joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b3698
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x59a112
pushfd
or dword [esp], reloc.WINMM.dll_midiStreamOut
popfd
cpuid
nop
jmp 0x59a129
pop ebx
ret
jmp 0x5b3735
mov bp, word [esp + 0x20]
mov ebp, dword [esp + 0x4b]
lea esp, [esp + 0x50]
jmp 0x59a106

Function at 0x5b5d68
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5b5da4
jmp 0x5b5d8e
call fcn.005b5df3
pushfd
lea ebx, reloc.WINMM.dll_midiStreamOut
mov ebx, eax
inc ch
jp 0x5b5dc2
jnp 0x5b5dc2
popal
int1
popal
add bl, dh
inc ebp
jo 0x5b5dc9
push 0xffffffffffffffc1
retf
lea ebx, [esi + 0x50]
lea edx, [edx + edx]
sbb dx, 0x1b36
js 0x5b5d36
rcl dl, cl
jmp 0x5b5da6
ja 0x5ab106
xchg dword [edx + 0x53], esi
invalid
bsf bx, si
jle 0x5b5d3a
jg 0x5b5d3a
sub edi, dword [edx + reloc.WINMM.dll_midiStreamOut]
sbb esi, dword [edx - 0x2e]
sar byte [ebx], cl
jmp 0x5b5e1e
rcl dl, cl
cmp ebp, ebx
jne 0x5b5d38
je 0x5b5d38
lea ecx, [esi + 0x40]
mov ebx, dword [esp]
stc
jbe 0x5b5dda
bt ebx, esp
push bp
jmp 0x5b5ea5
jmp 0x5b5dac
push bp
lea esp, [esp + 2]
jmp 0x5b5e44
add ch, bl
js 0x5b5d8f
push esp
retf 0x5cad
bt ebx, esp
jmp 0x5b5dc4
mov bx, word [esp]
lea ebx, [eax + ebx]
jmp 0x5b5e1b
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x5b5dfd
lea ebx, [ebp - 0x80]
and bl, 0xfc
call 0x5b5e27
cmp eax, 0x7915ec83
inc ebx
pop dword [esp + 0xc]
add esp, 0xa
lea esp, [esp + 3]
jmp 0x5b5e87
sub ecx, edx
neg ebx
jp 0x5b5e13
lea ebx, reloc.WINMM.dll_midiStreamOut
mov bx, word [esp]
lea ebx, [eax + ebx]
jmp 0x5b5e1b
pop dword [esp + 2]
jmp 0x5b5f00
sub ebx, ecx
pushal
push dword [esp + 0xc]
jb 0x5b5e71
jae 0x5b5eab
movsb byte es:[edi], byte [esi]
aas
scasd eax, dword es:[edi]
retf 0x8339
lea esp, [esp + 2]
jmp 0x5b5e44
pop dword [esp + 2]
jmp 0x5b5f00
push esi
push edi
push ecx
jmp 0x5b5eba
mov esi, edx
pushal
mov dword [esp], ebx
sub esp, 0x1b
jmp 0x5b6031
push word [esp + 0xd]
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
popal
jmp 0x5b5f33
mov esp, ebx
pushfd
lea esi, [ecx + ebx - 0x40]
jmp 0x5b5eb1
mov ecx, ecx
cld
rep movsb byte es:[edi], byte [esi]
call fcn.005b5f75
lodsd eax, dword [esi]
push sp
lea ecx, [ecx - 0x34]
sub esp, 0x1b
mov dword [esp], ebp
jmp 0x5b5fa9
mov dword [esp + 0xd], ebp
pop word [esp + 3]
lea esp, [esp + 1]
xchg dword [esp + 0x1c], ecx
call fcn.005b5f90
lea esp, [esp + 0x1c]
popal
jmp 0x5b5f33
js 0x5b5eea
push word [esp + 0xd]
lea esp, [esp + 1]
jmp 0x5b5fd7

Function at 0x5da918
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x20]
mov al, byte [edx]
call fcn.005da8bb
dec edi
aad 0x45
sub al, 0xdf
sbb eax, esp
ja 0x5da912
test eax, 0xf18b56c8
pushal
mov word [esp], bp
jmp 0x5da8a0
push dword [esp]
jmp 0x5da930
adc dword [eax - reloc.WINMM.dll_midiStreamOut], esp
jmp 0x5da902
lea esp, [esp + 8]
dec dword [esp + 8]
call fcn.005da91a
test eax, eax
jmp 0x5dad4d
jne 0x5da8de
not al
mov eax, esi
jmp fcn.005daa9f

