joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd85
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40dd98
push 0x80004005
call fcn.004019be
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40dd9f
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x413681
Capabilities:
Create process on windows

Disassembly:
sub eax, 0x3ef
push ebx
push esi
push edi
push 1
mov esi, ecx
pop edi
je 0x4137a6
dec eax
je 0x41379f
sub eax, 7
je 0x41374a
dec eax
je 0x4136cb
sub eax, 4
jne 0x4137df
push edi
xor ebx, ebx
push ebx
push ebx
push 0x480b48
push 0x480b90
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4137df
push 8
lea eax, [esi + 0x30]
call fcn.00423487
xor ebx, ebx
push ebx
lea eax, [esi + 0x114]
call fcn.00423487
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
push edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xd8
push 0x10
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov ecx, dword [esi + 0x80]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
lea eax, [esi + 0x84]
push ebx
call fcn.00423419
push 0xc3c3c3
push 0xa
lea eax, [esi + 0x84]
call fcn.00422d9d
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push ebx
push ebx
push 0xd69
jmp 0x4137d1
push 8
lea eax, [esi + 0x30]
call fcn.00423487
xor ebx, ebx
push ebx
lea eax, [esi + 0xcc]
call fcn.00423487
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
push edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xd8
push 0x10
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x80]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push ebx
push ebx
push 0xd6c
jmp 0x4137d1
call fcn.00413cd5
jmp 0x4137df
xor ebx, ebx
cmp byte [esi + 0x2c], bl
je 0x4137da
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4137df
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push ebx
push ebx
push 0xd62
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4137df
call fcn.00413ca7
mov eax, dword [esp + 0x10]
mov dword [eax], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x41494a
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x48e5fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x480c74
xor esi, esi
push 0x69
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x41497f
xor eax, eax
jmp 0x4149cb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x41497b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x41497b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x4149c8
push esi
push 0x80
push 2
push esi
push 1
push 0x10000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4149d9
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00448d93
leave
ret
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4149f8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x4149ca
xor esi, esi
inc esi
jmp 0x4149ed
Function at 0x414a98
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.00466880
mov eax, dword [0x48e5fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xf9c
lea eax, [ebp - 0x1204]
push ebx
push eax
mov dword [ebp - 0x1208], ebx
call fcn.00449330
add esp, 0xc
push 0x206
lea eax, [ebp - 0x256]
push ebx
push eax
mov dword [ebp - 0x260], ebx
mov word [ebp - 0x258], bx
call fcn.00449330
add esp, 0xc
push 0x40
lea eax, [ebp - 0x4e]
push ebx
push eax
mov dword [ebp - 0x25c], ebx
mov word [ebp - 0x50], bx
call fcn.00449330
xor eax, eax
add esp, 0xc
cmp eax, 0x480db8
je 0x414c2a
lea eax, [ebp - 0x260]
push eax
push 0xfa0
lea eax, [ebp - 0x1208]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x414c2a
mov eax, dword [ebp - 0x260]
cmp eax, ebx
je 0x414c2a
shr eax, 2
mov dword [ebp - 0x268], eax
mov eax, ebx
mov dword [ebp - 0x264], eax
je 0x414c2a
push dword [ebp + eax*4 - 0x1208]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x414c11
push 0x208
lea eax, [ebp - 0x258]
push ebx
push eax
mov dword [ebp - 0x25c], ebx
call fcn.00449330
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push 4
lea eax, [ebp - 0x25c]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x414c0a
push 0x104
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x25c]
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x414c0a
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x258]
push eax
call fcn.00448d7d
pop ecx
push eax
lea esi, [ebp - 0x50]
lea ecx, [ebp - 0x258]
call fcn.00446e30
test al, al
pop ecx
je 0x414c0a
push 0x480db8
