joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x40fe32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40fe39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40fe28
mov eax, 1
add ebx, ebx
jne 0x40fe4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40fe40
jne 0x40fe5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40fe40
xor ecx, ecx
sub eax, 3
jb 0x40fe70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40fee2
mov ebp, eax
add ebx, ebx
jne 0x40fe7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40fe88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40feac
inc ecx
add ebx, ebx
jne 0x40fe98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40fe8d
jne 0x40fea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40fe8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40fecc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40febd
jmp 0x40fe2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40fecc
add edi, ecx
jmp 0x40fe2e
pop esi
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40ff2b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40fee9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf040]
or eax, eax
je 0x40ff25
mov dword [ebx], eax
add ebx, 4
jmp 0x40ff06
call dword [esi + 0xf050]
mov ebp, dword [esi + 0xf044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40ff5f
sub esp, 0xffffff80
jmp 0x4020af
Function at 0x62f4e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4054c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x405120
mov eax, dword [0x638010]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
jne 0x62f536
push 0x638010
push 0x531514
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov eax, dword [0x638010]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaObjSetAddref]
lea ecx, [ebp - 0x48]
push eax
push ecx
call edi
lea edx, [ebp - 0x44]
push edx
call fcn.0062f670
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x44]
call esi
lea eax, [ebp - 0x44]
push eax
call fcn.00630b50
lea ecx, [ebp - 0x44]
call esi
push 0x53c580
push 0x80000001
call fcn.005fa280
push 0x53c580
push 0x80000002
call fcn.005fa280
push 0x53c5e0
push 0x80000002
call fcn.005faa90
push 0x53c64c
push 0x80000002
call fcn.005fb1a0
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x350]
lea edx, [ebp - 0x34]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0062fb20
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
lea ecx, [ebp - 0x44]
call esi
lea ecx, [ebp - 0x44]
push ecx
call fcn.00630c80
lea ecx, [ebp - 0x44]
call esi
lea edx, [ebp - 0x48]
push ebx
push edx
call edi
push 0x62f633
jmp 0x62f613
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
push ebx
call esi
lea ecx, [ebp - 0x2c]
push ecx
push ebx
call esi
ret
Function at 0x4027d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x41203c], 0x8088405
inc edx
mov dword [0x41203c], edx
mul edx
mov eax, edx
ret

Function at 0x4028f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40298c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40296c
xor eax, eax
push ebp
push 0x402965
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4029a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40296c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x4046f4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4048b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404755
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4048cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4047c7
xor eax, eax
push ebp
push 0x4047c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0040454c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4047a9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4048ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4047c7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4048a8
cmp byte [ebp - 0xd], 0
jne 0x404809
cmp byte [ebp - 0x12], 0
je 0x4048a8
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404822
dec ebx
cmp byte [ebx], 0x2e
je 0x404831
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404821
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4048a8
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40485e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4048a8
cmp byte [ebp - 0xd], 0
je 0x4048a8
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4048a8
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407389
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004035b4
jmp 0x407392
mov eax, ebx
mov edx, esi
call fcn.00403520
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40739c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4073bd
mov al, byte [esp]
jmp 0x4073bf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c868
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c8ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040c7cc
mov eax, dword [ebp - 4]
call fcn.004038ec
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8b5
lea eax, [ebp - 4]
call fcn.004034cc
ret

Function at 0x40caa8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cb35
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x40caf2
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.004035b4
jmp 0x40cb1f
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x40cb06
lea eax, [ebp - 4]
call fcn.004034cc
jmp 0x40cb15
lea edx, [ebp - 4]
call fcn.0040c978
test ebx, ebx
je 0x40cb15
dec ebx
jmp 0x40caf7
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb3c
lea eax, [ebp - 4]
call fcn.004034cc
ret

Function at 0x40cb44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00406d30
add esp, 0x104
pop ebx
ret
Function at 0x40cc88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40cda9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40cd93
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x40cce1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x40cd93
cmp dword [ebp - 0xc], 0
jne 0x40ccf6
mov eax, dword [ebp - 4]
call fcn.004034cc
mov bl, 1
jmp 0x40cd93
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.004035b4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004038f8
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x40ccad
test eax, eax
jne 0x40cd93
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x40cd3d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x40cd93
jmp 0x40cd3d
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x40cd50
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x40cd3a
cmp dword [ebp - 8], 7
jne 0x40cd5f
cmp dword [ebp - 0xc], 0
je 0x40cd5f
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004039cc
cmp dword [ebp - 8], 7
jne 0x40cd86
cmp dword [ebp - 0xc], 0
je 0x40cd86
lea eax, [ebp - 0x10]
call fcn.004038f8
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00403520
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cdb0
lea eax, [ebp - 0x10]
call fcn.004034cc
ret

Function at 0x40d744
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x412678
mov eax, esi
mov edx, 8
test al, 1
je 0x40d760
shr eax, 1
xor eax, 0xedb88320
jmp 0x40d762
shr eax, 1
dec edx
jne 0x40d753
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40d74c
pop esi
ret

Function at 0x40d778
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x412674], 0
jne 0x40d79b
call fcn.0040d744
push 1
push 0x412674
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40d7c7
mov edx, ebx
and edx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x412678]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40d7a1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40f0f8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040f0ac
test al, al
jne 0x40f119
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40f165
xor eax, eax
push ebp
push 0x40f155
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004038ec
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f15c
lea eax, [ebp - 0xc]
call fcn.0040f0e8
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f4a4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40f4ac
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40f599
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040cb70
mov edx, dword [ebp - 8]
mov ecx, 0x40f5b0
xor eax, eax
call fcn.0040f394
push 0
mov eax, dword [ebp - 4]
call fcn.004038ec
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40f567
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x40f4c6
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.0040eea4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00406a28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040d044
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.0040ee74
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x405df8]
call fcn.00407b38
call fcn.00402f9c
jmp 0x40f4c6
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f5a0
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004034f0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004034f0
ret

Function at 0x40f5c0
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x411544]
cmp dword [eax], 2
jne 0x40f628
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40f5e3
xor eax, eax
jmp 0x40f637
lea eax, [esp + 8]
push eax
push 0x40f63c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x40f628
xor eax, eax
jmp 0x40f637
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x40f650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40f6aa
inc esi
xor edi, edi
cmp edi, 1
jne 0x40f676
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40f684
cmp edi, 1
jle 0x40f684
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040f0f8
test eax, eax
jne 0x40f6aa
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40f6aa
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40f6aa
inc edi
dec esi
jne 0x40f666
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40f97c
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
cmp dword [0x412de4], 0
je 0x40f9c5
mov edi, dword [0x412f1c]
dec edi
test edi, edi
jl 0x40f9c5
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x412f18]
mov edx, dword [edx + eax]
mov eax, dword [0x412de4]
call fcn.00406978
test eax, eax
jne 0x40f9c1
mov eax, esi
call fcn.0040f930
jmp 0x40fa8a
inc esi
dec edi
jne 0x40f997
mov al, byte [0x412f04]
sub al, 1
jb 0x40f9d2
je 0x40f9db
jmp 0x40f9e4
call fcn.0040cdf0
mov ebp, eax
jmp 0x40f9e6
call sub.kernel32.dll_GetUserDefaultLangID
mov ebp, eax
jmp 0x40f9e6
xor ebp, ebp
test bp, bp
je 0x40fa83
mov edi, dword [0x412f1c]
dec edi
test edi, edi
jl 0x40fa32
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x412f18]
lea ebx, [edx + eax]
movzx eax, bp
cmp eax, dword [ebx + 0x28]
jne 0x40fa2e
cmp dword [ebx + 0x2c], 0
je 0x40fa25
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x40fa2e
mov eax, esi
call fcn.0040f930
jmp 0x40fa8a
inc esi
dec edi
jne 0x40f9fd
mov edi, dword [0x412f1c]
dec edi
test edi, edi
jl 0x40fa83
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x412f18]
lea ebx, [edx + eax]
mov eax, dword [ebx + 0x28]
and eax, 0x3ff
mov edx, ebp
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40fa7f
cmp dword [ebx + 0x2c], 0
je 0x40fa76
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x40fa7f
mov eax, esi
call fcn.0040f930
jmp 0x40fa8a
inc esi
dec edi
jne 0x40fa40
xor eax, eax
call fcn.0040f930
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fb1c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40fbf1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40fc08
push ebx
push 0x40fc14
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004037e8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004027b8
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004038ec
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40fb9c
mov al, 0x62
call fcn.0040f6ec
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040faf0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40fba5
call fcn.0040faf0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fbf8
lea eax, [ebp - 4]
call fcn.004034cc
ret

Function at 0x40fcb4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40fd68
jmp 0x40fd5d
cmp dword [esi + 0x10], 0x1000
jne 0x40fd49
test byte [esi + 0x15], 1
jne 0x40fd49
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40fd08
cmp eax, 2
je 0x40fd08
cmp eax, 0x10
je 0x40fd08
cmp eax, 0x20
jne 0x40fd1d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40fd1d
mov bl, 1
xor ebp, ebp
jmp 0x40fd2e
mov eax, dword [esi]
add eax, ebp
call fcn.0040fcac
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40fd21
test bl, bl
je 0x40fd49
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40fd68
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40fce0
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40cc60
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47481b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004693aa
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40cce2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004670fd
mov eax, dword [eax]
push 0x7f01c8
push eax
call fcn.00459504
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00469635
test bl, bl
je 0x40cce2
push 0x7f01c8
lea ecx, [esp + 0xc]
call fcn.004699c5
push 0x7f3d80
lea ecx, [esp + 0xc]
call fcn.004699c5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40cd1e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00469635
jmp 0x40cde9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40cda2
lea edx, [esp + 0x7c]
push 0x7f3d7c
push edx
call fcn.00459504
add esp, 8
test eax, eax
je 0x40cda2
lea eax, [esp + 0x7c]
push 0x7f3d78
push eax
call fcn.00459504
add esp, 8
test eax, eax
je 0x40cda2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cd32
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00469635
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40d5e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40d642
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc