joyce8/EMBER2024-capa huggingface dataset:
Function at 0x132fb86
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
mov dword [ebp - 0x38], ebx
call fcn.01325a9e
push eax
call fcn.01325b32
mov edi, eax
mov byte [ebp - 5], 0
test ebx, ebx
jne 0x132fbc9
mov eax, 0xc004d104
jmp 0x132fd51
cmp dword [ebp + 8], 0
mov eax, dword [ebx]
mov dword [ebp - 0x40], eax
jne 0x132fbdd
mov dword [ebx], edi
xor eax, eax
jmp 0x132fd51
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x132fd4c
xor edx, edx
mov eax, ecx
div edi
test edx, edx
jne 0x132fd4c
lea ebx, [edi + edi]
cmp ecx, ebx
ja 0x132fd4c
lea ecx, [esi + 0x34]
call fcn.0132f0e6
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.0132fa5e
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x132fc28
mov dword [ebp - 0x2c], 0x8007000e
jmp 0x132fd3f
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jbe 0x132fcd0
mov eax, dword [ebp - 0x30]
lea edx, [eax + ebx]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], edi
call fcn.013256d1
lea ecx, [ebp - 0x4c]
call fcn.013256d8
lea ecx, [ebp - 0x3c]
push ecx
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
lea ecx, [esi + 0xc]
call fcn.0132f073
add eax, ebx
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.013256d1
lea ecx, [ebp - 0x58]
call fcn.013256d8
push edi
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, dword [esi + 4]
push 0x40
call fcn.01228a37
mov ebx, dword [ebx + 0x32]
and byte [esi], dh
add byte [eax], al
invalid
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax - 1]
mov bl, byte [ecx]
movzx edx, bl
cmp edx, edi
jbe 0x132fcec
mov dword [ebp - 0x2c], 0xc004d211
jmp 0x132fd3f
xor edi, edi
test edx, edx
jbe 0x132fcfc
cmp byte [ecx], bl
jne 0x132fce3
inc edi
dec ecx
cmp edi, edx
jb 0x132fcf2
mov edi, dword [ebp - 0x38]
sub eax, edx
mov dword [edi], eax
mov eax, dword [esi + 0x30]
sub eax, edx
cmp dword [ebp - 0x40], eax
jae 0x132fd1e
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 0xc004d107
mov dword [ebp - 0x2c], eax
jmp 0x132fd3f
xor esi, esi
cmp dword [edi], esi
jbe 0x132fd3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [eax + esi]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + esi]
push eax
call fcn.013255eb
inc esi
cmp esi, dword [edi]
jb 0x132fd24
lea ecx, [ebp - 0x28]
call fcn.0132f089
mov eax, dword [ebp - 0x2c]
jmp 0x132fd51
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 0xc
Function at 0x1332c4d
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea ecx, [ebp - 0x118]
call fcn.0132ec7a
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x1332c95
xor esi, esi
lea ecx, [ebp - 0x118]
call fcn.0132ec8c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0103e3fb
leave
ret 0xc
cmp dword [ebp + 8], edi
jne 0x1332ca1
mov esi, 0xc004d104
jmp 0x1332c78
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
lea eax, [ebp - 0x124]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [ebp - 0x120], eax
mov ebx, dword [ebp - 0x124]
xor ebx, dword [ebp - 0x120]
push 1
push 8
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x118]
call fcn.01324e9f
cmp dword [ebp + 0x10], edi
jbe 0x1332d5c
lea eax, [ebp - 0x124]
push eax
call esi
mov eax, dword [ebp - 0x124]
xor eax, ebx
mov cl, bl
rol eax, cl
lea ecx, [ebp - 0x118]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
add eax, edi
mov dword [ebp - 0x128], eax
call fcn.0132ed94
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
xor al, bl
mov byte [ebp - 0x11c], al
call fcn.013255a6
xor al, byte [ebp - 0x11c]
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
mov byte [ebp - 0x130], al
push dword [ebp - 0x130]
call fcn.013255eb
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x1332ce4
pop ebx
jmp 0x1332c76
Function at 0x1333414
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x88], eax
cmp dword [ebp + 8], ebx
je 0x1333457
cmp eax, ebx
je 0x133345b
mov eax, dword [edi]
dec eax
je 0x1333473
dec eax
je 0x133346c
dec eax
je 0x1333465
mov eax, 0xc004a001
jmp 0x13335cb
cmp eax, ebx
je 0x1333442
mov eax, 0xc004d104
jmp 0x13335cb
call fcn.013356ee
jmp 0x1333478
call fcn.0133574c
jmp 0x1333478
call fcn.0133579d
cmp eax, ebx
jl 0x13335cb
mov esi, dword [ebp - 0x88]
mov byte [edi + 6], bl
mov byte [edi + 4], 1
cmp esi, ebx
je 0x13335cb
cmp esi, 0x40
jbe 0x13334ef
push esi
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0133311a
cmp eax, ebx
jl 0x13335cb
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
mov dword [ebp - 0x88], 0x40
call fcn.013331ad
cmp eax, ebx
jl 0x13335cb
push ebx
push ecx
push ecx
mov eax, esp
mov ecx, edi
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.01333414
cmp eax, ebx
jl 0x13335cb
jmp 0x1333525
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x44]
mov dword [ebp - 0x8c], eax
test esi, esi
jbe 0x133352b
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x90]
inc dword [ebp - 0x8c]
call fcn.013255a6
mov byte [ebx], al
inc ebx
dec esi
jne 0x1333508
mov esi, dword [ebp - 0x88]
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.msvcrt.dll_memcpy
push 0x40
pop ebx
sub ebx, esi
push ebx
lea eax, [ebp + esi - 0x44]
push 0x36
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp + esi - 0x84]
push 0x5c
push eax
call sub.msvcrt.dll_memset
xor ebx, ebx
add esp, 0x24
xor eax, eax
cmp esi, ebx
jbe 0x133357b
xor byte [ebp + eax - 0x44], 0x36
xor byte [ebp + eax - 0x84], 0x5c
inc eax
cmp eax, esi
jb 0x1333569
push 0x40
lea eax, [ebp - 0x84]
push eax
mov ecx, edi
call fcn.013330d8
cmp eax, ebx
jl 0x13335cb
push 0x68
lea eax, [edi + 8]
push eax
lea eax, [edi + 0x70]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
push ecx
push ecx
mov eax, esp
mov ecx, edi
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.01333414
cmp eax, ebx
jl 0x13335cb
push 0x40
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
call fcn.013330d8
cmp eax, ebx
jl 0x13335cb
mov byte [edi + 5], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 0xc
Function at 0x13365dd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x1336600
mov eax, 0xc004d101
jmp 0x1336793
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
sub ecx, eax
dec ecx
lea edx, [eax + eax]
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
cmp edx, eax
jb 0x133677e
lea eax, [ecx + eax*2]
cmp ecx, eax
ja 0x133677e
push eax
call fcn.0108dc98
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x133664a
mov dword [ebp + 0x14], 0x8007000e
jmp 0x1336785
mov ecx, dword [ebp - 4]
add ebx, ecx
lea edx, [eax + ecx]
mov ecx, dword [ebp + 0x18]
add ebx, eax
mov dword [ebp - 8], edx
test ecx, ecx
jne 0x1336660
mov ecx, eax
push dword [ebp + 0x1c]
push ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [edi]
push eax
call fcn.0133629c
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x1336785
mov ecx, dword [ebp - 4]
lea eax, [ecx + ecx + 2]
cmp ecx, eax
ja 0x133677e
cmp esi, eax
jb 0x133677e
mov eax, dword [ebp + 0x10]
push ecx
sub esi, ecx
lea edx, [eax + 1]
lea eax, [ecx + eax + 1]
mov ecx, dword [edi]
dec esi
push esi
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], esi
call fcn.013362dc
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x1336785
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jbe 0x13366dc
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0x18]
sub esi, eax
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x13366d3
push dword [ebp - 0x10]
mov ecx, dword [edi]
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push dword [ebp - 8]
push eax
push ebx
call fcn.013362dc
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x1336785
mov esi, dword [ebp + 0x1c]
test esi, esi
jbe 0x1336713
mov edi, dword [ebp - 0x18]
mov eax, ebx
sub edi, ebx
mov cl, byte [edi + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x133670a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jmp 0x1336726
cmp byte [ecx + ebx], 0
jne 0x133672b
inc ecx
cmp ecx, eax
mov dword [ebp + 0x18], ecx
jb 0x133671d
cmp ecx, eax
je 0x1336775
cmp byte [ecx + ebx], 1
jne 0x1336775
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
mov esi, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1336775
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], dl
jne 0x1336775
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
sub edx, esi
sub eax, edx
sub eax, esi
dec eax
cmp dword [ecx], eax
mov dword [ecx], eax
jb 0x133677e
push eax
add edx, esi
lea eax, [edx + ebx + 1]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1336785
mov dword [ebp + 0x14], 0xc004d210
jmp 0x1336785
mov dword [ebp + 0x14], 0x8007006f
push dword [ebp - 0x14]
call fcn.0108dca7
mov eax, dword [ebp + 0x14]
pop ecx
pop esi
pop ebx
pop edi
leave
ret 0x18
Function at 0x133d339
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x133e77c
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x1c
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x133e7b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x133e835
and eax, 0xffff
or eax, 0x80070000
jmp 0x133e835
cmp dword [ebp - 0xc], 0x1000000
je 0x133e7c5
xor eax, eax
inc eax
jmp 0x133e835
mov eax, dword [ebp - 0x20]
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [eax], cx
jne 0x133e7c0
mov esi, dword [eax + 0x3c]
add esi, eax
cmp esi, dword [ebp + 8]
ja 0x133e7c0
xor eax, eax
cmp dword [esi], 0x4550
jne 0x133e7c2
xor edi, edi
cmp ax, word [esi + 6]
jae 0x133e7c0
xor ebx, ebx
movzx eax, word [esi + 0x14]
add eax, ebx
lea eax, [eax + esi + 0x18]
push eax
call fcn.0133ecc9
cmp al, 1
je 0x133e815
movzx eax, word [esi + 6]
inc edi
add ebx, 0x28
cmp edi, eax
jb 0x133e7f3
jmp 0x133e7c0
movzx eax, word [esi + 0x14]
imul edi, edi, 0x28
add edi, esi
lea eax, [edi + eax + 0x18]
test eax, eax
je 0x133e7c0
mov ecx, dword [ebp - 8]
push eax
push dword [esi + 0x50]
push dword [ebp - 4]
call fcn.0133e63f
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x133eb75
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov byte [esi + 0x100], 0
mov byte [esi + 0x101], 0
mov edx, 0x3020100
xor ecx, ecx
mov dword [esi + ecx*4], edx
add edx, 0x4040404
inc ecx
cmp ecx, 0x40
jb 0x133ebaa
push edi
push eax
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll_memcpy
push dword [ebp + 0x14]
lea eax, [ebp + edi - 0x14]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x18
xor ecx, ecx
xor eax, eax
movzx edi, byte [esi + eax]
mov bl, byte [esi + eax]
mov edx, eax
and edx, 0xf
movzx edx, byte [ebp + edx - 0x14]
add edx, ecx
add edi, edx
and edi, 0xff
mov ecx, edi
mov dl, byte [esi + ecx]
mov byte [esi + ecx], bl
mov byte [eax + esi], dl
inc eax
cmp eax, 0x100
jb 0x133ebd9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0103e3fb
leave
ret 0x10

Function at 0x133ec62
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jbe 0x133ec84
push esi
mov eax, dword [ebp + 8]
lea esi, [eax + edi]
call fcn.0133ec1a
xor byte [esi], al
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x133ec70
pop esi
pop edi
pop ebp
ret 8
Function at 0x401510
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x401118
call fcn.004016c8
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40154b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40154b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401563
cmp eax, 0x20b
je 0x401550
mov dword [ebp - 0x1c], edi
jmp 0x401577
cmp dword [ecx + 0x84], 0xe
jbe 0x40154b
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x401571
cmp dword [ecx + 0x74], 0xe
jbe 0x40154b
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x402030], 0xffffffff
or dword [0x402034], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40202c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x402028]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x402038], eax
call fcn.004016be
cmp dword [0x40201c], edi
jne 0x4015d2
push fcn.004016be
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.004016a7
push 0x402010
push 0x40200c
call sub.msvcrt.dll__initterm
mov eax, dword [0x402024]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x402020]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x402008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004011de
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x401649
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40167e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00401703
ret
Function at 0x402b08
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004042c0
test esi, esi
jne 0x402b3e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004043b0
jmp 0x402b5c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a1c
mov edi, eax
test esi, esi
je 0x402b5c
cmp dword [ebx], 0
je 0x402b5c
dec esi
jmp 0x402b45
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x51a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403358
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403338
xor eax, eax
push ebp
push 0x403331
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403374
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403338
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x51a020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x51a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404144
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51d04c], 0
je 0x4041a5
cmp word [0x51d220], 0xd7b2
jne 0x40416d
cmp dword [0x51d228], 0
jbe 0x40416d
mov eax, 0x51d21c
call dword [0x51d238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x51a06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041cc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51a030], 0
jne 0x4041c1
push 0
push 0x51a064
push 0x51a06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406698
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4066fe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404530
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4066e8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406705
lea eax, [ebp - 0x10]
call fcn.004042c0
ret

Function at 0x40c748
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c781
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004043b0
jmp 0x40c78a
mov eax, ebx
mov edx, esi
call fcn.00404314
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c794
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c7b5
mov al, byte [esp]
jmp 0x40c7b7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ce3c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ccb4
mov eax, dword [0x51c120]
cmp byte [eax], 0
je 0x40ceb8
mov eax, dword [0x51bdc4]
call fcn.00402c48
call fcn.00402948
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004097a0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cf00
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ceee
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x51bd40]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x51d668]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d7c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d896
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404358
lea eax, [ebp - 8]
call fcn.004047d0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404780
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d880
mov eax, ebx
call fcn.004027e0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d879
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404780
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d863
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d8a8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d863
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d880
mov eax, dword [ebp - 0x10]
call fcn.00402800
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d89d
lea eax, [ebp - 8]
call fcn.004042c0
ret

Function at 0x40de20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40de84
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404530
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409294
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de8b
lea eax, [ebp - 0xc]
call fcn.004042c0
ret

Function at 0x427474
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x51d888
cmp dword [edi], 0
jne 0x4274f0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x51d884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x51a6d0
mov ecx, 2
call fcn.004029dc
mov edx, 0x42744c
lea eax, [esi + 5]
call fcn.0042746c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042746c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4274c5
mov dword [0x51d884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x428ad4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x428ada
ret
Function at 0x42b24c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42b29d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42b284
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42b274
jmp 0x42b29d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42b285
pop ebx
mov esp, ebp
pop ebp
ret