joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101bac90
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101e3af6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.100d48e0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.100d48e0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x101badc9
mov edx, dword [0x1025b4ac]
mov cx, word [0x1025b4b0]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.100ce7b0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.100d4e80
mov edx, dword [0x10211078]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.100cf1d0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.100d4e80
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.100cef50
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.100cef50
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x101baceb
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x101cb7d2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocStringLen
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x101cb862
cmp eax, ebx
je 0x101cb862
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101cb86a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x101cba15
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x101cbb67
xor edx, edx
cmp eax, edx
je 0x101cbb67
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x101cba4a
cmp eax, ecx
jb 0x101cba4a
xor ecx, ecx
jmp 0x101cba4f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x101cba69
jg 0x101cbb67
cmp eax, dword [esi + 8]
ja 0x101cbb67
cmp ecx, edx
jne 0x101cba83
cmp eax, dword [esi + 0x42c]
ja 0x101cba83
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x101cbac8
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x101cbaa3
cmp edi, edx
jb 0x101cbaa3
xor edx, edx
jmp 0x101cbaa8
mov edx, 1
cmp ecx, ebx
ja 0x101cbac8
cmp dword [esp + 0x14], edx
jg 0x101cbac8
jl 0x101cbab8
cmp eax, edi
ja 0x101cbac8
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.101cbb80
test eax, eax
je 0x101cbb67
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x101cbb16
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x101cbb57
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x101cbb57
jmp 0x101cbb26
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101cbb57
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101cbb57
cmp dword [edi], ebp
jne 0x101cbb57
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x101cbe30
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x101cbf16
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x101cbea3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x101cbefa
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x101cbeb6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x101cbee6
mov ebx, 0x3d
jmp 0x101cbef4
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x101cbe4a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x41aedc
pop dword [ebp - 0x20]
mov eax, 0xdfb1f471
sub eax, 0xdf704595
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x39b58
push 0
mov eax, 0x929eda1f
add eax, 0x6da3e60d
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x324c890c
add ecx, 0xcdb3c08f
mov ebx, eax
mov esi, 0x55994ac6
sub esi, 0x555592c6
add esi, dword [ebp - 0x20]
mov edx, 0x2429279f
add edx, 0x78619d4a
xor dword [ebp - 4], 0x2c35bfa5
mov edi, dword [esi]
add dword [ebp - 0x10], 0x246aeff5
add edi, edx
sub dword [ebp - 0xc], esi
mov dword [ebx], edi
xor dword [ebp - 0x18], 0x2da38234
add ebx, 4
add esi, 0x3ddace43
add esi, 0xc22531c1
loop 0x41af3b
add eax, 0x1193f
mov ebx, eax
add eax, 5
mov ecx, 0x616b48df
sub ecx, 0x612b48df
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e004]
jne 0x40100a
repz ret
jmp fcn.004016ac

Function at 0x409144
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403d07
and dword [ebp - 4], 0
cmp dword [0x4441e0], 0
mov ebx, eax
jne 0x4091f5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092a6
push eax
call fcn.00403c95
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4441e0], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4441e4], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4441e8], eax
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x4441f0], eax
test eax, eax
je 0x4091f5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x4441ec], eax
mov eax, dword [0x4441ec]
cmp eax, ebx
je 0x40924d
cmp dword [0x4441f0], ebx
je 0x40924d
push eax
call fcn.00403d10
push dword [0x4441f0]
mov esi, eax
call fcn.00403d10
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40924d
test edi, edi
je 0x40924d
call esi
test eax, eax
je 0x409244
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409244
test byte [ebp - 0xc], 1
jne 0x40924d
or dword [ebp + 0x10], 0x200000
jmp 0x409286
mov eax, dword [0x4441e4]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409286
mov eax, dword [0x4441e8]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4441e0]
call fcn.00403d10
pop ecx
test eax, eax
je 0x4092a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x18a1b3c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18a1b46
pushal
call 0x18a1b4c
pop ebp
sub ebp, 0x10
sub ebp, 0x14a1b3c
jmp 0x18a1b62
mov eax, 0x14a1b3c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e5
mov edx, 0x7ecdc54f
xor byte [eax], dl
inc eax
dec ecx
jne 0x18a1b79
jmp 0x18a1b8c
les eax, [edx + 0x4f73c6c4]
dec edi
dec edi
into
invalid
Function at 0x40225b
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x402282
inc edi
cmp edi, 0x1f6502b0
jl 0x40226a
cmp dword [0x48528c], 0x400
jne 0x402308
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push str.ketunuzututevutixaheve_kur_hucudecagixifelowizin
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.conixagewudopipulo
push esi
call fcn.0040276e
push esi
push esi
call fcn.004029e4
fldz
add esp, 8
fstp qword [esp]
call fcn.00402880
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402530
fstp st(0)
push esi
call fcn.00402a91
push esi
call fcn.00402aa0
add esp, 0x10
xor edi, edi
cmp edi, 0xd0fe
jge 0x402319
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x58bc6e
jg 0x402338
inc edi
cmp edi, 0xe52f
jl 0x40230a
mov eax, dword [0x475314]
mov dword [0x48528c], eax
call fcn.0040202e
mov edi, 0x3078f
cmp dword [0x48528c], 0x51f
jne 0x402366
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x40234c
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x406cde
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474bc0]
jne 0x406ce8
repz ret
jmp fcn.0040955f
Function at 0x40912a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x474bc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403cf6
and dword [ebp - 0x14], 0
cmp dword [0x47fe40], 0
mov dword [ebp - 0x18], eax
jne 0x4091dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409285
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409285
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47fe40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47fe44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47fe48], eax
call edi
push eax
call esi
mov dword [0x47fe50], eax
test eax, eax
je 0x4091dd
push 0x472c80
push ebx
call edi
push eax
call esi
mov dword [0x47fe4c], eax
mov eax, dword [0x47fe4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409236
cmp dword [0x47fe50], ecx
je 0x409236
push eax
call esi
push dword [0x47fe50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409236
test ebx, ebx
je 0x409236
call edi
test eax, eax
je 0x40922d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40922d
test byte [ebp - 8], 1
jne 0x409236
or dword [ebp + 0x10], 0x200000
jmp 0x409269
mov eax, dword [0x47fe44]
cmp eax, dword [ebp - 0x18]
je 0x409269
push eax
call esi
test eax, eax
je 0x409269
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409269
mov eax, dword [0x47fe48]
cmp eax, dword [ebp - 0x18]
je 0x409269
push eax
call esi
test eax, eax
je 0x409269
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47fe40]
call esi
test eax, eax
je 0x409285
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409287
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406cde
leave
ret