Function at 0x5da91a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push word [esp + 1]
lea esp, [esp + 5]
lea esp, [esp + 1]
jmp 0x5da93d
Function at 0x5da982
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
mov dword [esp], esp
call 0x5da982
arpl word [edx + 0x4568e4f5], bx
out 0xd3, eax
push cs
or ecx, esp
xor eax, 0xebc033cd
inc edi
jmp 0x5dac38
xor eax, eax
jmp 0x5da9c9
add eax, ecx
jmp 0x5dac22
jmp 0x5dd120
pop esi
jmp 0x5da99d
pushal
lea esp, [esp + 0x1b]
mov byte [esp], ah
jmp 0x5dab69
test eax, eax
call 0x5db01b
cmc
mov bh, 0x64
inc edi
xchg ebp, eax
leave
jl 0x5daa94
add edi, dword [esi + edx*4]
invalid
pushal
lea esp, [esp + 0x20]
and al, 0x20
jmp 0x5dafe6
out 0x47, eax
sub byte [eax], bl
mov ebx, dword [ebx]
jle 0x5daa29
dec edi
scasb al, byte es:[edi]
mov ecx, 0x648dc35e
pop esi
ret
lea esp, [esp + 4]
push ebp
ror edx, 0x1a
jmp 0x5daae3
sub esp, 0x18
mov edx, esp
jmp 0x5dab2a
bts ecx, esi
mov ebp, esp
push si
lea esp, [esp + 2]
jmp 0x5daacd
neg edx
jmp 0x5dab36
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
and dword [ebp - 0xc], 0
jmp 0x5dab14
add eax, ecx
sub esp, 5
lea esp, [esp + 1]
jmp 0x5dabba
push dword [esp + 4]
lea esp, [esp + 1]
jmp 0x5daba3
je 0x5da9fb
xor eax, eax
jmp 0x5da99d
mov esi, dword [eax + 0x78]
stc
jmp 0x5dabc9
lea esp, [esp + 8]
push esi
pushfd
bsr si, dx
bsr si, bp
jmp 0x5dab8d
mov edx, 0x10b
lea esp, [esp + 4]
cmp word [eax + 0x18], dx
jmp 0x5dab80
add esi, ecx
call 0x5dabd1
inc edi
mov eax, dword [eax + 0x7c]
push edi
jmp 0x5dac94
lea esp, [esp + 4]
test eax, eax
jmp 0x5dac54
mov eax, dword [esi + 0x20]
push ebx
cmc
mov dword [esp], edx
jmp 0x5dac02
push ebx
jmp 0x5dac76
lea esp, [esp + 8]
and dword [ebp - 4], 0
stc
jmp 0x5da987
jne 0x5da968
je 0x5da97e
lea esp, [esp + 2]
jmp 0x5dacc1
mov ebx, dword [esi + 0x18]
push edi
push edi
pop word [esp]
jmp 0x5dac60
mov dword [ebp - 0x18], eax
lea esp, [esp + 0xc]
je 0x5da97e
mov al, 0x5c
setge al
jmp 0x5dac18
mov dword [ebp - 0x10], eax
jmp 0x5dad12
mov edi, dword [esi + 0x24]
sub esp, 0x13
sub esp, 0xa
lea esp, [esp + 1]
jmp 0x5dacab
mov eax, dword [ecx]
pop ecx
add edi, ecx
add eax, ecx
jmp 0x5dad30
push ecx
mov ecx, esi
add ecx, 0x1c
jmp 0x5dacf4
mov ecx, ebp
jmp 0x5daf64
lea esp, [esp + 0x1c]
dec ebx
push ecx
jmp 0x5dad1a
lea esp, [esp + 2]
mov dword [ebp - 0x14], eax
call int.005dad72
pop edx
jmp 0x5daf20
lea esp, [esp + 0x24]
jb 0x5daa27
xchg ch, cl
jmp 0x5daf3f
cmp eax, esi
pushfd
mov byte [esp], dl
pushal
jmp 0x5daf0a
pushal
jmp 0x5daf48
mov ecx, dword [ebp - 0x18]
add ecx, esi
cmp eax, ecx
jmp 0x5daf29
lea esp, [esp + 0x20]
jb 0x5daa11
jae 0x5daa27
add cl, byte [edi + 0x29897a1f]
mov byte [0x63f2cdd], al
mov cl, 0x8d
dec ecx
clc
lea ecx, [ecx - 8]
mov dword [ecx], edi
pop ecx
push edi
pop word [esp]
jmp 0x5daebf
test eax, eax
call 0x5daf8a
leave
ret 8
Function at 0x5dabd1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
