joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401445
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x40b0f8]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x228]
lea ecx, [esp]
push ebp
mov ebp, dword [esp + 0x228]
and eax, 0x300
push esi
mov esi, dword [esp + 0x230]
push edi
mov edi, dword [esp + 0x22c]
and esi, 1
push ecx
mov dword [esp + 0x18], eax
or eax, 9
push eax
push ebp
push edi
call fcn.00406795
test eax, eax
jne 0x401554
xor ecx, ecx
test byte [esp + 0x234], 2
je 0x4014cd
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ecx
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401531
xor ecx, ecx
push 0x105
lea eax, [esp + 0x1c]
push eax
push ecx
jmp 0x401502
test esi, esi
jne 0x401531
push dword [esp + 0x234]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.00401445
test eax, eax
jne 0x401510
push 0x105
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4014da
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406ddf
mov esi, eax
test esi, esi
jne 0x401542
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401554
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401554
push 0
push dword [esp + 0x18]
mov ecx, esi
push ebp
push edi
call dword [0x4092cc]
call esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00408561
add esp, 0x21c
ret 0xc
Function at 0x4033dc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x403406
mov eax, dword [0x477d98]
push edi
add eax, ecx
push edi
push eax
push dword [0x40b014]
mov dword [0x41f16c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.0040323e
test eax, eax
js 0x4034dc
push ebx
push esi
push 4
lea eax, [ebp - 4]
push eax
push dword [0x40b014]
call fcn.00406e41
test eax, eax
je 0x4034d7
push dword [ebp - 4]
add dword [0x41f16c], 4
call fcn.0040323e
mov esi, eax
test esi, esi
js 0x4034d3
cmp dword [ebp + 0x10], edi
jne 0x4034a7
mov ecx, dword [ebp - 4]
test ecx, ecx
jle 0x4034d3
mov ebx, 0x4000
mov edi, 0x430d48
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40b014]
mov dword [ebp - 8], eax
call fcn.00406e41
test eax, eax
je 0x4034d7
push dword [ebp - 8]
push edi
push dword [ebp + 0xc]
call fcn.00406f05
test eax, eax
je 0x4034a3
mov eax, dword [ebp - 8]
add esi, eax
mov ecx, dword [ebp - 4]
add dword [0x41f16c], eax
sub ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jg 0x40345f
jmp 0x4034d3
push 0xfffffffffffffffe
jmp 0x4034d9
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 4], eax
cmovl eax, dword [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4034d7
mov esi, dword [ebp - 8]
add dword [0x41f16c], esi
mov eax, esi
jmp 0x4034da
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x4034ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x40b0f8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x403534
mov eax, dword [0x41f180]
test eax, eax
je 0x403528
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x41f180], 0
jmp 0x4035b6
cmp dword [0x41f180], 0
je 0x403546
push 0
call fcn.004066b4
jmp 0x4035b6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x477d40]
jbe 0x4035b6
cmp dword [0x46fd38], 0
je 0x403591
test byte [0x477e34], 1
je 0x4035b6
call fcn.004034e1
push eax
lea eax, [ebp - 0x84]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
push 0
call fcn.0040618e
jmp 0x4035b6
push 0
push 0x4038c0
push 0
push 0x6f
push dword [0x46fd34]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x41f180], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408561
leave
ret
Function at 0x406286
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4062a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x40662c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x40b0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x240]
push edi
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
ja 0x406673
test eax, eax
je 0x406673
add eax, eax
cmp word [ebp + eax - 0x242], 0x5c
je 0x406675
mov ecx, 0x409318
jmp 0x40667a
xor eax, eax
mov ecx, 0x40931a
push esi
push ecx
lea ecx, [ebp - 0x240]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x240]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00408561
leave
ret 4

Function at 0x4066e2
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406705
push dword [esp + 8]
push dword [esp + 8]
call fcn.004067c3
pop ecx
pop ecx
inc dword [0x477e10]
ret 8

Function at 0x4067c3
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, 0x4659d0
mov dword [0x4659d0], 0x55004e
mov dword [0x4659d4], 0x4c
push edi
mov edi, 0x400
test esi, esi
je 0x406816
push 1
push 0
push esi
call fcn.00406e14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4068fc
cmp eax, edi
jg 0x4068fc
push edi
mov esi, 0x4651d0
push esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4068fc
cmp eax, edi
jg 0x4068fc
push ebp
push esi
push ebx
push str._ls_ls_r_n
push 0x464dd0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x477d50]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00406301
push 4
push 0xc0000000
push esi
call fcn.00406e14
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4068fb
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4068f4
push esi
push edi
push ebx
call fcn.00406e41
test eax, eax
je 0x4068f4
push str._Rename__r_n
push edi
call fcn.0040704a
test eax, eax
jne 0x406900
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x464dd0
lea eax, [ecx + edi]
push eax
call fcn.00406b85
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406f05
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
ret
push 0x409a0c
add eax, 0xa
push eax
call fcn.0040704a
mov ecx, eax
test ecx, ecx
je 0x4068c5
lea edx, [edi + esi]
jmp 0x40691f
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406919
sub ecx, edi
inc ecx
jmp 0x4068c7
Function at 0x406a56
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00407098
mov edi, eax
cmp edi, 0xffffffff
je 0x406a99
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406a7a
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406a80
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406a89
xor eax, eax
inc eax
jmp 0x406a9b
test byte [ebp + 0xc], 4
jne 0x406a99
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406b09
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x460dd0
push edi
call fcn.0040702e
push edi
call fcn.004070c0
mov esi, eax
test esi, esi
je 0x406b7e
push esi
call fcn.00407240
test byte [0x477d4c], 0x80
je 0x406b42
movzx eax, word [esi]
test ax, ax
je 0x406b7e
cmp eax, 0x5c
je 0x406b7e
sub esi, edi
sar esi, 1
jmp 0x406b5c
call fcn.00406aa0
test eax, eax
je 0x406b56
test byte [eax], 0x10
je 0x406b7e
push edi
call fcn.00407211
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
cmp eax, esi
jg 0x406b48
call fcn.00406a27
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406b7e
xor eax, eax
inc eax
jmp 0x406b80
xor eax, eax
pop edi
pop esi
ret 4

Function at 0x406ba7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x45cd88], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x45cd88
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406be6
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x406bea
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x264
mov eax, dword [0x40b0f8]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
mov ebx, dword [esp + 0x270]
push esi
mov esi, dword [esp + 0x270]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406b09
mov dword [esp + 0x18], eax
test bl, 8
je 0x406c3a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x477e08], eax
jmp 0x406dc5
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x18], ebp
je 0x406c57
test eax, eax
je 0x406db4
test bl, 2
je 0x406d7d
push esi
push 0x45cdd0
call fcn.0040702e
test ebp, ebp
je 0x406c78
push str..
push 0x45cdd0
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x406c7e
push esi
call fcn.00407211
xor eax, eax
cmp word [esi], ax
jne 0x406c8f
cmp word [0x45cdd0], 0x5c
jne 0x406c9b
push 0x409318
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
push 0x45cdd0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x406d69
mov ebp, dword [esp + 0x10]
push 0x2e
pop eax
cmp word [esp + 0x4c], ax
jne 0x406ceb
cmp word [esp + 0x4e], 0
je 0x406d44
cmp word [esp + 0x4e], ax
jne 0x406ceb
cmp word [esp + 0x50], 0
je 0x406d44
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x18]
call fcn.0040702e
test byte [esp + 0x20], 0x10
je 0x406d12
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406d44
push ebx
push esi
call fcn.00406bea
jmp 0x406d44
push edi
push esi
call fcn.00406a56
test eax, eax
jne 0x406d3c
test edi, edi
je 0x406d34
push esi
push 0xfffffffffffffff1
call fcn.0040618e
xor eax, eax
push eax
push esi
call fcn.004066e2
jmp 0x406d44
inc dword [0x477e08]
jmp 0x406d44
push esi
push 0xfffffffffffffff2
call fcn.0040618e
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406ccd
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x406dc4
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x1c], ecx
je 0x406db4
push esi
call fcn.00406aa0
test eax, eax
je 0x406dc4
push esi
call fcn.00406a27
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406a56
test eax, eax
jne 0x406dbc
test edi, edi
je 0x406db4
push esi
push 0xfffffffffffffff1
call fcn.0040618e
xor eax, eax
push eax
push esi
call fcn.004066e2
jmp 0x406dc4
inc dword [0x477e08]
jmp 0x406dc4
push esi
push 0xffffffffffffffe5
call fcn.0040618e
pop ebp
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408561
add esp, 0x264
ret 8

Function at 0x406e14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x4000
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406795
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406ee3
push esi
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x3ffe], ax
pop esi
jne 0x406ee3
cmp dword [ebp - 8], 1
je 0x406ee8
cmp dword [ebp - 8], 2
je 0x406ee8
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406eed
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40b0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 0xc], 0x73006e
mov dword [ebp - 8], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 8], dx
lea eax, [ebp - 0xc]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406fa7
test edi, edi
jne 0x406f6c
mov word [esi], ax
jmp 0x406fa9
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408561
leave
ret 8

Function at 0x407098
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4070ba
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x407345
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x466424], 0
push esi
jne 0x40737f
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x407356
mov dword [ecx*4 + 0x466420], edx
inc ecx
cmp ecx, 0x100
jl 0x407351
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x4073a9
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x466420]
inc esi
sub edx, 1
jne 0x407391
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10020a90
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call fcn.10020a90
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10020a90
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x408151
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408160
pop dword [ebp - 0x14]
mov eax, 0x408160
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3df81
push 0
mov eax, 0xa33c996d
sub eax, 0xa2fa4755
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xc006d34e
add ecx, 0x3ff9756c
mov edx, eax
mov ebx, 0xa726b983
sub ebx, 0xa6e36583
add ebx, dword [ebp - 0x14]
mov esi, 0xf910b36a
add esi, 0x245c5830
sub dword [ebp - 8], 0xc3a4024c
mov edi, dword [ebx]
xor dword [ebp - 8], esi
sub edi, esi
sub dword [ebp - 0x10], 0x9610c328
mov dword [edx], edi
mov dword [ebp - 8], 0x25f0179e
add edx, 0x37cad920
sub edx, 0x37cad91c
add ebx, 0xa11ab63e
add ebx, 0x5ee549c6
loop 0x4081ba
add eax, 0x7e226f13
sub eax, 0x7e215958
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x206671be
sub ecx, 0x202671be
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4b2915
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b2794

Function at 0x4b61fd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b5ebd

Function at 0x4bb860
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x1400
cmp ax, di
je 0x4bb910
push 9
lea eax, [ebp - 0x18]
mov ebx, edi
push eax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4bb910
mov ecx, dword [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004064e0
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4bb8cb
mov eax, dword [esi]
jmp 0x4bb8cd
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, 0x400
cmp di, ax
jb 0x4bb8fd
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4bb8fd
dec eax
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004064e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049510d
mov esp, ebp
pop ebp
ret

Function at 0xeedf54
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeedf5e
pushal
call 0xeedf64
pop ebp
sub ebp, 0x10
sub ebp, 0xaedf54
jmp 0xeedf7a
mov eax, 0xaedf54
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b5
mov edx, 0xb6ffd4ef
xor byte [eax], dl
inc eax
dec ecx
jne 0xeedf91
jmp 0xeedfa4
and ah, byte fs:[esi - 0x2d]
out dx, eax
out dx, eax
out dx, eax
outsb dx, byte [esi]
pop ss
out dx, eax
out dx, eax
out dx, eax
in al, dx
and dl, byte [edi - 0x17]
out dx, eax
out dx, eax
out dx, eax
push ebp
invalid