joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x46706c]
mov esi, ecx
test eax, eax
je 0x439f66
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x439f7f
cmp byte [eax + 4], 0
je 0x439f7f
add eax, 5
pop esi
pop edi
ret
push 0x46706c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x439f5a
mov eax, dword [0x46706c]
test eax, eax
je 0x439ff2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43a00b
mov edi, eax
test eax, eax
jne 0x439fd0
movzx eax, byte [0x4679f9]
push 4
push 8
call fcn.0041f3c0
add esp, 8
test eax, eax
je 0x43a01f
mov dword [eax], 0x46706c
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x46706c]
test eax, eax
je 0x43a010
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x439fe5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x46706c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x439f95
xor eax, eax
pop esi
pop edi
ret
push 0x46706c
call fcn.00454ac0
add esp, 4
jmp 0x439fc8
push 8
push 4
call fcn.00455080
int3

Function at 0x43a030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x46707c]
mov esi, ecx
test eax, eax
je 0x43a10a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x43a05d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x43a105
mov eax, dword [0x46707c]
test eax, eax
je 0x43a12c
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x43a149
mov edi, eax
test eax, eax
jne 0x43a0c1
movzx eax, byte [0x4679f9]
push 4
push 0xc
call fcn.0041f3c0
add esp, 8
test eax, eax
je 0x43a165
mov dword [eax], 0x46707c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x46707c]
test eax, eax
je 0x43a153
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x43a0d6
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x43a0d8
mov eax, dword [esi + 4]
jmp 0x43a0d8
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x43a105
test ecx, ecx
je 0x43a105
lock dec dword [ecx]
jne 0x43a105
lea ecx, [esp + 4]
call fcn.0042a9a0
add edi, 8
jmp 0x43a14b
push 0x46707c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x43a051
jmp 0x43a05d
push 0x46707c
call fcn.00454ac0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x43a07b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x46707c
call fcn.00454ac0
add esp, 4
jmp 0x43a0b9
push 0xc
push 4
call fcn.00455080
int3
Function at 0x444e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x444ea8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x444ea0
cmp ebx, ebp
ja 0x444f16
cmp ebp, dword [esp + 0x1c]
ja 0x444f22
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x444ea2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x444e90
jmp 0x444eff
ja 0x444ea8
cmp edx, edi
mov ebx, ebp
jne 0x444e65
mov edx, dword [esp + 0x24]
test edx, edx
je 0x444f03
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x444ee0
mov esi, edi
sub ecx, ebx
jns 0x444ef7
jmp 0x444f05
cmp edi, edx
je 0x444f0c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x444f05
xor al, 1
cmp esi, edx
jne 0x444ec0
jmp 0x444f05
xor eax, eax
jmp 0x444f05
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x45d454
call fcn.004550e0
push 0x45d464
push ebp
push ebx
call fcn.00455620
push 0x45d464
push dword [esp + 0x20]
push ebp
call fcn.004555b0
int3

Function at 0x4463a1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4463e0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4463e0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4463e0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4463e0
cmp dword [ecx + 0x74], 0xe
jbe 0x4463e0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x44d658
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x44d6f5
push ebx
push esi
call fcn.0044d621
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044d5b5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x44d6a2
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44d6f4
push edi
push eax
call fcn.0044e275
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x44d6c2
call fcn.0044c113
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44d6f3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044d5b5
add esp, 0x20
test eax, eax
jne 0x44d6e1
push edi
call fcn.0044c113
jmp 0x44d6e9
push ebx
call fcn.0044c113
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x44e9f2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45fd50
push 0x45fd48
push str.FlsAlloc
push 0x1f
call fcn.0044e8b1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44ea26
push dword [ebp + 8]
mov ecx, esi
call dword [0x456188]
call esi
jmp 0x44ea2c
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44ea70
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45fd60
push 0x45fd58
push str.FlsGetValue
push 0x21
call fcn.0044e8b1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44eaa7
push dword [ebp + 8]
mov ecx, esi
call dword [0x456188]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x44eaaf
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45fd68
push 0x45fd60
push str.FlsSetValue
push 0x22
call fcn.0044e8b1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44eae9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x456188]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x453f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x453f6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x453f6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x454ac0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x454b41
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x454b7c
cmp dword [esp + 4], 0
je 0x454b63
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x454b9a
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x467a88]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x467a88], edi
jne 0x454b20
mov byte [0x467a84], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x454b73
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x454bdc
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x454b67
mov esi, dword [esp]
jmp 0x454b73
mov esi, dword [edi]
jmp 0x454b72
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x45b6c8
push 0x45b9c4
push eax
call fcn.004546d0
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x45b978
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x459b60
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x45b9b4
push eax
call fcn.00455150
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x45b978
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x459b60
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00454730
int3
Function at 0x455340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x455391
cmp eax, 1
jne 0x45540e
mov dword [esp], 0x45ce9c
jmp 0x455398
mov dword [esp], 0x45ce9a
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x45542a
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x45ced8
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x445a90
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x445a70
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x445a70
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.00455150
mov edx, 7
mov dword [esp], 0x45ce9e
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x4553ad
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x45cf0c
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x445a90
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x442a50
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x445a70
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x445a70
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.00455150
int3
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10077200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xdaf2b816
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
sub eax, 0xdaf2b816
je 0x10001050
jmp 0x10001038
mov eax, dword [ebp - 0x1c]
sub eax, 0x2365381a
je 0x10001062
jmp 0x1000104b
jmp 0x100010a7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x2365381a
jmp 0x100010a7
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x82
sub byte [edi], 0x44
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x10001073
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100184b0
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
jmp 0x10001022
Function at 0x1001b883
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001b8c2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b8c2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b8c2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001b8c2
cmp dword [ecx + 0x74], 0xe
jbe 0x1001b8c2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001e542
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001e5df
push ebx
push esi
call fcn.1001e50b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001e49f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001e58c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e5de
push edi
push eax
call fcn.1001f4ff
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001e5ac
call fcn.1001cfe4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e5dd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001e49f
add esp, 0x20
test eax, eax
jne 0x1001e5cb
push edi
call fcn.1001cfe4
jmp 0x1001e5d3
push ebx
call fcn.1001cfe4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001e84c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cb8
push 0x10026cb0
push str.FlsAlloc
push 0x1f
call fcn.1001e768
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e880
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025140]
call esi
jmp 0x1001e886
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001e8ca
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cc8
push 0x10026cc0
push str.FlsGetValue
push 0x21
call fcn.1001e768
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e901
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001e909
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cd0
push 0x10026cc8
push str.FlsSetValue
push 0x22
call fcn.1001e768
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e943
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10025140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10023ffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10023ffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x401550f3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x60d95bbb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402edc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x44f008], 0x8088405
inc edx
mov dword [ebx + 0x44f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x44f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033ac
xor eax, eax
push ebp
push 0x4033a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x44f024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x44f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x451048], 0
je 0x404111
cmp word [0x45121c], 0xd7b2
jne 0x4040d9
cmp dword [0x451224], 0
jbe 0x4040d9
mov eax, 0x451218
call dword [0x451234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x44f070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404138
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x44f034], 0
jne 0x40412d
push 0
push 0x44f068
push 0x44f070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405ebe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ef8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405ea8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ec5
lea eax, [ebp - 0x10]
call fcn.00404234
ret

Function at 0x40ae8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aec5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404324
jmp 0x40aece
mov eax, ebx
mov edx, esi
call fcn.00404288
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aed8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aef9
mov al, byte [esp]
jmp 0x40aefb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b590
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b3f8
mov eax, dword [0x44ffa4]
cmp byte [eax], 0
je 0x40b60c
mov eax, dword [0x44fddc]
call fcn.00402d48
call fcn.00402bc4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040867c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b654
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b642
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x44fd90]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x451664]
call fcn.004052c4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret