joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f6d0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f87b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44f85c
mov dl, 1
mov eax, dword [0x411eb0]
call fcn.00403340
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040c0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44f84b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043d6bc
test al, al
je 0x44f83e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44f88c
lea eax, [ebp - 0x254]
call fcn.00408df8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44f83e
xor eax, eax
push ebp
push 0x44f837
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44f8c4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44f820
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404330
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44f820
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f83e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44f741
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004159c0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f882
lea eax, [ebp - 0x260]
call fcn.004040c0
ret

Function at 0x4501f8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47fbdc]
cmp byte [eax + 0xa5], 0
jne 0x450269
cmp dword [0x47fbf4], 0
jne 0x45022a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4501b4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47fbf4], eax
cmp dword [0x47fbf0], 0
jne 0x450245
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47fbf0], eax
cmp dword [0x47fbf8], 0
jne 0x450269
push esp
push 0
push 0
push 0x450158
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x47fbf8], eax
pop edx
ret
Function at 0x4503a8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4503bf
add esp, 0xfffffff0
call fcn.00403694
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004197d0
mov eax, dword [0x47e188]
cmp word [eax + 2], 0
jne 0x4503e7
mov eax, dword [0x47e188]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451a80
mov eax, dword [0x47e250]
cmp word [eax + 2], 0
jne 0x450401
mov eax, dword [0x47e250]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451c78
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411a94]
call fcn.00403340
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411a94]
call fcn.00403340
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41bd14]
call fcn.00423430
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x450588
mov eax, dword [0x47e08c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423800
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x452218
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47e08c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c4ec
test eax, eax
je 0x4504f6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004087d8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c514
test eax, eax
je 0x45050a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404330
mov eax, dword [0x47df68]
cmp byte [eax], 0
jne 0x45053e
mov eax, ebx
call fcn.004506b0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004523f4
mov eax, ebx
call fcn.00452db8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45057e
call fcn.004036ec
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450930
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47fbdc]
cmp dword [eax + 0x30], 0
je 0x4509da
cmp dword [ebx + 0x94], 0
jne 0x4509d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4508c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4509d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45099a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4509d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413e30
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4509a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45153c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x451571
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041b0
jmp 0x45157e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404114
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4525d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452611
mov eax, esi
call fcn.00438d7c
test al, al
je 0x452611
mov eax, dword [ebx + 0x84]
call fcn.00438aa4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452611
push 0
mov eax, dword [ebx + 0x84]
call fcn.00438aa4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x459458
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x47fc0c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x45947a
shr eax, 1
xor eax, 0xedb88320
jmp 0x45947c
shr eax, 1
dec edx
jne 0x459468
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x459461
mov byte [0x48000c], 1
pop esi
pop ebx
ret

Function at 0x459498
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x48000c], 0
jne 0x4594af
call fcn.00459458
mov eax, edi
dec eax
test eax, eax
jl 0x4594d8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x47fc0c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4594b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x47a184
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x47a333
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x308]
cmp byte [eax + 0x38], 0
je 0x47a1aa
xor ebx, ebx
mov eax, dword [edi + 0x30c]
cmp byte [eax + 0x38], 0
je 0x47a1b8
mov bl, 1
mov eax, dword [edi + 0x310]
cmp byte [eax + 0x38], 0
je 0x47a1c6
mov bl, 2
mov eax, dword [edi + 0x314]
cmp byte [eax + 0x38], 0
je 0x47a1d4
mov bl, 3
mov eax, dword [edi + 0x318]
cmp byte [eax + 0x38], 0
je 0x47a1e2
mov bl, 4
mov eax, dword [edi + 0x31c]
cmp byte [eax + 0x38], 0
je 0x47a1f0
mov bl, 5
mov eax, dword [edi + 0x320]
cmp byte [eax + 0x38], 0
je 0x47a1fe
mov bl, 6
mov eax, dword [edi + 0x324]
cmp byte [eax + 0x38], 0
je 0x47a20c
mov bl, 7
mov eax, dword [edi + 0x328]
cmp byte [eax + 0x38], 0
je 0x47a21a
mov bl, 8
mov eax, dword [edi + 0x32c]
cmp byte [eax + 0x38], 0
je 0x47a228
mov bl, 9
mov dl, 1
mov eax, dword [0x429314]
call fcn.00429414
mov esi, eax
mov edx, 0x80000001
mov eax, esi
call fcn.004294b4
mov cl, 1
mov edx, 0x47a348
mov eax, esi
call fcn.00429518
mov eax, dword [edi + 0x364]
mov cl, byte [eax + 0x38]
mov edx, 0x47a370
mov eax, esi
call fcn.0042971c
mov eax, dword [edi + 0x368]
mov cl, byte [eax + 0x38]
mov edx, 0x47a380
mov eax, esi
call fcn.0042971c
mov eax, dword [edi + 0x330]
mov cl, byte [eax + 0x38]
mov edx, 0x47a390
mov eax, esi
call fcn.0042971c
xor ecx, ecx
mov cl, bl
mov edx, 0x47a3a0
mov eax, esi
call fcn.004296d8
mov eax, dword [0x48045c]
mov ecx, dword [eax + 0x44]
mov edx, 0x47a3b0
mov eax, esi
call fcn.004296d8
mov eax, dword [0x48045c]
mov ecx, dword [eax + 0x40]
mov edx, 0x47a3bc
mov eax, esi
call fcn.004296d8
mov eax, esi
call fcn.00429484
mov cl, 1
mov edx, 0x47a3cc
mov eax, esi
call fcn.00429518
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x38], 0
je 0x47a303
lea edx, [ebp - 4]
xor eax, eax
call fcn.004029f4
mov ecx, dword [ebp - 4]
mov edx, 0x47a404
mov eax, esi
call fcn.004296ac
jmp 0x47a30f
mov edx, 0x47a404
mov eax, esi
call fcn.0042963c
mov eax, esi
call fcn.00429484
mov eax, esi
call fcn.00403370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a33a
lea eax, [ebp - 4]
call fcn.004040c0
ret
Function at 0x10040640
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1004067e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10040676
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10040680
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10040666
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10040750
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10040766
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10040781
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1c813cd2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7224647d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x408966
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408980
and edi, edi
xor dword [ecx], eax
inc ecx
cmp ecx, esi
jne fcn.00408966
ret
Function at 0x5f252c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f2547
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b776c]
pop edx
test eax, eax
je 0x5f2619
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f2608
test dword [ebp - 0x2a8], 1
jne 0x5f2608
and dword [ebp - 0x2a8], 0x100
jne 0x5f2608
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3840]
pop edx
pop esi
test eax, eax
je 0x5f25ab
jmp 0x5f2608
cmp word [esi], 0x5a4d
jne 0x5f2608
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f2608
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3a5c]
pop edx
test eax, eax
je 0x5f2608
lea eax, [ebp - 0x28c]
push eax
call fcn.005f2488
test eax, eax
jne 0x5f2601
jmp 0x5f2608
mov eax, esi
jmp 0x5f2619
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f2547
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, ecx
push ebp
push edi
push esi
push eax
call fcn.004015ec
pop edi
lea eax, [edi - 0x160]
push 0
push 0
xchg dword [eax + 0x6afffffe], esp
add byte [edx], ch
push eax
call sub.KERNEL32.dll_LoadLibraryExA
test eax, eax
jne 0x40100d
call sub.KERNEL32.dll_GetCommandLineA
pop ebp
ret 8

Function at 0x401050
Capabilities:
Get common file path

Disassembly:
push edi
sub esp, 0x7c
push esp
pop edi
push 0x100
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0
push edi
add edi, eax
mov eax, 0x69636d5c
stosd dword es:[edi], eax
mov eax, 0x65766177
stosd dword es:[edi], eax
mov eax, 0x6c6c642e
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
call sub.KERNEL32.dll_GetCompressedFileSizeA
add esp, 0x7c
pop edi
cmp eax, 2
jg 0x40108a
int3
pushal
jmp 0x401274
mov ecx, ecx
push ebp
mov ebp, esp
mov edi, 0x403160
push edi
push ecx
push ebx
call fcn.004011ec
pop edi
push 0
call sub.KERNEL32.dll_FlushFileBuffers
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push edx
mov ebx, dword [edi + 0x90]
call ebx
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1f782d0a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, str._N
mov ebx, 0x42f3f8
nop
mov ecx, 0x4e6d07cb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x408599
Capabilities:
Encode data using xor

Disassembly:
or cl, cl
jne 0x407c15
or eax, eax
jns fcn.00407c10
neg eax
call fcn.00407c10
mov ax, 0x2d
mov word [esi - 2], ax
sub esi, 2
inc ecx
ret
or cl, cl
jne fcn.00407c8c
mov ecx, 0xa
test dword [eax + 4], 0x80000000
je fcn.00407c8c
push dword [eax + 4]
push dword [eax]
mov eax, esp
neg dword [esp]
adc dword [esp + 4], 0
neg dword [esp + 4]
call fcn.00407c8c
inc ecx
mov word [esi - 2], 0x2d
sub esi, 2
add esp, 8
ret
and al, 0xdf
mov cl, al
mov eax, 1
mov ebx, dword [ebp - 0xc]
cmp ebx, dword [ebp + 8]
jg case.default.0x4085b9
inc dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
lea esi, [esi + ebx*8]
mov eax, dword [esi]
movzx edx, byte [esi + 4]
jmp dword [edx*4 + 0x4085c0]
xor eax, eax
call fcn.00408820
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
sub ecx, edx
shr ecx, 1
mov ebx, dword [ebp - 4]
call fcn.0040839c
lea esi, [ebp - 0x66]
mov edx, dword [ebp - 0x20]
cmp edx, 0x20
jbe 0x40862e
xor edx, edx
mov ebx, ecx
sub cl, 0x44
je 0x407c54
mov ecx, 0x10
cmp bl, 0x58
je 0x407c54
mov ecx, 0xa
cmp bl, 0x55
je 0x407c54
jmp case.0x4085b9.1
lea esi, [ebp - 0x86]
mov edx, dword [ebp - 0x20]
mov ebx, ecx
cmp edx, 0x10
jbe 0x408669
xor edx, edx
sub cl, 0x44
je 0x407bf4
mov ecx, 0x10
cmp bl, 0x58
je 0x407bf4
mov ecx, 0xa
cmp bl, 0x55
je 0x407bf4
jmp case.0x4085b9.1
cmp cl, 0x53
jne case.0x4085b9.1
mov eax, esi
mov ecx, 1
jmp 0x4086e2
xor ecx, ecx
ret
cmp cl, 0x53
jne case.0x4085b9.1
movzx ecx, byte [eax]
inc eax
mov esi, 0x404b8c
jmp 0x4086fe
add esi, dword [ebp - 4]
mov edx, eax
lea eax, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 4]
call esi
pop ebx
mov esi, dword [ebp - 0x10]
jmp 0x408731
or esi, esi
je 0x4086d2
mov ecx, dword [esi - 4]
shr ecx, 1
cmp ecx, dword [ebp - 0x20]
ja 0x408740
ret
mov ecx, dword [ebp - 0x20]
ret
mov bh, 0
mov esi, eax
mov bl, 0
cmp cl, 0x47
je 0x4087d4
mov bl, 1
cmp cl, 0x45
je 0x4087d4
mov bl, 2
cmp cl, 0x46
je 0x4087b5
mov bl, 3
cmp cl, 0x4e
je 0x4087b5
cmp cl, 0x4d
jne case.0x4085b9.1
mov bl, 4
mov eax, 0x12
mov edx, dword [ebp - 0x20]
cmp edx, eax
jbe 0x4087e6
mov edx, 2
cmp cl, 0x4d
jne 0x4087e6
movzx edx, byte [0x415b72]
jmp 0x4087e6
mov eax, dword [ebp - 0x20]
mov edx, 3
cmp eax, 0x12
jbe 0x4087e6
mov eax, 0xf
push ebx
push eax
push edx
lea eax, [ebp - 0xa6]
mov edx, esi
movzx ecx, bh
mov ebx, dword [ebp - 4]
call fcn.00408440
mov ecx, eax
lea edx, [ebp - 0xa6]
lea eax, [ebp - 0x10]
mov ebx, dword [ebp - 4]
call fcn.00404b9c
mov esi, dword [ebp - 0x10]
or esi, esi
je 0x4086d2
mov ecx, dword [esi - 4]
shr ecx, 1
ret

Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4095c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4096ed
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004093dc
mov esi, eax
mov eax, dword [0x412c2c]
cmp byte [eax], 0
je 0x409695
mov eax, dword [0x412b68]
call fcn.0040317c
call fcn.00402f6c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4095a4]
call fcn.00405ad8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x409708
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4096d1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x412b48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415b48]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4096f4
lea eax, [ebp - 4]
mov edx, dword [0x4095a4]
call fcn.00405ae4
ret

Function at 0x40a91f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40a942
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40a944
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40a97d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40a967
mov eax, esp
cmp esi, eax
je 0x40a98a
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40a9c4
cmp bl, 0
je 0x40a9c0
cmp bl, 0x41
jl 0x40a9bb
cmp bl, 0x5a
jg 0x40a9bb
or bl, 0x20
xor al, bl
inc esi
jmp 0x40a99f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a904
Function at 0x40b5b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b5fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b548
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b601
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b818
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b8af
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b863
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b899
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b87c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b88f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b6d8
mov ebx, eax
test esi, esi
je 0x40b88f
dec esi
jmp 0x40b86a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8b6
lea eax, [ebp - 4]
call fcn.0040b067
ret

Function at 0x40b8c0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408134
add esp, 0x208
pop ebx
ret