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x414c3b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x264]
inc eax
cmp eax, dword [ebp - 0x268]
mov dword [ebp - 0x264], eax
jb 0x414b5c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448d93
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x414c2c
Function at 0x4159c8
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7c8]
sub esp, 0x848
mov eax, dword [0x48e5fc]
xor eax, ebp
mov dword [ebp + 0x7c4], eax
mov eax, dword [ebp + 0x7d4]
push ebx
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0x34]
xor ebx, ebx
cmp eax, ebx
push edi
je 0x4159fc
lea ecx, [eax + 0x20]
jmp 0x4159fe
xor ecx, ecx
cmp ecx, ebx
je 0x415a08
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
xor edi, edi
inc edi
cmp dword [ebp + 0x7d0], ebx
mov dword [esi + 0xf4], edi
jne 0x415a90
push 0x802
lea eax, [ebp - 0x3e]
push ebx
push eax
mov word [ebp - 0x40], bx
call fcn.00449330
push 0x480e5c
lea edi, [ebp - 0x40]
mov ebx, 0x480e54
call fcn.00409f3d
add esp, 0x10
test eax, eax
je 0x415a79
push 0x38
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00449330
mov eax, edi
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x64], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0
push 0
push 0xd63
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
inc edi
jmp 0x415adf
cmp dword [ebp + 0x7d0], edi
jne 0x415aaa
push ebx
push ebx
push 0xd63
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x415adf
cmp dword [ebp + 0x7d0], 2
jne 0x415adf
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x415adf
push 0x105
push ebx
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [esi + 0x34]
lea ecx, [eax + 0x20]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
lea ecx, [esi + 0x20]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0x7c4]
mov dword [eax], edi
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00448d93
add ebp, 0x7c8
leave
ret 8
Function at 0x41cd3f
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x20fc]
mov eax, 0x217c
call fcn.00466880
mov eax, dword [0x48e5fc]
xor eax, ebp
mov dword [ebp + 0x20f8], eax
mov eax, dword [ebp + 0x2104]
push ebx
push closesocket
push eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ebx
call fcn.0040a10f
test eax, eax
jge 0x41cd95
cmp dword [ebp - 0x1c], ebx
je 0x41cd8e
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41ce7a
push esi
push edi
xor eax, eax
mov byte [ebp + 0x20e8], bl
lea edi, [ebp + 0x20e9]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [ebp - 0x80]
stosb byte es:[edi], al
call fcn.00403a2c
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x2000
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41cdd6
call fcn.0040a496
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x41cdea
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x80]
call fcn.00404176
jmp 0x41cdb3
cmp dword [ebp - 0x1c], ebx
je 0x41cdfb
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp + 0x20e8]
push eax
lea esi, [ebp - 0x80]
call fcn.00404381
push 0xfe
lea eax, [ebp + 0x1fea]
push ebx
push eax
mov word [ebp + 0x1fe8], bx
call fcn.00449330
add esp, 0x10
lea esi, [ebp + 0x1fe8]
xor edi, edi
movzx eax, byte [ebp + edi + 0x20e8]
push eax
push 0x4814a8
push 3
push esi
call fcn.004493aa
add esp, 0x10
add esi, 4
inc edi
cmp edi, 0x10
jb 0x41ce2e
push dword [ebp - 0x24]
lea eax, [ebp + 0x1fe8]
push eax
call fcn.0044e10e
mov esi, eax
neg esi
sbb esi, esi
pop ecx
inc esi
cmp dword [ebp - 0x1c], ebx
pop ecx
je 0x41ce76
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp + 0x20f8]
xor ecx, ebp
pop ebx
call fcn.00448d93
add ebp, 0x20fc
leave
ret
Function at 0x4203e6
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x48e5fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x480c74
xor esi, esi
push 0x6a
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x42041b
xor eax, eax
jmp 0x420467
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x420417
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x420417
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x420464
push esi
push 0x80
push 2
push esi
push 1
push 0x10000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x420475
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00448d93
leave
ret
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x420494
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x420466
xor esi, esi
inc esi
jmp 0x420489