mov dword [esp], esp
call 0x5da982
arpl word [edx + 0x4568e4f5], bx
out 0xd3, eax
push cs
or ecx, esp
xor eax, 0xebc033cd
inc edi
jmp 0x5dac38
xor eax, eax
jmp 0x5da9c9
add eax, ecx
jmp 0x5dac22
jmp 0x5dd120
pop esi
jmp 0x5da99d
pushal
lea esp, [esp + 0x1b]
mov byte [esp], ah
jmp 0x5dab69
test eax, eax
call 0x5db01b
cmc
mov bh, 0x64
inc edi
xchg ebp, eax
leave
jl 0x5daa94
add edi, dword [esi + edx*4]
invalid
pushal
lea esp, [esp + 0x20]
and al, 0x20
jmp 0x5dafe6
out 0x47, eax
sub byte [eax], bl
mov ebx, dword [ebx]
jle 0x5daa29
dec edi
scasb al, byte es:[edi]
mov ecx, 0x648dc35e
pop esi
ret
lea esp, [esp + 4]
push ebp
ror edx, 0x1a
jmp 0x5daae3
sub esp, 0x18
mov edx, esp
jmp 0x5dab2a
bts ecx, esi
mov ebp, esp
push si
lea esp, [esp + 2]
jmp 0x5daacd
neg edx
jmp 0x5dab36
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
and dword [ebp - 0xc], 0
jmp 0x5dab14
add eax, ecx
sub esp, 5
lea esp, [esp + 1]
jmp 0x5dabba
push dword [esp + 4]
lea esp, [esp + 1]
jmp 0x5daba3
je 0x5da9fb
xor eax, eax
jmp 0x5da99d
mov esi, dword [eax + 0x78]
stc
jmp 0x5dabc9
lea esp, [esp + 8]
push esi
pushfd
bsr si, dx
bsr si, bp
jmp 0x5dab8d
mov edx, 0x10b
lea esp, [esp + 4]
cmp word [eax + 0x18], dx
jmp 0x5dab80
add esi, ecx
call 0x5dabd1
inc edi
mov eax, dword [eax + 0x7c]
push edi
jmp 0x5dac94
lea esp, [esp + 4]
test eax, eax
jmp 0x5dac54
mov eax, dword [esi + 0x20]
push ebx
cmc
mov dword [esp], edx
jmp 0x5dac02
push ebx
jmp 0x5dac76
lea esp, [esp + 8]
and dword [ebp - 4], 0
stc
jmp 0x5da987
jne 0x5da968
je 0x5da97e
lea esp, [esp + 2]
jmp 0x5dacc1
mov ebx, dword [esi + 0x18]
push edi
push edi
pop word [esp]
jmp 0x5dac60
mov dword [ebp - 0x18], eax
lea esp, [esp + 0xc]
je 0x5da97e
mov al, 0x5c
setge al
jmp 0x5dac18
mov dword [ebp - 0x10], eax
jmp 0x5dad12
mov edi, dword [esi + 0x24]
sub esp, 0x13
sub esp, 0xa
lea esp, [esp + 1]
jmp 0x5dacab
mov eax, dword [ecx]
pop ecx
add edi, ecx
add eax, ecx
jmp 0x5dad30
push ecx
mov ecx, esi
add ecx, 0x1c
jmp 0x5dacf4
mov ecx, ebp
jmp 0x5daf64
lea esp, [esp + 0x1c]
dec ebx
push ecx
jmp 0x5dad1a
lea esp, [esp + 2]
mov dword [ebp - 0x14], eax
call int.005dad72
pop edx
jmp 0x5daf20
lea esp, [esp + 0x24]
jb 0x5daa27
xchg ch, cl
jmp 0x5daf3f
cmp eax, esi
pushfd
mov byte [esp], dl
pushal
jmp 0x5daf0a
pushal
jmp 0x5daf48
mov ecx, dword [ebp - 0x18]
add ecx, esi
cmp eax, ecx
jmp 0x5daf29
lea esp, [esp + 0x20]
jb 0x5daa11
jae 0x5daa27
add cl, byte [edi + 0x29897a1f]
mov byte [0x63f2cdd], al
mov cl, 0x8d
dec ecx
clc
lea ecx, [ecx - 8]
mov dword [ecx], edi
pop ecx
push edi
pop word [esp]
jmp 0x5daebf
test eax, eax
call 0x5daf8a
leave
ret 8
Function at 0x6ab224
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
sub esp, 0
mov ah, ch
bsr eax, ebp
xchg dx, ax
jmp 0x6ab24a
lea eax, [ebx*4]
mov cl, dl
inc ecx
mov al, byte [esp + 3]
jmp 0x6ab20e
push word [esp + 4]
mov dword [esp + 4], edx

Function at 0x6ab299
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae dh
push bx
lea esp, [esp + 2]
call fcn.006ab0ee
std
mov cx, word [esp]
pushal
cld
lea ecx, [esi*4]
jmp 0x6ab338
xchg byte [esp + 4], al
call fcn.006ab2cf
xchg byte [esp], al
bts ecx, ecx
mov edx, 0x48bc8c2
mov eax, 0xd1e57001
rdtsc
add esp, 0xd
jmp 0x6ab2e5

Function at 0x6ab2cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x14]
xchg byte [esp + 0x10], dh
xchg word [esp + 1], ax
jmp 0x6ab30c
pop dword [esp + 7]
rdtsc
mov byte [esp + 0x16], ch
std
not cl
call fcn.006ab2ee
Function at 0x6af9ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 5]
lea esp, [esp + 0xc]
clc
pushfd
push word [esp + 0xe]
jmp 0x6afa15
pop dword [esp]
mov word [esp + 0xe], bp
mov word [esp + 5], dx
push dword [esp + 9]
jmp 0x6af9b8
push si
pop word [esp + 2]
mov byte [esp + 3], al
sub esp, 6
pushal
jmp 0x6afa26
pop dword [esp]
stc
add esp, 0xf
mov byte [esp + 3], ah
mov dword [esp], ebx
std
jmp 0x6af9ff
push dword [esp + 3]
cld
pushal
lea esp, [esp + 0x4f]
sub esp, 0xe
mov byte [esp + 1], al
jmp 0x6afb89
sub esp, 0x13
call fcn.006afa65
clc
push word [esp + 1]
mov byte [esp + 0x12], bl
pop word [esp + 0x13]
cld
lea esp, [esp + 0xd]
jmp 0x6afa9b
mov byte [esp + 3], ch
mov dword [esp + 3], ecx
mov word [esp + 8], cx
std
sub esp, 0xa
mov dword [esp + 0x10], esp
jmp 0x6afac9

Function at 0x6afa73
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x20], bx
jmp 0x6afa7e
sub esp, 0x1e
lea esp, [esp + 0x42]
call fcn.006afaa3
inc esi
fisttp qword [ebp + 0x14]
out 0x62, eax
mov al, 0x2e
mov esp, 0xbfb136db
xchg byte [ecx], dh
xor byte [ebx], dh

Function at 0x6afaa3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], ax
lea esp, [esp]
cmc
add esp, 2
jmp 0x6afb21
pop word [esp + 3]
pop word [esp]
push word [esp + 2]
sub esp, 0x1a
jmp 0x6afaf5
sub esp, 0xa
pop dword [esp + 0x24]
call fcn.006afadf
push dword [esp + 2]
push dword [esp + 0xf]
mov word [esp + 0xa], cx
stc
push word [esp + 0x11]
cld
jmp 0x6afb57
sub esp, 0x13
cmc
push dword [esp + 0x14]
mov dword [esp + 2], ebx
sub esp, 7
add esp, 0x15
jmp 0x6afab1
pop word [esp]
push dword [esp + 0x12]
call 0x6afb38
lea esp, [esp + 0x14]
popfd
lea esp, [esp + 4]
call fcn.006afbeb

Function at 0x6afadf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x11], si
sub esp, 0x15
lea esp, [esp + 0x42]
sub esp, 0x15
jmp 0x6afb01

Function at 0x6afb72
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
jmp 0x6afbb9
pop word [esp + 1]
push dword [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.006afba3
pop word [esp]
push esp
lea esp, [esp + 2]
mov dword [esp], edx
pushfd
lea esp, [esp + 3]
jmp 0x6afc0a
mov byte [esp], cl
lea esp, [esp + 1]
push ebx
call fcn.006afbf0

Function at 0x6afbf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
push word [esp + 2]
lea esp, [esp]
jmp 0x6afc2d
lea esp, [esp + 2]
mov dword [esp], esp
pushfd
call fcn.006afc17
Function at 0x6afc17
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6ab14a
call fcn.006ab14f
push dword [esp + 7]
push word [esp + 3]
mov dword [esp + 3], edi
jmp 0x6afc3a
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 4], ebp
pushfd
pop word [esp]
push word [esp]
jmp 0x6afcc6
mov dword [esp + 4], esi
call 0x6afc81
xchg esi, eax
add eax, 0xfc0ffc95
and byte [esi + 0xbbe4324], dh
xor ch, byte [ebx + 0x2ad5e3b]
dec esi
fnstcw word [eax]
sbb ebx, dword [eax + 0x2d]
jo 0x6afcd9
mov esi, 0x3bab320b
pop esi
lodsd eax, dword [esi]
add cl, byte [esi - 0x27]
cmp byte [ebx], bl
pop eax
sub eax, 0x2af070
sub al, byte [eax]
push eax
jmp 0x6aad48
Function at 0x403bf6
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403c0e
push dword [esp + 4]
push 0x403b8f
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403c4b
push esi
mov esi, dword [0x4b0300]
test esi, esi
je 0x403c4a
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403c42
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x4b0300
call fcn.00404dda
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403c1b
pop edi
pop ebx
pop esi
ret 4
Function at 0x4043b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4043e5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x404670
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x4b0364]
push ebx
push esi
push edi
push eax
or edi, 0xffffffff
push ecx
or ebx, edi
call fcn.00404c1e
mov esi, eax
test esi, esi
je 0x4046ca
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, dword [esp + 0x10]
xor edi, edi
xor edx, edx
or ecx, edx
or edi, eax
cmp dword [esi + 4], edx
je 0x4046c0
cmp dword [esi + 0x14], edx
jne 0x4046c0
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
cdq
add ecx, eax
adc edi, edx
mov edx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
ret 4

Function at 0x4046e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4b0364]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00404c1e
test eax, eax
je 0x40472a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x404717
push 1
push edx
push eax
call fcn.004049a0
movzx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x404740
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4b0364]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00404c1e
test eax, eax
je 0x40478a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x404777
push 4
push edx
push eax
call fcn.004049a0
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x4047a0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4b0364]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00404c1e
test eax, eax
je 0x4047ea
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x4047d7
push 1
push edx
push eax
call fcn.004049a0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x404800
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x404859
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x404858
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4b0364]
push eax
push ecx
call fcn.00404c1e
test eax, eax
je 0x404854
cmp dword [eax + 4], 0
je 0x404842
push esi
push edi
push eax
call fcn.00404ad0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x404860
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.004050b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x4b0364]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.00404c1e
mov ebx, eax
test ebx, ebx
je 0x40497e
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x4048be
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004049a0
mov dword [esp + 0x14], eax
jmp 0x4048d5
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x4048e7
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x404911
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.004050b0
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x40497d
cmp dword [esp + 0x14], 0
je 0x404928
cmp al, 0xd
je 0x404928
cmp al, 0xa
jne 0x4048a0
sub ebp, 1
cmp al, 0xd
jne 0x40497d
cmp dword [ebx + 4], 0
je 0x404944
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004049a0
jmp 0x40495b
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x40497d
cmp dword [ebx + 4], 0
je 0x40496e
add dword [ebx + 0xc], 1
jmp 0x40497d
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.00405130
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x408d64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404ae8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408d7d
test al, 0x10
jne 0x408d81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x408e6c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404ae8
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x408e80
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404ae8
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x408ea2
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40b93c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b975
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404728
jmp 0x40b97e
mov eax, ebx
mov edx, esi
call fcn.0040468c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b988
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b9a9
mov al, byte [esp]
jmp 0x40b9ab
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c030
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bea8
mov eax, dword [0x462760]
cmp byte [eax], 0
je 0x40c09d
mov eax, dword [0x462574]
call fcn.00402e90
call fcn.00402880
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004092dc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c0e4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c0d3
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x462528]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x463718]
call fcn.00405de8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cebc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cf20
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004048a0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408b38
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf27
lea eax, [ebp - 0xc]
call fcn.00404638
ret

Function at 0x4233fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x463a24
cmp dword [edi], 0
jne 0x423478
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x463a20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x460608
mov ecx, 2
call fcn.00402920
mov edx, 0x4233d4
lea eax, [esi + 5]
call fcn.004233f4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004233f4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42344d
mov dword [0x463a20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424954
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42495a
ret

Function at 0x426df0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x426e41
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x426e28
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426e18
jmp 0x426e41
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x426e29
pop ebx
mov esp, ebp
pop ebp
ret