650d825
add edx, 0xf9f0639f
add edx, dword [ebp - 0x20]
mov ebx, 0xa5c0edf7
add ebx, 0xb686af2f
xor dword [ebp - 0x18], ecx
mov edi, dword [edx]
xor dword [ebp - 0x14], 0x89cb1d93
sub edi, ebx
xor dword [ebp - 4], 0x86354a53
mov dword [esi], edi
sub dword [ebp - 0x18], 0x9f873d82
add esi, 0xc7245f60
add esi, 0x38dba0a4
add edx, 4
loop 0x406ec2
add eax, 0x1ccc73d4
sub eax, 0x1ccb7edd
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x416b06af
add ecx, 0xbed4f951
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4035fc
pop dword [ebp - 0x18]
mov eax, 0x3ec50f8d
sub eax, 0x3e84d991
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x7d956678
sub dword [ebp - 0x28], 0x2f43212d
mov dword [ebp - 0x24], 0x2f693c06
sub dword [ebp - 0x24], 0xfd35efc1
mov dword [ebp - 0x20], 0x18327f30
add dword [ebp - 0x20], 0x3419c4fe
mov dword [ebp - 0x1c], 0x7bc7a702
sub dword [ebp - 0x1c], 0x7bc7a702
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xded7fcb7
add dword [ebp - 0x28], 0x959a6c9f
mov dword [ebp - 0x24], 0x2e30cae2
sub dword [ebp - 0x24], 0xecc4696d
mov dword [ebp - 0x20], 0x2e4792eb
sub dword [ebp - 0x20], 0xcad8267f
mov dword [ebp - 0x1c], 0x2b205e6e
add dword [ebp - 0x1c], 0xd4dfa192
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x8cbb13a2
add eax, 0x73855c7e
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3d7d5
push 0
call eax
mov ecx, 0x969a871f
add ecx, 0x6965d816
mov edi, eax
mov esi, 0x1358dd30
add esi, 0xece7ead0
add esi, dword [ebp - 0x18]
mov ebx, 0xbcba7e2e
add ebx, 0x3acb514
mov edx, dword [esi]
sub dword [ebp - 4], 0x240b7261
sub edx, ebx
mov dword [ebp - 0x10], 0xc8d68d70
mov dword [edi], edx
xor dword [ebp - 4], ecx
add edi, 0xfb804670
sub edi, 0xfb80466c
add esi, 0x5c27c6cd
add esi, 0xa3d83937
loop 0x403719
add eax, 0x4e2b1f8b
add eax, 0xb1d6501c
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x402eb8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004046c8
test esi, esi
jne 0x402eef
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004047b8
jmp 0x402f10
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d54
mov dword [esp], eax
test esi, esi
je 0x402f10
cmp dword [ebx], 0
je 0x402f10
dec esi
jmp 0x402ef7
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403704
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a7020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40379c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40377c
xor eax, eax
push ebp
push 0x403775
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40377c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4a7020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a7020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044a0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ab04c], 0
je 0x404501
cmp word [0x4ab220], 0xd7b2
jne 0x4044c9
cmp dword [0x4ab228], 0
jbe 0x4044c9
mov eax, 0x4ab21c
call dword [0x4ab238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a7074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404528
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4a7030], 0
jne 0x40451d
push 0
push 0x4a706c
push 0x4a7074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40467c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402af4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4ab04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404644
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406a64
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406aca
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404938
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004031c4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406ab4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ad1
lea eax, [ebp - 0x10]
call fcn.004046c8
ret

Function at 0x409694
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b88
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4096ad
test al, 0x10
jne 0x4096b1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40ccb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cced
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004047b8
jmp 0x40ccf6
mov eax, ebx
mov edx, esi
call fcn.0040471c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cd00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cd21
mov al, byte [esp]
jmp 0x40cd23
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d3b8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d220
mov eax, dword [0x4aa25c]
cmp byte [eax], 0
je 0x40d434
mov eax, dword [0x4a9df8]
call fcn.00402ff4
call fcn.00402c80
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004099b4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d47c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d46a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4a9d64]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ab668]
call fcn.00405e64
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40dd2c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40de02
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404760
lea eax, [ebp - 8]
call fcn.00404bd8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ddec
mov eax, ebx
call fcn.00402af4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40dde5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40ddcf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40de14
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ddcf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ddec
mov eax, dword [ebp - 0x10]
call fcn.00402b24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de09
lea eax, [ebp - 8]
call fcn.004046c8
ret

Function at 0x40e414
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e478
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404938
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004092f4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e47f
lea eax, [ebp - 0xc]
call fcn.004046c8
ret

Function at 0x41fdb0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041fc08
dec esi
jne 0x41fdd2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x420f2c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0x4ab88c
cmp dword [esi], 0
jne 0x420fd2
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x4ab888]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x4a7408
mov ecx, 2
call fcn.00402d14
mov edx, 0x420f04
mov eax, dword [ebp - 8]
add eax, 5
call fcn.00420f24
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.00420f24
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x420f99
mov eax, dword [ebp - 8]
mov dword [0x4ab888], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x422558
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42255e
ret

Function at 0x424be8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x424c39
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x424c20
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x424c10
jmp 0x424c39
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x424c21
pop ebx
mov esp, ebp
pop ebp
ret