Function at 0x401000
Capabilities:
Terminate process
Write file on windows

Disassembly:
push 0xfffffffffffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
mov ebx, esp
push 0
push ebx
push 0xf
push 0x401024
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x206c260
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xd8
aaa
push 0x2f0b8562
or byte [edx + eax - 0x5f], 0xdf
push cs
mov ebp, 0x3f435998
cmp bh, al
or byte [esi + 0x1f3eab1a], ch
fmulp st(7)
invalid
call fcn.02745310
pop ebx
xor al, 0xac
daa
aam 0xe
sub al, 0x43
mov esi, dword [esi]
ror dword [ecx - 7], cl
jne 0x206c211
adc eax, 0x1b535b7
stosd dword es:[edi], eax
add dword [eax + 0x3d8212e], ebx
and al, 0xdb
mov bh, 0x2c
pushal
mov ch, 0x1a
jp 0x206c2cd
lds ebp, [eax + 0x3235d976]
mov byte [0xd8ae1590], al
cmp eax, 0x582d66bb
fdivr dword [0x582d66bb]
stc
xor edx, dword [edx + 0x44]
test al, 0xe4
cmp dword [edx + ecx*2 + 0x17], ecx
loopne 0x206c293
call 0xa0e304f9
pop ebx
xor byte cs:[ecx + 0x43], ch
invalid
iretd

Function at 0x26cc878
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x24]
je 0x26c93f9
cmp bh, 0x1e
stc
cmc
jmp 0x26c9d2f
shr dword [edi - 0x3b], 0x4f
lds ebx, [ecx - 0x23]
jno 0x2364823
inc ecx
ret
test dl, 0xaa
cmc
clc
test ah, 0x18
cmp al, 9
call fcn.01df32ba
jp 0x236484d
mov esi, dword [ebx + ebx*4]
mov esi, 0x41fc59ac
pop ecx
cld
inc ecx
xchg esp, eax
push 0xffffffffffffffde
jl 0x2364823
pushal
salc
push esp
sar byte [edx - 0x24], 0x78
in eax, dx
push edi
xor ecx, ebp
popfd
xchg esp, eax
pop ebx
lodsd eax, dword [esi]
rol ecx, cl
or byte [ecx - 0x4dba0b0b], al
stc
or dl, dh
xchg byte [edi - 0x29], bl
push eax
push 0x8a82a1bd
push 0xeef38c06
jg 0x2364882
aam 0x1f
clc
xchg esp, eax
out dx, eax
and eax, 0x1982959e
jne 0x236483b
sahf
xchg ebp, eax
sbb byte [ecx], 0x75
mov al, 3
cwde
hlt
add ebx, dword [eax + 0x740caf4]
xor bh, byte [ecx - 0x19]
stosd dword es:[edi], eax
pop esi
rep insb byte es:[edi], dx
add bh, cl
dec ebp
leave
dec ebx
test byte [eax], dl
inc ecx
xchg esi, eax
add al, 0x47
sbb bh, al
or eax, 0xdc5f229f
movsb byte es:[edi], byte [esi]
and esp, ebp
aas
cmc
dec eax
jle 0x2364885
push ebp
jmp 0xf1964410
sub al, 0x30
jge 0x2364837
cmp ch, bh
stc
cmp ch, 0xa4
cmp al, 9
test al, al
jmp 0x2077d09
Function at 0x4041c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40422a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040383c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402728
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404214
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404231
lea eax, [ebp - 0x10]
call fcn.004035f4
ret

Function at 0x405ffc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406035
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004036e4
jmp 0x40603e
mov eax, ebx
mov edx, esi
call fcn.00403648
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406048
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406069
mov al, byte [esp]
jmp 0x40606b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4066f0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406568
mov eax, dword [0x4083a4]
cmp byte [eax], 0
je 0x40676c
mov eax, dword [0x408300]
call fcn.004026c4
call fcn.004025ec
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004054cc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4067b4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4067a2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4082e0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x409660]
call fcn.00403c14
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407160
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4071c4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040383c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004053a0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4071cb
lea eax, [ebp - 0xc]
call fcn.004035f4
ret

Function at 0x407cfc
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x407cbc
call fcn.00404424
xor eax, eax
push ebp
push 0x407da4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1f5
push 0x4097a0
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x409798
mov edx, 0x4097a0
mov ecx, 0x1f5
call fcn.0040383c
push dword [0x409798]
push 0x407db8
push 0x407dd0
mov eax, 0x40979c
mov edx, 3
call fcn.004038b4
mov eax, dword [0x40979c]
call fcn.00403868
mov eax, 0x409998
mov edx, dword [0x40979c]
call fcn.00405528
mov eax, 0x409b90
mov edx, 0x409998
mov ecx, 0x1f5
call fcn.0040383c
push 5
push 0x409998
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407dab
ret