joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418b58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x418b67
pop dword [ebp - 0x10]
mov eax, 0x7ad3fefc
sub eax, 0x7a927395
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3c56a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4028464a
sub ecx, 0x4027fe9b
mov esi, eax
mov edi, 0xb7413729
add edi, 0x4901f6d7
add edi, dword [ebp - 0x10]
mov edx, 0x7ba842ba
sub edx, 0xfb5dc0cd
sub dword [ebp - 8], esi
mov ebx, dword [edi]
sub dword [ebp - 0xc], esi
add ebx, edx
xor dword [ebp - 0xc], 0x8d2871a3
mov dword [esi], ebx
xor dword [ebp - 0xc], 0xe375724c
add esi, 4
add edi, 0xa5596836
add edi, 0x5aa697ce
loop 0x418bc1
add eax, 0x28b32189
sub eax, 0x28b20ffa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25f63121
add ecx, 0xda49cedf
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x2eb565a7
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
mov ecx, 0x4f1213b9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x47b149
Capabilities:
Connect socket

Disassembly:
jmp 0x508bd4
jmp dword [sym.imp.WS2_32.dll_connect]

Function at 0x47bf2c
Capabilities:
Terminate process

Disassembly:
jmp 0x508cb0
jmp fcn.00516d10
cmp ecx, dword [0x59adb0]
jne 0x508cba
repz ret
jmp 0x47c54e
Function at 0x481260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
push esi
push edi
lea edi, [ebp - 0x29c]
mov ecx, 0xa7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x59adb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10c], 0
push 0x103
push 0
lea eax, [ebp - 0x10b]
push eax
call fcn.0047c3fa
add esp, 0xc
mov esi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, esp
call fcn.0047d11f
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x13c], 0x54
mov byte [ebp - 0x13b], 0x58
mov byte [ebp - 0x13a], 0x47
mov byte [ebp - 0x139], 0x75
mov byte [ebp - 0x138], 0x69
mov byte [ebp - 0x137], 0x46
mov byte [ebp - 0x136], 0x6f
mov byte [ebp - 0x135], 0x75
mov byte [ebp - 0x134], 0x6e
mov byte [ebp - 0x133], 0x64
mov byte [ebp - 0x132], 0x61
mov byte [ebp - 0x131], 0x74
mov byte [ebp - 0x130], 0x69
mov byte [ebp - 0x12f], 0x6f
mov byte [ebp - 0x12e], 0x6e
mov byte [ebp - 0x12d], 0
mov esi, esp
push 0x104
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
cmp esi, esp
call fcn.0047d11f
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0047c689
add esp, 8
test eax, eax
jne 0x4814a0
mov esi, esp
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, esp
call fcn.0047d11f
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x118]
push eax
call fcn.0047a3b1
add esp, 4
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
je 0x4813df
mov eax, dword [ebp - 0x160]
imul eax, eax, 0x6c
cmp dword [eax + 0x59ca70], 1
jle 0x4813d5
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x154], 1
cmp dword [ebp - 0x148], 1
je 0x4814a0
mov eax, dword [ebp - 0x160]
mov dword [0x59ce4c], eax
cmp dword [ebp - 0x154], 1
je 0x48142b
mov eax, dword [0x59ce48]
imul eax, eax, 0x6c
mov ecx, dword [ebp - 0x118]
mov dword [eax + 0x59ca08], ecx
mov eax, dword [0x59ce48]
mov dword [0x59ce4c], eax
mov eax, dword [0x59ce48]
add eax, 1
mov dword [0x59ce48], eax
mov word [ebp - 0x1cc], 0
push 0x62
push 0
lea eax, [ebp - 0x1ca]
push eax
call fcn.0047c3fa
add esp, 0xc
lea eax, [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.0047bfcc
add esp, 8
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
je 0x4814a0
mov esi, esp
lea eax, [ebp - 0x1cc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
call eax
cmp esi, esp
call fcn.0047d11f
mov esi, esp
push 1
mov eax, dword [0x59ce40]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.0047d11f
push edx
mov ecx, ebp
push eax
lea edx, [0x4814d0]
call fcn.0047a8c5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047bf2c
add esp, 0x29c
cmp ebp, esp
call fcn.0047d11f
mov esp, ebp
pop ebp
ret
Function at 0x4cb0e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0047d11f
movsx eax, ax
test eax, eax
jge 0x4cb126
mov eax, dword [ebp - 8]
or eax, 8
mov dword [ebp - 8], eax
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0047d11f
movsx eax, ax
test eax, eax
jge 0x4cb147
mov eax, dword [ebp - 8]
or eax, 1
mov dword [ebp - 8], eax
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0047d11f
movsx eax, ax
test eax, eax
jge 0x4cb168
mov eax, dword [ebp - 8]
or eax, 2
mov dword [ebp - 8], eax
mov esi, esp
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0047d11f
movsx eax, ax
test eax, eax
jge 0x4cb189
mov eax, dword [ebp - 8]
or eax, 4
mov dword [ebp - 8], eax
mov esi, esp
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0047d11f
movsx eax, ax
test eax, eax
jge 0x4cb1aa
mov eax, dword [ebp - 8]
or eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.0047d11f
mov esp, ebp
pop ebp
ret