Function at 0x422af8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
mov esi, eax
call edi
mov ebx, 0xff00
and ax, bx
cmp ax, bx
je 0x422b28
push 2
call edi
and ax, bx
cmp ax, bx
je 0x422b28
push 1
push esi
call fcn.00422bef
push 0x3f3
push esi
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00422732
mov edi, eax
test edi, edi
je 0x422b58
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422b58
push dword [esp + 0x10]
mov eax, dword [edi]
push 0
push 0
push edi
call dword [eax + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
Function at 0x10001060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1000d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x100010cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100010b2
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x100010f9
inc ax
mov word [ebp - 0xa], ax
jmp 0x100010cc
cmp eax, 0xe7
jne 0x100010f9
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x100010f9
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10001095
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100072e9
leave
ret
xor al, al
jmp 0x100010ea

Function at 0x10001282
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1000d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x100012cb
cmp word [edx], cx
je 0x100012cb
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100012f0
mov eax, dword [ebp - 8]
xor ecx, ecx
push dword [ebp + 0x14]
push ebx
push 1
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov edi, eax
test ecx, ecx
je 0x100012ee
cmp ecx, esi
je 0x100012ee
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100072e9
leave
ret

Function at 0x1000150c
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0x1000d6d0], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x1000d6cc], ebx
push edi
push ebx
mov dword [0x1000d6c8], eax
mov dword [0x1000d6d4], ebx
mov dword [0x1000d6d8], eax
mov dword [0x1000d6dc], ebx
mov dword [0x1000d6e0], ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov esi, eax
mov dword [0x1000d6f4], edx
mov eax, 0x55555555
mov dword [0x1000d6f0], esi
xor edi, edi
mov dword [0x1000ea70], eax
pop ecx
mov dword [0x1000ea74], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.10008450
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0x1000d6f0], esi
adc edx, ebx
mov dword [edi*8 + 0x1000d6f4], edx
inc edi
cmp edi, eax
jb 0x1000156a
movaps xmm0, xmmword [0x1000a3e0]
pop edi
pop esi
mov dword [0x1000d6e8], eax
mov eax, 0x1000d6c8
movups xmmword [0x1000ea78], xmm0
pop ebx
ret 0x10
Function at 0x1000187e
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x10008871
call fcn.100081b9
mov esi, dword [0x1003fc54]
xor edi, edi
mov al, 1
xchg byte [esi], al
push 4
call fcn.100072f7
mov dword [ebp - 0x14], eax
mov dword [eax], esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
push ecx
push edi
push eax
push 0x10002747
push edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x1c
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x100018de
cmp dword [esi + 0x60], edi
je 0x100018cf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call fcn.10008177
ret
push 6
mov dword [ebp - 0x18], edi
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x10006658
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10006673
xor eax, eax
push eax
push eax
push eax
push 0x100062d9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x405b70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405bd6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404154
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b58
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405bc0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bdd
lea eax, [ebp - 0x10]
call fcn.00403ee4
ret

Function at 0x40ae58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae91
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403fd4
jmp 0x40ae9a
mov eax, ebx
mov edx, esi
call fcn.00403f38
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aea4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aec5
mov al, byte [esp]
jmp 0x40aec7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b54c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b3c4
mov eax, dword [0x46ba68]
cmp byte [eax], 0
je 0x40b5c8
mov eax, dword [0x46b720]
call fcn.004029c4
call fcn.00402844
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004085e4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b610
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b5fe
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46b698]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46c664]
call fcn.00405084
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40be64
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bf3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f7c
lea eax, [ebp - 8]
call fcn.004043f4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bf24
mov eax, ebx
call fcn.004026dc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bf1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bf07
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bf4c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bf07
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf24
mov eax, dword [ebp - 0x10]
call fcn.004026fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf41
lea eax, [ebp - 8]
call fcn.00403ee4
ret

Function at 0x40c42c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c490
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404154
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004080fc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c497
lea eax, [ebp - 0xc]
call fcn.00403ee4
ret

Function at 0x41aac0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041a918
dec esi
jne 0x41aae2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x41bc24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46c888
cmp dword [edi], 0
jne 0x41bca0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46c884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46a3ec
mov ecx, 2
call fcn.004028d8
mov edx, 0x41bbfc
lea eax, [esi + 5]
call fcn.0041bc1c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041bc1c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41bc75
mov dword [0x46c884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41ceb4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ceba
ret

Function at 0x41f2fc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41f34d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41f334
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41f324
jmp 0x41f34d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41f335
pop ebx
mov esp, ebp
pop ebp
ret