joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00406f78
mov eax, dword [ebp - 0xc]
call fcn.00406f98
mov eax, dword [ebp - 0x10]
call fcn.00406f98
xor eax, eax
push ebp
push 0x50f77c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00407004
lea edx, [ebp - 0x18]
mov eax, dword [0x51f7b0]
call fcn.0050c900
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, 0x50f788
call fcn.00409d68
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, 0x50f798
call fcn.00409d68
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040703c
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
mov eax, dword [ebp - 0x14]
call fcn.0040703c
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 0x14]
call fcn.00412994
mov eax, dword [ebp - 0x234]
call fcn.0040703c
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x24]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x22e]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406c64
push 0
mov eax, dword [ebp - 8]
call fcn.00406dd4
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f783
lea eax, [ebp - 0x234]
call fcn.00406fa0
lea eax, [ebp - 0x20]
call fcn.00409d24
lea eax, [ebp - 0x1c]
call fcn.00409d24
lea eax, [ebp - 0x18]
call fcn.00409d24
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406fa8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406c18
ret
Function at 0x50fd1c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcbc
xor eax, eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x330], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50ff48
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x330]
mov eax, dword [0x51f93c]
mov eax, dword [eax]
call fcn.004a20c4
mov eax, dword [ebp - 0x330]
lea edx, [ebp - 0x32c]
call fcn.00412994
mov edx, dword [ebp - 0x32c]
lea eax, [ebp - 4]
mov ecx, 0x50ff60
call fcn.0040747c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2d4]
call fcn.0040493c
lea eax, [ebp - 0x2d4]
call fcn.004046d4
call fcn.00404380
mov edx, 0x50ff88
lea eax, [ebp - 0x2d4]
call fcn.00407958
call fcn.00404d98
call fcn.00404380
push 0x50ffa0
lea edx, [ebp - 0x338]
mov eax, dword [0x51f93c]
mov eax, dword [eax]
call fcn.004a20c4
push dword [ebp - 0x338]
push 0x50ffb8
lea eax, [ebp - 0x334]
mov edx, 3
call fcn.00407560
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0x2d4]
call fcn.00407958
call fcn.00404d98
call fcn.00404380
push 0x50ffc8
lea edx, [ebp - 0x340]
mov eax, dword [0x51f93c]
mov eax, dword [eax]
call fcn.004a20c4
push dword [ebp - 0x340]
push 0x50ffb8
push 0x50ffec
lea eax, [ebp - 0x33c]
mov edx, 4
call fcn.00407560
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2d4]
call fcn.00407958
call fcn.00404d98
call fcn.00404380
push 0x50ffa0
push dword [ebp - 4]
push 0x50ffb8
lea eax, [ebp - 0x344]
mov edx, 3
call fcn.00407560
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2d4]
call fcn.00407958
call fcn.00404d98
call fcn.00404380
lea eax, [ebp - 0x2d4]
call fcn.00404a00
call fcn.00404380
lea eax, [ebp - 0x328]
xor ecx, ecx
mov edx, 0x44
call fcn.00404ae4
mov dword [ebp - 0x2fc], 1
mov word [ebp - 0x2f8], 0
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x328]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040703c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x50ff22
mov eax, dword [ebp - 0x2e0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2e4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ff4f
lea eax, [ebp - 0x344]
mov edx, 7
call fcn.00406fa8
lea eax, [ebp - 4]
call fcn.00406fa0
ret
Function at 0x510000
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebx
add esp, 0xffffff9c
mov ebx, eax
mov dword [esp + 0x58], 0xc
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0xffffffff
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x44
call fcn.00404ae4
mov dword [esp + 0x14], 0x44
mov dword [esp + 0x40], 0x101
mov word [esp + 0x44], 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x28
push 0xffffffffffffffff
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x74]
push eax
push ebx
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x510088
mov dword [esp], 0x103
push esp
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x510088
push 0xa
call sub.kernel32.dll_Sleep_2
add esp, 0x64
pop ebx
ret

Function at 0x1000113d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call 0x1000113d
pop ecx
push 0x8b04c483
inc ebp
or al, 0x8b
dec ebp
or byte [ebx + 0x4598d10], cl
mov dword [ecx], edx
mov edi, dword [eax]
lea esi, [eax + 4]
mov dword [ebp + 0xc], ebx
xor ecx, ecx
sub ebx, esi
mov eax, dword [esi]
add esi, 4
mov edx, eax
sub eax, ecx
xor edx, edi
add eax, edi
mov edi, ecx
mov dword [ebx + esi - 4], edx
imul edi, ecx
xor eax, edi
inc ecx
cmp ecx, 7
mov edi, eax
jl 0x10001159
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0x4e4e4f4b
je 0x1000118b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
jmp 0x1000118f
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x100011da
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x100011da
push 0x8b04c483
inc ebp
or byte [ebp + 0x5e0375c0], al
pop ebp
ret
Function at 0x4a4f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6d000]
push edi
jmp 0x4a4f2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a4f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4f20
mov eax, 1
add ebx, ebx
jne 0x4a4f43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a4f54
jne 0x4a4f73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4f73
dec eax
add ebx, ebx
jne 0x4a4f60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a4f38
add ebx, ebx
jne 0x4a4f6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a4fc5
xor ecx, ecx
sub eax, 3
jb 0x4a4f8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a4ffa
sar eax, 1
mov ebp, eax
jmp 0x4a4f96
add ebx, ebx
jne 0x4a4f96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4f64
inc ecx
add ebx, ebx
jne 0x4a4fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4f64
add ebx, ebx
jne 0x4a4fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a4fa6
jne 0x4a4fc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a4fa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a4fe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a4fd6
jmp 0x4a4f26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a4fe4
add edi, ecx
jmp 0x4a4f26
pop esi
mov edi, esi
mov ecx, 0x2c6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a5002
cmp byte [edi], 0x11
jne 0x4a5002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a5007
lea edi, [esi + 0xa1000]
mov eax, dword [edi]
or eax, eax
je 0x4a507f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc4838]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc4950]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a5034
mov ecx, edi
jns 0x4a5063
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc4954]
or eax, eax
je 0x4a5079
mov dword [ebx], eax
add ebx, 4
jmp 0x4a5051
call dword [esi + 0xc4964]
mov ebp, dword [esi + 0xc4958]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a50b3
sub esp, 0xffffff80
jmp 0x454bde
Function at 0xf4c1000
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0xfffffff6
mov dword [esp + 0x10], edi
mov esi, 0xf4cc7c6
lea ecx, [eax + 0xa]
sub ebp, eax
xor eax, eax
add esi, 3
mov al, byte [ecx - 2]
add ecx, 3
mov edx, eax
xor eax, eax
mov al, byte [esi - 5]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
xor eax, eax
mov al, byte [ecx - 4]
mov dword [esp + 0x10], edx
mov edx, eax
xor eax, eax
mov al, byte [esi - 4]
sub eax, edx
cdq
mov ebx, eax
xor eax, eax
mov al, byte [esi - 3]
xor ebx, edx
sub ebx, edx
xor edx, edx
mov dl, byte [ecx - 3]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add eax, edi
lea edi, [eax + ebx]
lea eax, [ecx + ebp]
cmp eax, 0x18
jl 0xf4c101e
movzx ax, byte [0xf4cc34e]
movzx cx, byte [0xf4cc83c]
imul eax, edi
imul ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add eax, ecx
pop ebx
pop ecx
ret
Function at 0xf4c3680
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov bp, word [0xf4cc344]
xor ecx, ecx
mov cx, bp
push esi
push edi
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
lea esi, [eax*4 + 0x168]
mov eax, 0xb60b60b7
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x1b4e81b5
mov esi, edx
mov edx, ecx
imul edx, dword [0xf4cc29c]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov edi, edx
mov edx, dword [esp + 0x14]
cmp edi, 0x28a
mov ebx, dword [edx + 0xc]
jle 0xf4c36e2
or eax, 0xffffffff
jmp 0xf4c36fa
cmp edi, 0x1f4
jle 0xf4c36ee
xor eax, eax
jmp 0xf4c36fa
xor eax, eax
cmp edi, 0xfa
setle al
inc eax
imul ecx, eax
add ecx, 0x96
mov eax, 0x1b4e81b5
imul ecx
mov ecx, edx
sar ecx, 5
mov eax, ecx
shr eax, 0x1f
add ecx, eax
cmp bp, 0x12c
jne 0xf4c372d
lea eax, [ecx + ebx]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
jmp 0xf4c3747
lea eax, [ecx + ebx]
cmp bp, 0x258
lea edi, [eax + eax*4]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + edi*2]
cdq
idiv esi
mov edi, eax
mov ebp, dword [esp + 0x18]
cmp edi, 6
mov dword [ebp], 0
jne 0xf4c37b5
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebp, edx
lea eax, [ecx + ebp]
add eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
cdq
idiv esi
cmp eax, edi
jle 0xf4c378f
mov ecx, dword [esp + 0x18]
mov edi, 7
mov dword [ecx], 1
jmp 0xf4c3829
sub ecx, ebp
add ecx, ebx
lea eax, [ecx + ecx*4]
shl eax, 1
cdq
idiv esi
cmp eax, 6
jge 0xf4c3829
mov edx, dword [esp + 0x18]
mov edi, 5
mov dword [edx], 0xffffffff
jmp 0xf4c3829
test edi, edi
jne 0xf4c37c0
mov edi, 1
jmp 0xf4c3829
cmp edi, 4
je 0xf4c3822
cmp edi, 2
jge 0xf4c37ee
mov eax, 0x66666667
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
add edx, ecx
add edx, ebx
lea eax, [edx + edx*4]
shl eax, 1
cdq
idiv esi
cmp eax, edi
jle 0xf4c3829
inc edi
jmp 0xf4c3822
cmp edi, 8
jne 0xf4c381b
mov eax, 0x66666667
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
add ecx, ebx
lea eax, [ecx + ecx*4]
shl eax, 1
cdq
idiv esi
cmp eax, edi
jge 0xf4c3829
mov edi, 7
jmp 0xf4c3822
jle 0xf4c3829
mov edi, 8
mov dword [ebp], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0f4c2df0
lea ebp, [ebx - 1]
add esp, 4
xor esi, esi
test ebp, ebp
jle 0xf4c38a0
mov edx, dword [esp + 0x14]
push 0
mov eax, dword [edx + 0x10]
push eax
call fcn.0f4c4700
mov ecx, dword [0xf4cc2d0]
mov edx, dword [esp + 0x1c]
and eax, 0xff
push 1
mov byte [ecx + esi], al
mov eax, dword [edx + 0x10]
push eax
call fcn.0f4c4700
mov ecx, dword [0xf4cc2d4]
and eax, 0xff
add esp, 0x10
mov byte [ecx + esi], al
mov eax, dword [0xf4cc7dc]
add eax, dword [0xf4ccba4]
mov dword [0xf4cc7dc], eax
mov dl, byte [eax]
mov al, byte [0xf4cc32c]
and dl, al
inc esi
cmp esi, ebp
mov byte [0xf4cc29b], dl
jl 0xf4c383f
mov eax, dword [esp + 0x14]
push 0
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0f4c4700
mov edx, dword [0xf4cc2d0]
and eax, 0xff
add esp, 8
mov byte [edx + ebx - 1], al
mov eax, dword [0xf4cc2d4]
mov byte [eax + ebx - 1], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0xf4c5600
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x8000
push 0xf4cc550
call dword [sym.imp.MSVCRT.dll__open]
add esp, 8
cmp eax, 0xffffffff
mov dword [0xf4cc314], eax
jne 0xf4c562d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov ebp, dword [0xf4cc814]
push 0x20
push 0xf4cc778
push eax
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
jne 0xf4c5654
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
pop ecx
ret
mov eax, dword [0xf4cc77a]
xor ebx, ebx
test eax, eax
jle 0xf4c56db
mov eax, dword [0xf4cc314]
push 0x20
push 0xf4cc818
push eax
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
je 0xf4c5649
mov ecx, 7
mov eax, 0xf4cc835
cmp byte [eax], 0
jne 0xf4c5694
sub eax, 3
dec ecx
cmp eax, 0xf4cc820
jge 0xf4c5684
inc cl
mov byte [0xf4cc81d], cl
mov cx, word [0xf4cc818]
push ecx
call fcn.0f4c5890
add esp, 4
test eax, eax
mov al, byte [0xf4cc81f]
je 0xf4c56b9
or al, 1
jmp 0xf4c56bb
and al, 0xfe
mov ecx, 8
mov esi, 0xf4cc818
mov edi, ebp
mov byte [0xf4cc81f], al
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0xf4cc77a]
inc ebx
add ebp, 0x20
cmp ebx, eax
jl 0xf4c565f
mov edx, dword [0xf4cc314]
mov word [0xf4cc33c], bx
push edx
call dword [sym.imp.MSVCRT.dll__close]
push 0x8000
push str.user.fa
call dword [sym.imp.MSVCRT.dll__open]
add esp, 0xc
cmp eax, 0xffffffff
mov dword [0xf4cc314], eax
jne 0xf4c571d
pop edi
pop esi
pop ebp
mov word [0xf4cc30c], 0
xor eax, eax
pop ebx
pop ecx
ret
push 0x20
push 0xf4cc778
push eax
call dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [0xf4cc7b4]
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [0xf4cc77a]
xor ebp, ebp
test eax, eax
jle 0xf4c580a
mov ecx, dword [0xf4cc314]
push 0x20
push 0xf4cc818
push ecx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
je 0xf4c5829
mov ecx, 7
mov eax, 0xf4cc835
cmp byte [eax], 0
jne 0xf4c5780
sub eax, 3
dec ecx
cmp eax, 0xf4cc820
jge 0xf4c5770
mov bl, byte [0xf4cc34e]
inc cl
mov byte [0xf4cc81d], cl
xor ecx, ecx
xor eax, eax
mov dl, byte [eax + 0xf4cc820]
cmp dl, 1
jbe 0xf4c57b1
movzx si, byte [eax + 0xf4cc822]
movzx di, byte [eax + 0xf4cc821]
add esi, edi
jmp 0xf4c57b9
movzx si, byte [eax + 0xf4cc821]
movzx di, bl
imul esi, edi
movzx di, byte [0xf4cc83c]
movzx dx, dl
imul edx, edi
add edx, ecx
add eax, 3
cmp eax, 0x18
lea ecx, [edx + esi]
jl 0xf4c5792
mov eax, dword [esp + 0x10]
mov word [0xf4cc81b], cx
mov edi, eax
mov ecx, 8
mov esi, 0xf4cc818
add eax, 0x20
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [0xf4cc77a]
inc ebp
cmp ebp, eax
jl 0xf4c5746
mov ecx, dword [0xf4cc314]
mov word [0xf4cc30c], bp
push ecx
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [0xf4cc314]
push eax
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402f74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x453020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40300c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fec
xor eax, eax
push ebp
push 0x402fe5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403028
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x453020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x453020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cb8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x455048], 0
je 0x403d19
cmp word [0x45521c], 0xd7b2
jne 0x403ce1
cmp dword [0x455224], 0
jbe 0x403ce1
mov eax, 0x455218
call dword [0x455234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45306c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d40
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x453030], 0
jne 0x403d35
push 0
push 0x453064
push 0x45306c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40598c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059f2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059dc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059f9
lea eax, [ebp - 0x10]
call fcn.00403e34
ret

Function at 0x40aa8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aac5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f24
jmp 0x40aace
mov eax, ebx
mov edx, esi
call fcn.00403e88
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aad8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aaf9
mov al, byte [esp]
jmp 0x40aafb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b180
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40aff8
mov eax, dword [0x45409c]
cmp byte [eax], 0
je 0x40b1fc
mov eax, dword [0x453ec0]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004082c4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b244
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b232
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x453e70]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x455664]
call fcn.00404ea0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40ba98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bb6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ecc
lea eax, [ebp - 8]
call fcn.00404344
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bb58
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bb51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042f4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bb3b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bb80
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bb3b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb58
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb75
lea eax, [ebp - 8]
call fcn.00403e34
ret

Function at 0x40bfec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c050
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040a4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407e54
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c057
lea eax, [ebp - 0xc]
call fcn.00403e34
ret

Function at 0x41a178
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x455884
cmp dword [edi], 0
jne 0x41a1f4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x455880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4533ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a150
lea eax, [esi + 5]
call fcn.0041a170
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a170
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a1c9
mov dword [0x455880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b410
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b416
ret
Function at 0x41d858
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41d8a9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41d890
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41d880
jmp 0x41d8a9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41d891
pop ebx
mov esp, ebp
pop ebp
ret