Function at 0x4eaab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd0]
mov ecx, 0x34
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3b4], 0
je 0x4eab92
cmp dword [ebp + 8], 0x100
jne 0x4eab50
movzx eax, word [ebp + 0xc]
cmp eax, 0xd
jne 0x4eab50
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3ba]
test ecx, ecx
je 0x4eab29
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0047d11f
movsx eax, ax
test eax, eax
jge 0x4eab50
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3bb]
test ecx, ecx
jne 0x4eab50
mov eax, dword [ebp - 8]
cmp dword [eax + 0x40], 0
je 0x4eab4c
push 0
push 0
push 0
push str.return
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x40]
call fcn.0047d322
xor eax, eax
jmp 0x4eab97
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3b4]
call fcn.0047d2b4
mov dword [ebp - 0xd0], eax
mov esi, esp
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xd0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd0]
mov edx, dword [eax + 0xc]
call edx
cmp esi, esp
call fcn.0047d11f
jmp 0x4eab97
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.0047d11f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4082d0
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x409a1c
Capabilities:
Get number of processors

Disassembly:
xor dh, byte gs:[eax]
xor al, 0x35
popal
xor al, 0x37
cmp word fs:[ebp + 0x66], sp
bound edi, qword [eax]
xor esp, dword [esi + 0x39]
aaa
bound esp, qword fs:[ebx + 0x30]
popal
xor dword [esi], esi
xor byte [0x38376135], dh
xor dh, byte [eax]
xor eax, 0x38383338
xor dh, byte fs:[esi]
xor eax, 0x33613534
bound esi, qword [eax]
aaa
xor ax, 0x6665
cmp byte [esi + 0x64], ah
xor al, 0x37
xor dh, byte [esp]
xor dh, byte [eax]
xor byte [0x66376135], dh
xor byte [ebx], dh

Function at 0x409a68
Capabilities:
Get number of processors

Disassembly:
xor byte [ebp + 0x62], ah
xor eax, 0x32303665
cmp byte [ecx], dh
xor esp, dword [ecx + esi + 0x64]
arpl word [ecx], si
xor byte ss:[ebp + 0x30], ah
xor esi, dword [0x66393765]
arpl word [ebx], si
xor byte [edx], dh
popal
cmp dword [eax], esi
xor eax, 0x34646235
bound esi, qword [ecx]
xor esi, dword [ebx]
arpl word fs:[ecx], si
xor byte [ecx], bh
xor ah, byte [edx + 0x38]
xor eax, 0x63636665
aaa
cmp dword gs:[ecx], edi
xor dword [ebx], esi
bound esi, qword [ecx]
xor esp, dword ss:[edx + 0x61]
aaa
xor byte [0x36646335], dh
cmp dword [eax], edi
cmp byte [edi], dh
xor byte [ebx], dh
cmp byte [esp + esi + 0x62], ah
xor si, word [esi]
xor dword [esi], esi
bound edi, qword [ecx]
xor al, 0x33
cmp byte [edx + 0x65], ah
cmp dword ss:[eax], esi
xor ah, byte ss:[ebp + 0x37]
xor ah, byte fs:[eax + esi + 0x35]
xor byte [0x37323036], dh

Function at 0x409ad8
Capabilities:
Get number of processors

Disassembly:
xor byte [0x37323036], dh
popal
xor eax, 0x62333865
cmp dword [eax], edi
cmp dword [edi], esi
aaa
xor byte fs:[edi], dh
cmp byte [esi], dh
arpl word [ecx], di
aaa
xor al, 0x33
xor dword [eax], esi
xor al, 0x61
arpl word [0x61663261], si
xor byte gs:[0x61653236], dh
xor al, 0x37
xor word [esi + 0x61], sp
xor byte ss:[ecx], bh
arpl word [0x62393831], si
xor dh, byte [edx]
xor byte [ecx], bh
xor byte [esi + esi + 0x35], ah
aaa
cmp byte [ebx + 0x35], ah
xor esi, dword [0x30343133]
xor eax, 0x32663336
xor byte [esp + esi + 0x33], ah
xor ax, 0x6461
xor dh, byte fs:[edx]
bound esp, qword [ebp + 0x33]
cmp byte [edx + 0x64], ah
xor al, 0x61
xor dword [0x37663366], esi
Function at 0x40c208
Capabilities:
Get number of processors

Disassembly:
bound esp, qword [esi + 0x66]
aaa
cmp word [ebx], si
xor al, 0x30
xor byte fs:[ecx], dh
cmp dword [0x62366234], esi
xor dword [esi + 0x65], esp
xor sp, word gs:[ecx + 0x64]
bound esi, qword [ebx]
xor al, 0x36
xor esp, dword [ebp + 0x38]
arpl word [ebx], si
xor dword [esi + 0x65], esp
xor dh, byte ss:[edx]
cmp byte [esi + 0x35], ah
cmp dword [ebx], esi
cmp dword gs:[eax], esi
xor byte fs:[edi], dh
cmp byte [ecx], bh
arpl word [esi], si
xor eax, 0x64653265
bound esp, qword [ecx + 0x31]
aaa
cmp dword [edi], esi
xor dword [edx + 0x37], esp
bound esi, qword [esi]
arpl word gs:[ebx], si
aaa
xor dword [ebx], esi
Function at 0x40dc2c
Capabilities:
Get number of processors

Disassembly:
xor esp, dword [esi + 0x39]
cmp byte [ecx + 0x63], ah
cmp byte fs:[ebp + 0x32], ah
xor eax, 0x62346330
Function at 0x40e8ac
Capabilities:
Get number of processors

Disassembly:
aaa
popal
xor esp, dword [ebx + 0x64]
xor dword [ecx], edi
xor eax, 0x65323132
xor esi, dword ss:[esi]
xor byte [esi + 0x34], ah
xor byte [edi + esi], dh
xor ah, byte [ecx + 0x66]
cmp byte [eax], dh
xor al, 0x65
xor ah, byte [ecx + esi + 0x62]
xor esp, dword ss:[edx + 0x30]
cmp byte [ecx + esi], dh
cmp byte [ebx], dh
xor al, 0x38
cmp byte [edx + 0x62], ah
cmp dword [ecx], edi
xor dword [ecx + 0x33], esp
xor dword [ecx], esi
xor byte [ecx + edi], dh
aaa
bound esp, qword gs:[esi + 0x37]
aaa
bound esi, qword [esi]
arpl word [edx], si
popal
xor byte gs:[ecx], bh
xor byte ss:[eax], bh
xor al, 0x32

Function at 0x40e8fc
Capabilities:
Get number of processors

Disassembly:
xor al, 0x63
cmp word [eax], si
aaa
xor dword [ecx + 0x37], esp
aaa
popal
popal
xor al, 0x61
popal
bound esp, qword ss:[ecx + 0x64]
xor dh, byte [0x37323534]
xor dword [edx + 0x63], esp
xor word gs:[esi], si
xor byte [ecx + 0x39], ah
xor byte gs:[eax], bh
xor al, 0x32
bound esi, qword [ecx]
popaw
xor esi, dword [ebx]
xor al, 0x66
xor dword [eax], edi
bound esp, qword [ebx + 0x61]
xor dword [edx + 0x66], esp
arpl word ss:[ebx + 0x37], sp
xor ax, 0x6436
xor dword [edx + 0x34], esp
xor dh, byte [edx]
xor al, 0x34
cmp byte [ecx], bh
popal
xor byte [eax], bh
xor al, 0x34
aaa
bound esp, qword [esi + 0x63]
xor eax, 0x31623164
cmp dword [0x36396636], esi
xor dh, byte ss:[esi]
xor byte [edx], dh
xor edi, dword [eax]
xor dword [esi + 0x35], esp
arpl word [ecx], si
xor eax, 0x61633762
bound esi, qword [eax]
xor byte ss:[eax], bh
xor al, 0x35
xor ah, byte [esi + 0x65]
xor byte [edx + 0x32], ah
cmp byte [0x33343434], dh
xor eax, 0x33393763
xor dh, byte gs:[edi]
xor byte [ebx], dh
aaa
cmp byte ss:[esi], dh
bound esp, qword [esi + 0x62]
popal
xor edi, dword ss:[eax]
xor byte fs:[eax], bh
xor al, 0x35
cmp dword gs:[ebx], esi
arpl word ss:[eax], di
xor eax, 0x35346461
bound esi, qword [esi + 0x63626332]
cmp byte [esi], dh
popal
xor esi, dword [ecx]
arpl word ss:[esi + 0x32], sp
popal
aaa
cmp dword [esi + 0x66], esp
xor byte [ecx], dh
popal
arpl word [eax], si
cmp byte [esi + esi], dh
xor dword ss:[eax], esi
bound esp, qword [esi + 0x39]
xor al, 0x30
bound esp, qword [esi + 0x64]
popal
xor word [esi + 0x32], sp
aaa
xor eax, 0x61633361
xor esi, dword [ebx]
arpl word gs:[esi + 0x32], sp
xor eax, 0x37316238
xor byte [eax], bh
xor al, 0x37
aaa
popaw
popal
aaa
xor esp, dword [ebp + 0x64]
cmp dword [edi], esi
arpl word [0x34656166], si
arpl word [ebp + 0x32], sp
xor al, 0x33
xor ax, 0x3635
aaa
cmp dword ss:[ebp + 0x64], esp
xor ah, byte [ebx + 0x30]
cmp byte [edi + esi], dh
arpl word [edx + 0x65], sp
aaa
arpl word [ebx + 0x35], sp
xor al, 0x34
xor edi, dword [ecx]
xor al, 0x63
xor byte [esi + 0x37], ah
cmp byte [esp + esi], dh
xor dword fs:[eax], edi
bound esp, qword ss:[ebx + 0x65]
Function at 0x40e95c
Capabilities:
Get number of processors

Disassembly:
xor al, 0x63
cmp word [eax], si
aaa
xor dword [ecx + 0x37], esp
aaa
popal
popal
xor al, 0x61
popal
bound esp, qword ss:[ecx + 0x64]
xor dh, byte [0x37323534]
xor dword [edx + 0x63], esp
xor word gs:[esi], si
xor byte [ecx + 0x39], ah
xor byte gs:[eax], bh
xor al, 0x32
bound esi, qword [ecx]
popaw
xor esi, dword [ebx]
xor al, 0x66
xor dword [eax], edi
bound esp, qword [ebx + 0x61]
xor dword [edx + 0x66], esp
arpl word ss:[ebx + 0x37], sp
xor ax, 0x6436
xor dword [edx + 0x34], esp
xor dh, byte [edx]
xor al, 0x34
cmp byte [ecx], bh
popal
xor byte [eax], bh
xor al, 0x34
aaa
bound esp, qword [esi + 0x63]
xor eax, 0x31623164
cmp dword [0x36396636], esi
xor dh, byte ss:[esi]
xor byte [edx], dh
xor edi, dword [eax]
xor dword [esi + 0x35], esp
arpl word [ecx], si
xor eax, 0x61633762
bound esi, qword [eax]
xor byte ss:[eax], bh
xor al, 0x35
xor ah, byte [esi + 0x65]
xor byte [edx + 0x32], ah
cmp byte [0x33343434], dh
xor eax, 0x33393763
xor dh, byte gs:[edi]
xor byte [ebx], dh
aaa
cmp byte ss:[esi], dh
bound esp, qword [esi + 0x62]
popal
xor edi, dword ss:[eax]
xor byte fs:[eax], bh
xor al, 0x35
cmp dword gs:[ebx], esi
arpl word ss:[eax], di
xor eax, 0x35346461
bound esi, qword [esi + 0x63626332]
cmp byte [esi], dh
popal
xor esi, dword [ecx]
arpl word ss:[esi + 0x32], sp
popal
aaa
cmp dword [esi + 0x66], esp
xor byte [ecx], dh
popal
arpl word [eax], si
cmp byte [esi + esi], dh
xor dword ss:[eax], esi
bound esp, qword [esi + 0x39]
xor al, 0x30
bound esp, qword [esi + 0x64]
popal
xor word [esi + 0x32], sp
aaa
xor eax, 0x61633361
xor esi, dword [ebx]
arpl word gs:[esi + 0x32], sp
xor eax, 0x37316238
xor byte [eax], bh
xor al, 0x37
aaa
popaw
popal
aaa
xor esp, dword [ebp + 0x64]
cmp dword [edi], esi
arpl word [0x34656166], si
arpl word [ebp + 0x32], sp
xor al, 0x33
xor ax, 0x3635
aaa
cmp dword ss:[ebp + 0x64], esp
xor ah, byte [ebx + 0x30]
cmp byte [edi + esi], dh
arpl word [edx + 0x65], sp
aaa
arpl word [ebx + 0x35], sp
xor al, 0x34
xor edi, dword [ecx]
xor al, 0x63
xor byte [esi + 0x37], ah
cmp byte [esp + esi], dh
xor dword fs:[eax], edi
bound esp, qword ss:[ebx + 0x65]
Function at 0x40f76c
Capabilities:
Get number of processors

Disassembly:
arpl word [0x36303534], si
cmp dword gs:[ebp + 0x65], esp
xor esp, dword [ecx + 0x31]
xor byte [eax], bh
xor dword [eax], esi
cmp byte [eax], dh
cmp byte [edx + 0x61], ah
Function at 0x411600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x41165a
inc esi
xor edi, edi
cmp edi, 1
jne 0x411626
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040dc2c
jmp 0x411634
cmp edi, 1
jle 0x411634
mov eax, dword [ebp + 8]
push eax
call fcn.0040dc2c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0041118c
test eax, eax
jne 0x41165a
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x41165a
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x41165a
inc edi
dec esi
jne 0x411616
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x411664
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x411688
mov eax, dword [ebp - 4]
jmp 0x41168b
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x411690
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4116dd
xor ebx, ebx
jmp 0x4116d2
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call 0x407f9c
test eax, eax
jne 0x4116d1
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x411787
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4116b3
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4116e9
je 0x4116f2
jmp 0x4116fb
call fcn.0040ece8
mov esi, eax
jmp 0x4116fd
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4116fd
xor esi, esi
test si, si
je 0x411787
xor ebx, ebx
jmp 0x411723
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x411722
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x411787
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x41170a
xor ebx, ebx
jmp 0x41177c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x41177b
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x411770
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.00411664
push eax
mov eax, esi
call fcn.00411664
pop edx
cmp edx, eax
jne 0x41177b
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x411787
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411732
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x406583
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x4065a3
cmp byte [ebp + 8], 0
je 0x40659b
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret
mov eax, dword [ebp + 0xc]
add dword [eax], 0x1c
pop ebp
ret
test cl, cl
je 0x4065b2
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x21
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
test eax, eax
jns 0x4065c4
add eax, 0x100
js 0x4065bb
mov dword [ecx], eax
pop ebp
ret
Function at 0x40940b
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 8], 0x48af
mov dword [ebp - 0x18], 0xb8b78acc
mov dword [ebp - 0xc], 0x642e40c1
push 3
lea ecx, [ebp - 0x44]
call fcn.0040809e
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x409447
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x40945d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.0040818c
or dword [eax], 0xffffffff
jmp 0x409440
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
sub eax, 0xf628
cmp eax, 0x7e78
jge 0x409482
mov dword [ebp - 0x14], 1
jmp 0x409486
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
je 0x40949d
mov dword [ebp - 0x1c], 1
jmp 0x4094a1
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c], eax
jle 0x4094b2
mov dword [ebp - 0x20], 1
jmp 0x4094b6
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x20]
mov ecx, 0xfafd11d9
sub ecx, eax
cmp ecx, 2
jne 0x4094d1
mov dword [ebp - 0x24], 1
jmp 0x4094d5
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x24], eax
jne 0x4094e9
cmp dword [ebp - 8], 0
jne 0x4094e9
and dword [ebp - 0x2c], 0
jmp 0x4094f0
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
push 2
lea ecx, [ebp - 0x44]
call fcn.0040818c
mov dword [ebp - 0x28], 0x2da3c3d2
cmp dword [ebp - 0x28], 0
je 0x409525
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x409523
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x40954b
mov dword [ebp - 0xc], 0
jmp 0x409535
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x14
je 0x40954b
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x30], 0xc5c6a3f1
jmp 0x40952e
lea ecx, [ebp - 0x44]
call fcn.00408170
push dword [ebp + 8]
push 0x5bd6
push 0
push 1
push dword [ebp + 0xc]
call fcn.00409812
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x411c38
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x411c64
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
call fcn.0041b34f
add esp, 0xc
jmp 0x411c95
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x411c81
push 0x1a5f
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x411c95
push 0
call fcn.0041b6e5
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41abc1
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41abf7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x2123
push 0x7ec6
push 1
call fcn.0041ac29
add esp, 0x14
jmp 0x41ac25
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41ac1d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41ac1b
push 0
call fcn.0041bd17
pop ecx
jmp 0x41ac25
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret