joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f900440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x4e814d
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._ldap_set_option
test eax, eax
je 0x6f900470
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], 0x4e814e
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp sym._ldap_set_option

Function at 0x6f900490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x4e816d
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._ldap_set_option
test eax, eax
je 0x6f9004c0
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], 0x4e816e
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp sym._ldap_set_option

Function at 0x6f908ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x42c
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ldif_open_url
mov dword [ebp - 0x420], eax
test eax, eax
je 0x6f908bf8
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x41c], edi
jmp 0x6f908b4b
lea esi, [ebx + edi]
lea eax, [esi + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._ber_memrealloc
mov ecx, eax
test eax, eax
je 0x6f908bb0
add ebx, ecx
lea eax, [ebp - 0x418]
mov dword [esp + 8], edi
mov dword [esp], ebx
mov ebx, esi
mov dword [esp + 4], eax
mov dword [ebp - 0x41c], ecx
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [ebp - 0x420]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fread]
mov edi, eax
test eax, eax
jne 0x6f908b08
mov eax, dword [ebp - 0x420]
mov edi, dword [ebp - 0x41c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fclose]
test ebx, ebx
je 0x6f908be0
mov eax, dword [ebp + 0xc]
mov byte [edi + ebx], 0
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor eax, eax
add esp, 0x42c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp - 0x41c]
mov dword [esp], edi
call sym._ber_memfree
mov eax, dword [ebp - 0x420]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fclose]
add esp, 0x42c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 1
mov dword [esp], edi
call sym._ber_memrealloc
test eax, eax
je 0x6f908bff
mov edi, eax
jmp 0x6f908b93
mov eax, 0xffffffff
jmp 0x6f908ba3
mov dword [esp], edi
call sym._ber_memfree
or eax, 0xffffffff
jmp 0x6f908ba3
Function at 0x6f90b4e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov dword [esp], str.HOME
call dword [sym.imp.ucrtbase.dll_getenv]
test eax, eax
je 0x6f90b58a
mov edi, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], eax
mov esi, eax
call edi
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
call edi
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], 0
lea eax, [ecx + eax + 3]
mov dword [esp], eax
call sym._ber_memalloc_x
mov edi, eax
test eax, eax
je 0x6f90b58a
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_s
mov dword [esp], eax
call sym._sprintf_4
mov edx, 1
mov eax, edi
call sym._openldap_ldap_init_w_conf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str._s._s
mov dword [esp], edi
call sym._sprintf_4
mov edx, 1
mov eax, edi
call sym._openldap_ldap_init_w_conf
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._ber_memfree_x
add esp, 0x2c
mov eax, ebx
mov edx, 1
pop ebx
pop esi
pop edi
pop ebp
jmp sym._openldap_ldap_init_w_conf
Function at 0x6f90dab0
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
add esp, 0xffffff80
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x30], 0
mov eax, dword [ebx + 0x84]
mov ecx, dword [edx]
mov dword [ebp - 0x2c], 0x11
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x80]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
lea eax, [ebx + 0x14]
mov dword [ebp - 0x44], 2
test ecx, ecx
je 0x6f90dcb0
mov edx, dword [ebx + 0x14]
mov ecx, eax
mov esi, edx
test edx, edx
jne 0x6f90db2e
jmp 0x6f90dca0
mov esi, dword [ecx + 0x18]
add ecx, 0x18
test esi, esi
je 0x6f90dca0
cmp esi, 0x4002
jne 0x6f90db20
mov esi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x6f90dca0
mov ecx, eax
mov esi, edx
jmp 0x6f90db5e
mov esi, dword [ecx + 0x18]
add ecx, 0x18
test esi, esi
je 0x6f90dca0
cmp esi, 0x4008
jne 0x6f90db50
mov esi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
test ecx, ecx
jne 0x6f90db8e
jmp 0x6f90dca0
mov edx, dword [eax + 0x18]
add eax, 0x18
test edx, edx
je 0x6f90dca0
cmp edx, 0x4004
jne 0x6f90db80
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6f90dca0
lea eax, [ebp - 0x24]
lea esi, [ebx + 4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], str.Negotiate
mov dword [esp], 0
mov dword [ebp - 0xc], 2
call sym._AcquireCredentialsHandleA_36
sub esp, 0x24
test eax, eax
jne 0x6f90dcbe
lea eax, [ebp - 0x4c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x48]
mov dword [esp + 0x24], eax
lea eax, [ebx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x10010
mov eax, dword [ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._InitializeSecurityContextA_48
sub esp, 0x30
mov edx, eax
cmp eax, 0x90312
sete al
test edx, edx
je 0x6f90dc76
test al, al
je 0x6f90dcbe
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x34]
movzx eax, al
mov dword [edx], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x3c]
mov dword [edx], ecx
mov edx, dword [ebp + 0x1c]
mov dword [edx], str.GSS_SPNEGO
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, 0xfffffff9
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [edx], eax
lea esp, [ebp - 8]
mov eax, 2
pop ebx
pop esi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x6f90dca5
Function at 0x6f90de70
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 0
mov eax, dword [ebx + 0x78]
lea esi, [edx - 4]
mov dword [ebp - 0x20], 1
mov ecx, esi
mov dword [ebp - 0x1c], 0
sub ecx, eax
mov dword [ebp - 0x30], eax
add eax, 4
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], ecx
cmp eax, edx
ja 0x6f90df21
mov eax, dword [ebx + 0x84]
mov edx, dword [ebx + 0x80]
cmp eax, esi
jb 0x6f90df50
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
add ebx, 0xc
mov dword [esp], edx
add eax, 4
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebx + 0x74]
mov dword [ebp - 0x28], eax
add eax, dword [ebx + 0x6c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._DecryptMessage_16
sub esp, 0x10
test eax, eax
je 0x6f90df30
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, eax
mov dword [esp], edx
cmp eax, esi
cmovb eax, esi
mov dword [esp + 4], eax
mov edi, eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, eax
test eax, eax
je 0x6f90df7d
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], edi
jmp 0x6f90ded6
mov eax, 0xfffffffe
jmp 0x6f90df26
Function at 0x6f90dfe0
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x30]
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], 0
mov edx, dword [ebx + 0x80]
lea esi, [ecx + edi + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 2
cmp esi, eax
ja 0x6f90e0e0
lea eax, [edx + ecx + 4]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._memcpy
mov eax, dword [ebx + 0x80]
mov edx, dword [ebx + 0x78]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
lea edx, [eax + edx + 4]
add eax, 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
mov dword [esp + 8], eax
lea eax, [ebx + 0xc]
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call sym._EncryptMessage_16
sub esp, 0x10
test eax, eax
je 0x6f90e0a8
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x80]
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x30]
bswap edx
mov dword [ecx], edx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebx + 0x80]
mov dword [edx], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp + 0x18]
add edx, dword [ebp - 0x30]
add edx, 4
mov dword [ecx], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, eax
mov dword [esp], edx
cmp eax, esi
cmovae esi, eax
mov dword [esp + 4], esi
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, eax
test eax, eax
je 0x6f90e10e
mov dword [ebx + 0x80], eax
mov ecx, dword [ebx + 0x78]
mov dword [ebx + 0x84], esi
jmp 0x6f90e040
mov eax, 0xfffffffe
jmp 0x6f90e09b

