joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11359eb
Capabilities:
Encode data using xor

Disassembly:
and ah, byte [0x2c056301]
out dx, eax
xchg edi, eax
pop ss
push ebp
xor eax, dword [eax + 0x4e8d0462]
sahf
test dword [edx - 0x720a746a], ebx
mov esi, ebp
lea eax, [ecx + ecx*4 + 0x5fad3aa9]
mov esi, ebp
lea eax, [ecx + ecx*4 + 0x5fad3aa9]
dec cl
pop ecx
jno 0xe1f675
adc dh, byte [edx - 0x7e0aa2e5]
xor esp, dword [ebx - 0xd77de57]
pop edx
and dl, byte [eax + 0x1bb22228]
jno fcn.011359eb
popfd
mov ah, 0xde
jnp 0x11359d5
sbb dword [eax - 0x2d41f566], ebx
jl 0x1135a29
lds esi, [eax + edx*8 + 0xf46f2d4]
aaa
insd dword es:[edi], dx
das
cmp eax, dword [ecx + 7]
mov ebp, 0xbfeb5854
daa
inc ebp
outsb dx, byte [esi]
bound ebp, qword [ecx + 0x5d]
pop ss
push ecx
jne 0x1135ab2
jno 0x1135a54
pop ss
pop eax
aam 0xf
rcr dword [eax + 0x64605961], 0x77
sub edi, edi
mov edx, 0xe46575b
inc ebp
dec ebx
std
mov word [ebp + 0x31], es
pushal
ja 0x1135a71
invalid
jo 0x1135a9a
ja 0x1135a44
pop ds
inc ebp
imul ebx, ebp, 0x67
loope 0x1135aad
lcall 0xbaa0, 0x116fca24
test eax, 0x472684d1
lodsd eax, dword [esi]
jle 0x1135ac4
inc ebx
stc
mov eax, 0xac79a1f2
xor byte [ebx - 0x1b], 0x86
mov eax, dword [0x7382ac79]
in eax, 0x86
invalid
jne 0x1135a3c
push esi
inc edi
test dword [esi + 0x12], esi
push edi
sbb eax, 0xdd91729c
mov eax, 0x7a2963a2
out dx, al
imul eax, dword [ebp - 0x4c], 0x7b
mov esp, 0xa892c1a5
inc ebx
and byte [edx - 0x3e3edd55], 0x4b
shl dword ss:[edi - 0x65ab1468], 0xe3
mov eax, dword [0xeb3070ea]
movsd dword es:[edi], dword [esi]
rcl dword [edx - 0x7dbcc958], 0xa2
stosd dword es:[edi], eax
and al, cl
ror dword [ebx + 0x36], 0xc1
cmpsd dword [esi], dword es:[edi]
cwde
jmp 0x1135b19
push esp
lcall 0xeb30, 0x70eaa1e3
fidivr dword [edx + 0x69]
lahf
jmp 0x12591529
jmp 0xb71f156d
ror esi, 0x45
sbb eax, 0x57c1a2af
push ecx
jnp 0x1135b14
mov edi, 0xe9230226
fst dword [edx - 0x3c]
ret 0x64d6

Function at 0x11383e7
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xf6
fdivr st(6)
enter 0xffffffffffffc166, 0xfffffffffffffffa
mov al, dl
enter 0x6642, 0xffffffffffffffff
ret 0xd233
not ecx
call fcn.01122891
sbb dword [esi], eax
loopne 0x112009f
adc eax, 0x9153b4fa
mov edi, 0xc21de790
test byte [ebx], dl
jmp 0x11200d1
mov dh, 0xb0
in al, 0x74
push ebx
in al, 0xeb
jne 0x1120049
add byte [edi], ch
xor dword [edi - 0x3c530d14], 0xedffe8f9
invalid
call 0x8110eea3
in eax, dx
imul ebx, dword [0xcbfcda26], 0x1120056
adc byte [edx], 0x96
invalid
int1
and eax, ebp
je 0x112008d
scasd eax, dword es:[edi]
xor al, 0x23
mov ah, 0xdb
push ebp
adc ah, al
fmulp st(1)
pop ds
xchg esp, eax
invalid
mov eax, dword [ebp + eax - 0x542b8b27]
mov dword [esp], 0x6902c3b2
adc ebp, 4
push 0x999e83a5
xor ecx, ecx
not dword [esp + 4]
test eax, eax
push 0x1296d393
lea esp, [esp + 0xc]
je 0x1138465
push 0x960d13a3
mov dword [esp], ebx
mov ebx, 0xcf8b873d
movzx ebx, byte [edx]
push 0x5ab5379f
xor ebx, ecx
push 0x7780f5a4
and ebx, 0xff
sar word [esp], 0x81
mov ebx, dword [ebx*4 + 0xc8d264]
shr ecx, 8
xor ecx, ebx
dec dword [esp]
inc edx
xor ecx, 0xf697ae0a
sar dword [esp + 4], 0xbf
dec eax
lea esp, [esp + 8]
jne 0x113841f
pop ebx
jmp 0x112006d
Function at 0x118edc3
Capabilities:
Encode data using xor

Disassembly:
call fcn.01123a6d
xor bp, bx
add bp, 0xc606
call fcn.00e25c43
mov ecx, 0x4f089e07
mov esi, dword [edi + ecx - 0x4f089e07]
sal cl, 1
mov cl, byte [edi + ecx - 0x4f089e0a]
ja 0x117b5a1
sbb ecx, edi
inc eax
neg ch
imul ecx, dword [ebx - 0x4f6be78c], 0x4736f207
ficom dword [ecx - 0x44]
inc eax
and byte [eax + 0xcbc37bd], dl
xchg ecx, eax
popfd
popal
push cs
stosd dword es:[edi], eax
push es
mov ebx, 0x7f2ca660
adc al, 0x96
sub dl, byte es:[0x580d04bc]
jae 0x118ee84
pop eax
mov word [ebx], cs
and al, 0x4b
mov bh, 0xc8
cld
dec esi
scasd eax, dword es:[edi]
outsd dx, dword [esi]
adc al, 0xa3
hlt
xor bl, byte [ecx]
lodsd eax, dword [esi]
inc ebx
and al, 0x50
jge 0x118ee84
or esi, edx
mov dword [esi], edi
pop es
mov dword [eax + edi*4 + 0x15], edi
invalid
Function at 0x4082f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408380
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408380
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408333
test edx, 3
jne 0x408322
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40832d
jmp 0x408333
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408333
cmp dword [ecx - 8], 1
je 0x40833d
mov edx, ebx
or edx, 3
call fcn.00404f2c
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40834f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004047e0

Function at 0x40838c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40841c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40841c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4083cf
test edx, 3
jne 0x4083be
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4083c9
jmp 0x4083cf
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4083cf
cmp dword [ecx - 8], 1
je 0x4083d9
mov edx, ebx
or edx, 3
call fcn.00404f2c
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4083eb
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004047e0

Function at 0x41ed38
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ed3e
ret
Function at 0x42fa74
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff94
mov esi, eax
mov edi, esp
xor ebx, ebx
call fcn.0042b14c
call fcn.0042ac40
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x42fbf5
mov eax, edi
xor ecx, ecx
mov edx, 0x54
call fcn.00403310
mov dword [edi], 0x54
mov eax, dword [0x466d90]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [edi + 4], eax
mov eax, dword [0x4697f4]
mov dword [edi + 0x3c], eax
movzx eax, byte [esi + 0xe8]
dec al
je 0x42fad5
dec al
jne 0x42fad9
add dword [edi + 0x10], 4
jmp 0x42fad9
add dword [edi + 0x10], 8
test byte [esi + 0x60], 1
je 0x42fae3
add dword [edi + 0x10], 0
test byte [esi + 0x60], 2
je 0x42faed
add dword [edi + 0x10], 0x10
test byte [esi + 0x60], 4
je 0x42fafa
add dword [edi + 0x10], 0x100
test byte [esi + 0x60], 8
je 0x42fb07
add dword [edi + 0x10], 0x80000
test byte [esi + 0x60], 0x10
je 0x42fb14
add dword [edi + 0x10], 0x200
test byte [esi + 0x60], 0x20
je 0x42fb1e
add dword [edi + 0x10], 0x20
lea ecx, [esp + 0x54]
mov edx, dword [esi + 0x88]
mov eax, dword [esi + 0x84]
call fcn.0041324c
mov eax, dword [esp + 0x54]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x70]
push eax
lea eax, [esp + 0x60]
push eax
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x68]
mov eax, dword [esi + 0x64]
call fcn.00413274
push esi
push edi
lea esi, [esp + 0x64]
add edi, 0x1c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [esi + 0x80]
push eax
lea eax, [esp + 0x60]
push eax
mov ecx, dword [esi + 0x7c]
mov edx, dword [esi + 0x78]
mov eax, dword [esi + 0x74]
call fcn.00413274
push esi
push edi
lea esi, [esp + 0x64]
add edi, 0x2c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [edi + 0x44], 0x42e458
or dword [edi + 0x10], 0x400
push edi
call fcn.0042b1b0
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x42fbf5
mov eax, dword [edi + 0x14]
mov dword [esi + 0x84], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x88], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x7c], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x42fbe8
push eax
call fcn.00406928
mov eax, dword [edi + 0xc]
test eax, eax
je 0x42fbf5
push eax
call fcn.00406928
mov eax, ebx
add esp, 0x6c
pop edi
pop esi
pop ebx
ret
Function at 0x461d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c94
xor eax, eax
push ebp
push 0x461f5d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call fcn.00406b20
push edx
push esi
mov esi, 0x156
sub esi, 0x45
or edx, 0x53
nop
nop
nop
nop
nop
push esi
pop esi
and esi, 0x3b
add esi, 0x3b
inc esi
push esi
pop esi
inc esi
xchg edx, esi
pop esi
pop edx
lea eax, [ebp - 0x10]
call fcn.004047e0
call fcn.004068a0
push edx
push esi
sub edx, 0x13c
nop
nop
nop
nop
sub esi, 0xbc
dec esi
xchg esi, edx
xor edx, 0x137
xor esi, 0x150
or edx, 0x1a3
or edx, 0x1f
pop esi
pop edx
mov dl, 1
mov eax, dword [0x412744]
call fcn.0040399c
mov dword [ebp - 0x1c], eax
push 1
call fcn.00406948
push edx
push ebx
push edx
pop edx
mov ebx, 0x13b
nop
nop
sub edx, 0xb6
mov edx, 0xb5
dec edx
mov edx, 0x150
add ebx, 0x195
add ebx, 0x2e
pop ebx
pop edx
mov dl, 0x20
mov eax, dword [ebp - 0x1c]
call fcn.00415fac
call fcn.00406880
push ebx
xor ebx, 0x11
xor ebx, 0x194
or ebx, 0x16e
push ebx
pop ebx
xchg ebx, ebx
and ebx, 0x2f
or ebx, 0x11c
dec ebx
add ebx, 0x1a9
nop
nop
nop
nop
xchg ebx, ebx
pop ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.00415d94
push 1
call fcn.00406df0
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x461ef6
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
push 1
call fcn.00406df0
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.004089b8
mov dword [ebp - 0x18], eax
push 1
call fcn.00406848
lea eax, [ebp - 0x2c]
mov dl, byte [ebp - 0x18]
add dl, byte [ebp - 8]
call fcn.004049c8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.00404aac
call fcn.004068a0
push edx
push esi
sub edx, 0x13c
nop
nop
nop
nop
sub esi, 0xbc
dec esi
xchg esi, edx
xor edx, 0x137
xor esi, 0x150
or edx, 0x1a3
or edx, 0x1f
pop esi
pop edx
call fcn.004068a0
push edx
push esi
sub edx, 0x13c
nop
nop
nop
nop
sub esi, 0xbc
dec esi
xchg esi, edx
xor edx, 0x137
xor esi, 0x150
or edx, 0x1a3
or edx, 0x1f
pop esi
pop edx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x461e48
call fcn.004068a0
push edx
push esi
sub edx, 0x13c
nop
nop
nop
nop
sub esi, 0xbc
dec esi
xchg esi, edx
xor edx, 0x137
xor esi, 0x150
or edx, 0x1a3
or edx, 0x1f
pop esi
pop edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f64
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404804
lea eax, [ebp - 0x10]
call fcn.004047e0
lea eax, [ebp - 4]
call fcn.004047e0
ret
Function at 0x1005d91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a028]
jne 0x1005d9a
ret
jmp 0x1005d9f
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005dc3
call eax
cmp dword [0x101b0d0], 0
je 0x1005e0a
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005d91
add ebp, 0x2a8
leave
ret

Function at 0x100702b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007066
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007043
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007082
dec esi
je 0x100707b
dec esi
jne 0x1007087
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x408949
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
push esi
pop edx
mov esi, 0xfa10af9f
call fcn.0040896f
xor dword [ecx], edi
mov edx, esi
and esi, esi
inc ecx
cmp ecx, eax
jne fcn.00408949
ret
Function at 0x406650
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4066b6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404d04
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403630
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4066a0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066bd
lea eax, [ebp - 0x10]
call fcn.00404a94
ret

Function at 0x4082b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404f30
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4082c9
test al, 0x10
jne 0x4082cd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x408414
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404f30
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x408436
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40aeb8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aef1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404b84
jmp 0x40aefa
mov eax, ebx
mov edx, esi
call fcn.00404ae8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40af04
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40af25
mov al, byte [esp]
jmp 0x40af27
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40b5bc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b424
mov eax, dword [0x41bbd8]
cmp byte [eax], 0
je 0x40b638
mov eax, dword [0x41baec]
call fcn.00403244
call fcn.00402ae8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040880c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b680
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b66e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41bac4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41c660]
call fcn.00405af8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c42c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c490
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d04
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407fa8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c497
lea eax, [ebp - 0xc]
call fcn.00404a94
ret

Function at 0x41897c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x418a4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.kernel32.dll_GetTempPathA
mov esi, eax
mov eax, edi
mov edx, esi
call fcn.004050bc
mov eax, dword [edi]
call fcn.00404f30
push eax
push esi
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x418a2d
mov eax, dword [edi]
call fcn.00404f30
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404c8c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040c228
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00404ae8
test bl, bl
je 0x418a34
push dword [edi]
push 0x418a68
lea eax, [ebp - 0x14]
mov edx, dword [0x41bc18]
add edx, 0x187
call fcn.00404cf8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404df0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040c228
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404ae8
jmp 0x418a34
mov eax, edi
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418a56
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404ab8
ret
Function at 0x418a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x418b08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.004050bc
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x418ae6
mov eax, dword [ebx]
call fcn.00404f30
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x418ae6
mov eax, dword [ebx]
call fcn.00404f30
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404c8c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040c228
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404ae8
jmp 0x418aed
mov eax, ebx
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418b0f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ab8
ret

Function at 0x418b64
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x418c00
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, edi
call fcn.00404f30
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.004050bc
push esi
mov eax, dword [ebx]
call fcn.00404f30
push eax
mov eax, edi
call fcn.00404f30
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x418bde
mov eax, dword [ebx]
call fcn.00404f30
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404c8c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040c228
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404ae8
jmp 0x418be5
mov eax, ebx
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418c07
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ab8
ret
Function at 0x418cd8
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor eax, eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x158]
mov edx, dword [0x406fe0]
call fcn.004053e0
xor eax, eax
push ebp
push 0x418eda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x15c]
mov ecx, 0x418ef0
call fcn.00404d7c
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x10
call fcn.004084a8
mov ebx, eax
test ebx, ebx
jne 0x418e3b
xor eax, eax
push ebp
push 0x418e34
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x418e1b
mov eax, dword [ebp - 0x14c]
mov edx, 0x418efc
call fcn.00404e7c
je 0x418e06
mov eax, dword [ebp - 0x14c]
mov edx, 0x418f08
call fcn.00404e7c
je 0x418e06
test byte [ebp - 0x150], 0x10
je 0x418e06
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404d30
inc eax
push eax
lea eax, [ebp - 0x160]
mov ecx, 0x418f14
mov edx, dword [ebp - 0x14c]
call fcn.00404d7c
mov eax, dword [ebp - 0x160]
mov edx, dword [ebp + 8]
add edx, 0xfffffffc
pop ecx
call fcn.00405018
mov eax, dword [ebp + 8]
push eax
call fcn.00418cd8
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404d30
mov ebx, eax
mov eax, dword [ebp - 0x14c]
call fcn.00404d30
sub ebx, eax
inc ebx
push ebx
mov eax, dword [ebp - 0x14c]
call fcn.00404d30
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
pop edx
call fcn.00404fd0
lea eax, [ebp - 0x158]
call fcn.004084f8
mov ebx, eax
test ebx, ebx
je 0x418d61
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418e3b
lea eax, [ebp - 0x158]
call fcn.0040851c
ret
lea edx, [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040c268
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.00404b2c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.00408414
mov eax, dword [0x41bc18]
cmp byte [eax + 0x196], 0
je 0x418e8f
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404f30
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x418e9a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004087f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418ee1
lea eax, [ebp - 0x164]
call fcn.00404a94
lea eax, [ebp - 0x160]
call fcn.00404a94
lea eax, [ebp - 0x15c]
call fcn.00404a94
lea eax, [ebp - 0x158]
mov edx, dword [0x406fe0]
call fcn.004054a4
ret