joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100030b4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x1001d9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002a034]
xor eax, ebp
mov dword [ebp + 0x104], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1001ec0c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10015a48
add esp, 0xc
test eax, eax
jne 0x100031a9
push dword [ebp - 0x18]
call fcn.10015a48
cmp dword [0x1002aa80], 0
pop ecx
je 0x10003122
xor eax, eax
inc eax
jmp 0x100031ab
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, esi
ja 0x100031a9
test eax, eax
je 0x100031a9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000330b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push str.JavaDeployReg.log
call fcn.1000330b
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.100033d2
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10003177
call fcn.100037d1
push 0x1001ec38
lea ecx, [ebp - 0x10]
call fcn.100033b4
push eax
push 0x1002aa80
call fcn.10015a48
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
test ecx, ecx
je 0x100031a4
call fcn.100037d1
lea eax, [esi + 1]
jmp 0x100031ab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.10004926
add ebp, 0x108
leave
ret

Function at 0x10003656
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.10015a48
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036e0
lea eax, [esp + 0x28]
push eax
call fcn.10003656
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x100036bb
call fcn.1000342b
push ebx
mov ecx, edi
call fcn.10003445
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.1000342b
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x11c
ret 4
Function at 0x10003bc2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10005d80
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10015a48
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10015a48
push 0x10021be8
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10015a48
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10005d80
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003c67
sub ecx, edx
cmp ecx, 6
jbe 0x10003c8e
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10015a48
pop ecx
pop ecx
test eax, eax
jne 0x10003c8e
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003c95
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10020533
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10015a48
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10005800
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d0f
mov ax, word [0x10021c14]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x824
ret
Function at 0x10015a48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10015a57
pop dword [ebp - 0x48]
mov eax, 0x10015a57
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x9dced9d
add dword [ebp - 0x58], 0x447557ae
mov dword [ebp - 0x54], 0xd60b8851
add dword [ebp - 0x54], 0x5c27c3f4
mov dword [ebp - 0x50], 0x95ff7ada
sub dword [ebp - 0x50], 0x49b336ac
mov dword [ebp - 0x4c], 0x13ca6d6a
sub dword [ebp - 0x4c], 0x13ca6d6a
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb4f4dfe1
add dword [ebp - 0x58], 0xbf7d8975
mov dword [ebp - 0x54], 0xa50f2f4b
sub dword [ebp - 0x54], 0x63a2cdd6
mov dword [ebp - 0x50], 0x5b84220b
sub dword [ebp - 0x50], 0xf814b59f
mov dword [ebp - 0x4c], 0x42044eb2
sub dword [ebp - 0x4c], 0x42044eb2
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3c6ab
push 0
call eax
mov ecx, 0x4465
mov edx, eax
mov ebx, 0xbd063a7a
add ebx, 0x52fd1d86
add ebx, dword [ebp - 0x48]
mov edi, 0xacc5ffc4
sub edi, 0x8f203ad0
add dword [ebp - 0x14], 0xdea7065f
mov esi, dword [ebx]
sub dword [ebp - 0x40], 0x1f8dcf65
xor esi, edi
mov dword [edx], esi
add edx, 0xab148281
add edx, 0x54eb7d83
add ebx, 4
loop 0x10015b64
add eax, 0xa1010a8c
sub eax, 0xa1000625
mov ebx, eax
add eax, 0xc728050a
add eax, 0x38d7fafb
mov ecx, 0x2103139b
add ecx, 0xeefcec65
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40673a
pop dword [ebp - 0x34]
mov eax, 0x40673a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x73f4c05
sub dword [ebp - 0x44], 0xb8ed06ba
mov dword [ebp - 0x40], 0x2b8e5b5c
sub dword [ebp - 0x40], 0xf95b0f17
mov dword [ebp - 0x3c], 0xd352e6d1
add dword [ebp - 0x3c], 0x78f95d5d
mov dword [ebp - 0x38], 0x4f1e6097
add dword [ebp - 0x38], 0xb0e19f69
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xd80ba7b5
sub dword [ebp - 0x44], 0x63993e5f
mov dword [ebp - 0x40], 0x4bfdc21a
sub dword [ebp - 0x40], 0xa9160a5
mov dword [ebp - 0x3c], 0xe5501b5e
sub dword [ebp - 0x3c], 0x81e0aef2
mov dword [ebp - 0x38], 0x6265f35b
add dword [ebp - 0x38], 0x9d9a0ca5
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd2bffc1a
add eax, 0x2d8084e6
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3453d
push 0
call eax
mov ecx, 0x3b3f
mov esi, eax
mov edx, 0xa108d295
sub edx, 0xa0c1ee95
add edx, dword [ebp - 0x34]
mov edi, 0xf0e372d7
add edi, 0x92454fe
xor dword [ebp - 0x20], 0x34ec768f
mov ebx, dword [edx]
add dword [ebp - 4], 0xfe81c780
sub ebx, edi
sub dword [ebp - 4], eax
mov dword [esi], ebx
xor dword [ebp - 4], ecx
add esi, 4
add edx, 0x45ead895
sub edx, 0x45ead891
loop 0x40684c
add eax, 0xdfcf
xor ebx, ebx
add ebx, eax
add eax, 0xe80fddd6
add eax, 0x17f0222f
mov ecx, 0x9b01d8d
add ecx, 0xf68fe273
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40c279
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40c288
pop dword [ebp - 0x40]
mov eax, 0x25045ff9
sub eax, 0x24c39d71
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x55aef2c1
add dword [ebp - 0x50], 0xf8a3528a
mov dword [ebp - 0x4c], 0xb668cf43
sub dword [ebp - 0x4c], 0x843582fe
mov dword [ebp - 0x48], 0xf5bcfa2f
add dword [ebp - 0x48], 0x568f49ff
mov dword [ebp - 0x44], 0x7145bff
add dword [ebp - 0x44], 0xf8eba401
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x3dd2a620
add dword [ebp - 0x50], 0x369fc336
mov dword [ebp - 0x4c], 0x7230ec2a
add dword [ebp - 0x4c], 0xcf3b754b
mov dword [ebp - 0x48], 0xe69b5a57
sub dword [ebp - 0x48], 0x832bedeb
mov dword [ebp - 0x44], 0x1d35b02b
sub dword [ebp - 0x44], 0x1d35b02b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3edc7
push 0
call eax
mov ecx, 0x4cb3
xor edx, edx
add edx, eax
mov ebx, 0xe51d95cf
sub ebx, 0xe4da51cf
add ebx, dword [ebp - 0x40]
mov esi, 0xb9d903cb
xor dword [ebp - 0x3c], 0x47708bb2
mov edi, dword [ebx]
add edi, esi
sub dword [ebp - 0x1c], ecx
mov dword [edx], edi
sub dword [ebp - 0x14], eax
add edx, 4
add ebx, 0x3a3ac6cb
add ebx, 0xc5c53939
loop 0x40c396
add eax, 0x837dba9c
add eax, 0x7c836b03
mov ebx, eax
add eax, 5
mov ecx, 0xf6e633f4
add ecx, 0x959cc0c
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x660610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x564015
lea edi, [esi - 0x163015]
push edi
or ebp, 0xffffffff
jmp 0x660632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x660639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x660628
mov eax, 1
add ebx, ebx
jne 0x66064b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x66065c
jne 0x66067b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66067b
dec eax
add ebx, ebx
jne 0x660668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x660640
add ebx, ebx
jne 0x660677
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6606cd
xor ecx, ecx
sub eax, 3
jb 0x660693
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x660702
sar eax, 1
mov ebp, eax
jmp 0x66069e
add ebx, ebx
jne 0x66069e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66066c
inc ecx
add ebx, ebx
jne 0x6606ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66066c
add ebx, ebx
jne 0x6606b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6606ae
jne 0x6606ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6606ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6606ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6606de
jmp 0x66062e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6606ec
add edi, ecx
jmp 0x66062e
pop esi
mov edi, esi
mov ecx, 0x8f09
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x66070a
cmp byte [edi], 0x19
jne 0x66070a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x66070f
lea edi, [esi + 0x25d000]
mov eax, dword [edi]
or eax, eax
je 0x66077e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2668f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x266a38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x66073c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x266a3c]
or eax, eax
je 0x660778
mov dword [ebx], eax
add ebx, 4
jmp 0x660759
call dword [esi + 0x266a4c]
mov ebp, dword [esi + 0x266a40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6607b2
sub esp, 0xffffff80
jmp 0x4012b0
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4016c5
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x40576c]
test eax, eax
jne 0x4016e2
push 0x12c
push 8
call dword [0x40404c]
push eax
call dword [0x404050]
push esi
mov esi, dword [esp + 8]
mov dl, byte [esi]
test dl, dl
mov dword [0x40576c], eax
mov ecx, eax
je 0x401704
sub esi, eax
xor dl, byte [esp + 0xc]
mov byte [ecx], dl
inc ecx
mov dl, byte [esi + ecx]
test dl, dl
jne 0x4016f6
mov byte [ecx], 0
pop esi
ret
Function at 0x402a9c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404590
test esi, esi
jne 0x402ad2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404680
jmp 0x402af0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029b0
mov edi, eax
test esi, esi
je 0x402af0
cmp dword [ebx], 0
je 0x402af0
dec esi
jmp 0x402ad9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4036c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x461020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403760
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403740
xor eax, eax
push ebp
push 0x403739
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40377c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403740
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x461020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x461020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404414
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46304c], 0
je 0x404475
cmp word [0x463220], 0xd7b2
jne 0x40443d
cmp dword [0x463228], 0
jbe 0x40443d
mov eax, 0x46321c
call dword [0x463238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x461070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40449c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x461030], 0
jne 0x404491
push 0
push 0x461068
push 0x461070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406388
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063ee
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404800
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040328c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4063d8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063f5
lea eax, [ebp - 0x10]
call fcn.00404590
ret

Function at 0x40b338
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b371
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404680
jmp 0x40b37a
mov eax, ebx
mov edx, esi
call fcn.004045e4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b384
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3a5
mov al, byte [esp]
jmp 0x40b3a7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ba2c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b8a4
mov eax, dword [0x4620cc]
cmp byte [eax], 0
je 0x40baa8
mov eax, dword [0x461ee0]
call fcn.00402eb4
call fcn.004028dc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408b78
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40baf0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bade
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x461e8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x463668]
call fcn.00405880
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c38c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c462
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404628
lea eax, [ebp - 8]
call fcn.00404aa0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a50
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c44c
mov eax, ebx
call fcn.00402774
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c445
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a50
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c42f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c474
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c42f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c44c
mov eax, dword [ebp - 0x10]
call fcn.00402794
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c469
lea eax, [ebp - 8]
call fcn.00404590
ret

Function at 0x40c8e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c944
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404800
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004086e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c94b
lea eax, [ebp - 0xc]
call fcn.00404590
ret

Function at 0x41dd18
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x463888
cmp dword [edi], 0
jne 0x41dd94
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x463884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x461400
mov ecx, 2
call fcn.00402970
mov edx, 0x41dcf0
lea eax, [esi + 5]
call fcn.0041dd10
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041dd10
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41dd69
mov dword [0x463884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41efa8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41efae
ret
Function at 0x4213f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x421441
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x421428
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x421418
jmp 0x421441
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x421429
pop ebx
mov esp, ebp
pop ebp
ret