Function at 0x6f90e4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.ucrtbase.dll__read]

Function at 0x6f90f090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_recv]
sub esp, 0x10
leave
ret

Function at 0x6f90f0f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_send]
sub esp, 0x10
leave
ret
Function at 0x6f910180
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x3c]
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 3
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x40], ebx
xor eax, eax
test edx, edx
je 0x6f910251
mov eax, dword [esi + 4]
test eax, eax
je 0x6f910260
mov edx, dword [esi + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], edx
mov edx, dword [esi + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], 6
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi]
add eax, 8
mov dword [esp], eax
call sym._EncryptMessage_16
sub esp, 0x10
test eax, eax
jne 0x6f910278
lea esi, [ebp - 0x18]
mov eax, dword [ebx + 8]
mov edx, dword [ebx]
test eax, eax
je 0x6f910247
test edx, edx
je 0x6f910247
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov edi, dword [ecx + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [edi + 0x10]
test eax, eax
js 0x6f910278
add ebx, 0xc
cmp esi, ebx
jne 0x6f91021f
mov eax, dword [ebp + 0x10]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call sym._setup_buffers.part.0
test eax, eax
js 0x6f910278
mov eax, dword [esi + 4]
jmp 0x6f9101bb
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6f9105e0
Capabilities:
Get inbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x70
mov dword [esp + 4], 0x1c
mov dword [esp], 1
call sym._ber_memcalloc
mov ebx, eax
test eax, eax
je 0x6f91066d
lea edx, [ebp - 0x3c]
xor eax, eax
mov ecx, 0xd
cmp dword [ebp + 0xc], 1
mov edi, edx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x40], 4
rep stosd dword es:[edi], eax
mov eax, 1
mov dword [esp + 0x1c], ebx
adc eax, 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Unified_Security_Protocol_Provider
mov dword [esp], 0
call sym._AcquireCredentialsHandleA_36
sub esp, 0x24
test eax, eax
jne 0x6f910680
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop edi
pop ebp
ret
mov dword [esp], ebx
xor ebx, ebx
call sym._ber_memfree
jmp 0x6f91066d

Function at 0x43b630
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
add eax, eax
call fcn.0043b671
and esi, esi
sub esp, 4
mov dword [esp], 0x2227d6be
pop esi
sub eax, 0xf8d25192
xor dword [edx], ecx
push 0x4ee68863
pop esi
inc esi
add eax, esi
inc edx
or eax, eax
and eax, esi
add eax, eax
cmp edx, ebx
jne fcn.0043b630
sub eax, 0xe87c03a7
push eax
pop eax
add esi, esi
ret
Function at 0x40b044
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407b04
xor eax, eax
push ebp
push 0x40b104
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040858c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040873c
mov eax, dword [ebx]
call fcn.0040aef4
test al, al
jne 0x40b0e1
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040858c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040873c
mov eax, dword [ebx]
call fcn.0040aef4
test al, al
jne 0x40b0e1
mov eax, ebx
call fcn.00407a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b10b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407a80
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x40caa4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40e538
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040e524
add esp, 0x208
pop ebx
ret

Function at 0x41e04c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x41e085
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00407ba8
jmp 0x41e08e
mov eax, ebx
mov edx, esi
call fcn.00407e00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e098
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x41e0ba
movzx eax, word [esp]
jmp 0x41e0bc
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41f10c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41f231
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041ef14
mov esi, eax
mov eax, dword [0x4ba6c0]
cmp byte [eax], 0
je 0x41f1d9
mov eax, dword [0x4ba524]
call fcn.00405820
call fcn.00405564
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41f0dc]
call fcn.00409c00
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41f24c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x41f215
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4ba4f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4be634]
call fcn.00409ff0
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f238
lea eax, [ebp - 4]
mov edx, dword [0x41f0dc]
call fcn.00409d24
ret
Function at 0x4697b4
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xc0dcab4
jae 0x4697d8
in al, dx
mov esp, dword [esi + 0x47c0788c]
adc al, 0xd4
mov eax, dword [0x26f7ea46]
mov ebx, 0x977cb0bd
or ah, byte [edi - 0x58b1c0e7]
sbb dword [edi], edi
dec esi
cmpsd dword [esi], dword es:[edi]
mul dword [ebx]
jae 0x469746
nop
test byte [0xd5259b7b], al
nop
pop ss
xor eax, 0x3e42fdb8
outsb dx, byte [esi]
jecxz 0x469781
loop 0x4697a1
and eax, 0x383e635e
add edi, eax
pop esi
arpl word [esi], di
cmp byte [ebx], al
clc
xor byte [edx - 0x27], cl
test byte [edx - 0x697650f1], bl
mov ecx, 0xe99cc64d
or eax, 0x438cd50c
inc esi
adc byte [ecx], ah
mov eax, 0x88eaabdd
jp 0x4697a7
and eax, dword [esi + 0x3e]
in eax, 0xeb
inc esi
in eax, 0xeb
iretd

Function at 0x46bcb8
Capabilities:
Authenticate hmac

Disassembly:
xchg byte [ebx - 0x4c], al
jns 0x46bce7
sbb eax, 0x1d32abbd
ret
js 0x46bd13
xor byte [ecx], bl
sbb al, 0xf2
cli
pop ss
add al, 0x31
stosd dword es:[edi], eax
mov edi, 0xacfb0677
and bh, byte [edi - 0x40d9a742]
push cs
mov esi, 0xebf2658
xchg edx, eax
sbb bh, byte [edi + 0x7c2788b6]
cmpsd dword [esi], dword es:[edi]
imul ebp, dword [ecx], 0xffffff87
lodsb al, byte [esi]
imul ebp, dword [edi], 0xffffff87
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
lahf
cmpsb byte [esi], byte es:[edi]
xchg ecx, eax
jp 0x46bcfb
bswap ebx
lodsd eax, dword [esi]
jl 0x46bd69
shr byte [0x6e28455], cl
sub al, 0xa
sti
scasb al, byte es:[edi]
sbb bh, byte [ebp - 0x2d9f92cb]
invalid
mov eax, dword [esi]
adc dword [0x80192519], ebp
mov bl, 0xd2
cmp al, 0xfa
jecxz 0x46bd0b
inc esp
jge 0x46bded
dec edx
cwde
sal dh, cl
ret 0x8147
push edi
hlt

Function at 0x497a9c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x497aea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00497560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497b03
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4aefa0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4aefa8
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af10b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00408550
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004228bc
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004229b8
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
call fcn.00422d78
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00422678
lea eax, [ebp - 0x2c]
mov edx, 0x4af128
call fcn.004086e4
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004229b8
mov eax, dword [ebp - 0x28]
mov ecx, 1
pop edx
call fcn.00408abc
dec eax
je 0x4af047
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x4af0e3
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x4af0e3
lea eax, [ebp - 4]
call fcn.0042307c
cmp dword [ebp - 4], 0
jne 0x4af062
lea eax, [ebp - 4]
mov edx, 0x4af140
call fcn.00407e48
push 0x4af154
push dword [ebp - 4]
push 0x4af194
push 0x4af1a4
push 0x4af1e4
lea eax, [ebp - 8]
mov edx, 5
call fcn.004087c4
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.004084ec
push eax
call sub.advapi32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x4af0ab
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
xor ebx, ebx
jmp 0x4af0e3
mov dword [ebp - 0x18], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x4af0da
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af112
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00407a80
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407a80
ret

Function at 0x4af4d8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
call fcn.0041ff44
cmp eax, 2
jne 0x4af540
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4af4fb
xor eax, eax
jmp 0x4af54f
lea eax, [esp + 8]
push eax
push 0x4af554
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4af540
xor eax, eax
jmp 0x4af54f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret