joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b8335
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x100e54dd
call fcn.100c74ca
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x20]
push edx
push ebx
lea edx, [ebp - 0x18]
push edx
push ebx
lea edx, [ebp - 0x1c]
push edx
push ebx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100b8445
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1008a452
pop ecx
push dword [ebp - 0x20]
mov esi, eax
call fcn.1008a452
pop ecx
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x2c]
push esi
push dword [ebp - 0x24]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100b8422
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov word [esi + eax*2], cx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x64]
call fcn.10026c47
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.1008a452
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.100227b7
lea ecx, [ebp - 0x64]
call fcn.100227b7
push esi
call fcn.100c7651
push edi
call fcn.100c7651
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100b8360
xor ebx, ebx
push esi
inc ebx
call fcn.100c7651
push edi
call fcn.100c7651
pop ecx
pop ecx
jmp 0x100b8445
mov eax, ebx
call fcn.100c7417
ret

Function at 0x100b84f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x100e5527
call fcn.100c74ca
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x10]
inc edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x20], ecx
jb 0x100b8518
mov eax, dword [esi]
lea edx, [ebp - 0x18]
xor ebx, ebx
push edx
push ebx
push ebx
push ebx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b8591
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
inc eax
mov dword [ebp - 4], ebx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1008a452
cmp dword [esi + 0x14], 8
mov ebx, eax
pop ecx
jb 0x100b8554
mov esi, dword [esi]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
push ebx
push 0
push 0
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b8578
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.1008a452
xor edi, edi
push ebx
call fcn.100c7651
pop ecx
jmp 0x100b8591
mov eax, edi
call fcn.100c7417
ret
Function at 0x100bcb79
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x100e5f38
call fcn.100c745c
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x40]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
push eax
mov dword [ebp - 0x44], esi
call fcn.1008a452
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 1
push 0x100f25f4
call fcn.1008a452
push 2
push 0x1013edec
lea ecx, [ebp - 0x40]
call fcn.1008a452
push 1
push 0x100f25f4
lea ecx, [ebp - 0x40]
call fcn.1008a452
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x100bcbe0
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x40]
push eax
call fcn.1008a452
push 1
push 0x100eef5c
lea ecx, [ebp - 0x40]
call fcn.1008a452
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x100bcc05
mov eax, dword [ebx]
push dword [ebx + 0x10]
lea ecx, [ebp - 0x40]
push eax
call fcn.1008a452
push 7
xor ebx, ebx
xor eax, eax
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1008a452
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
jne 0x100bcc89
push 0x100eadb0
call fcn.1008a452
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x100bcc71
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x28]
call fcn.1008a452
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edi
cmp eax, 0x10
jb 0x100bcccc
inc eax
push eax
jmp 0x100bccc2
lea eax, [ebp - 0x40]
push eax
call fcn.1008a452
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x100bccac
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x28]
call fcn.1008a452
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
cmp ecx, 0x10
jb 0x100bcccc
inc ecx
push ecx
push dword [ebp - 0x40]
call fcn.1008a452
pop ecx
pop ecx
mov eax, esi
call fcn.100c7406
ret
Function at 0x100c687e
Capabilities:
Get file size

Disassembly:
push 0x74
mov eax, 0x100e79db
call fcn.100c745c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x80]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x50
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.100419f1
push esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x80]
call fcn.1008a452
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
push ebx
cmovae eax, dword [ebp - 0x30]
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100c6909
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
je 0x100c6902
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], eax
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
call fcn.100227b7
lea ecx, [ebp - 0x80]
call fcn.10041ada
mov al, bl
call fcn.100c7406
ret

Function at 0x100c6921
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x100e7a13
call fcn.100c745c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x78]
push 0x50
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.100419f1
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.1008a452
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x28]
setne bl
call fcn.100227b7
lea ecx, [ebp - 0x78]
call fcn.10041ada
mov al, bl
call fcn.100c7406
ret
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401b5a
pop dword [ebp - 0x28]
mov eax, 0x636e7ba5
add eax, 0x9cd19fb5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x87be7517
sub dword [ebp - 0x38], 0x396c2fcc
mov dword [ebp - 0x34], 0x9a767ff2
add dword [ebp - 0x34], 0x97bccc53
mov dword [ebp - 0x30], 0x5b550937
add dword [ebp - 0x30], 0xf0f73af7
mov dword [ebp - 0x2c], 0xf56bb8d7
sub dword [ebp - 0x2c], 0xf56bb8d7
lea eax, [ebp - 0x38]
push eax
mov eax, 0x669f87d7
add eax, 0x99a1487d
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xae463241
add dword [ebp - 0x38], 0xc62c3715
mov dword [ebp - 0x34], 0x8f23b666
add dword [ebp - 0x34], 0xb248ab0f
mov dword [ebp - 0x30], 0x676fc69c
sub dword [ebp - 0x30], 0x4005a30
mov dword [ebp - 0x2c], 0xe6c51ddf
add dword [ebp - 0x2c], 0x193ae221
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf64b6925
add eax, 0x9f56727
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c23d
push 0
call eax
mov ecx, 0x8cc4830c
sub ecx, 0x8cc4314b
xor ebx, ebx
add ebx, eax
mov edi, 0xbffc2371
add edi, 0x40458c8f
add edi, dword [ebp - 0x28]
mov edx, 0x9dd99ae6
sub edx, 0x98496c00
mov esi, dword [edi]
sub dword [ebp - 0x20], 0x39f15f82
xor esi, edx
add dword [ebp - 0x24], 0xfb625a22
mov dword [ebx], esi
sub dword [ebp - 0x14], esi
add ebx, 4
add edi, 0xaa5be7f8
sub edi, 0xaa5be7f4
loop 0x401c7e
add eax, 0x8c61cbff
sub eax, 0x8c609228
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10001cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x14c
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x88]
add eax, edx
lea ecx, [esi + 0x78]
add ecx, edx
cmp word [edx + esi + 4], di
cmovne ecx, eax
mov eax, dword [ecx]
test eax, eax
je 0x10001e05
cmp dword [ebp + 0x10], 0
lea ecx, [eax + esi]
mov dword [ebp - 8], ecx
ja 0x10001d4c
mov eax, dword [ebp + 0xc]
jb 0x10001d1b
cmp eax, 0xffff
ja 0x10001d4c
movzx edx, ax
xor eax, eax
sub edx, dword [ecx + 0x10]
sbb eax, eax
test eax, eax
ja 0x10001e05
jb 0x10001d38
cmp edx, dword [ecx + 0x14]
jae 0x10001e05
mov eax, dword [ecx + 0x1c]
pop edi
lea eax, [eax + edx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
add edx, esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x18], eax
jbe 0x10001e05
nop word [eax + eax]
mov ebx, dword [edx + eax*4]
add ebx, esi
mov esi, ebx
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001d80
sub esi, ecx
call fcn.10002770
push 0xeeeeeeee
push 0x7fed7fed
mov edi, eax
push edi
push 1
push esi
push ebx
call fcn.100026a0
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 2
push esi
push dword [ebp - 0xc]
mov ebx, eax
call fcn.100026a0
xor ecx, ecx
or ecx, ebx
cmp dword [ebp + 0xc], eax
jne 0x10001dca
cmp dword [ebp + 0x10], ecx
je 0x10001de1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0x18]
jae 0x10001e05
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10001d70
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx ecx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100026a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100026fa
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
nop word [eax + eax]
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0x14]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100026c0
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x402f30
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404bec
test esi, esi
jne 0x402f67
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404cdc
jmp 0x402f88
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402dcc
mov dword [esp], eax
test esi, esi
je 0x402f88
cmp dword [ebx], 0
je 0x402f88
dec esi
jmp 0x402f6f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403580
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4b4008], 0x8088405
inc edx
mov dword [ebx + 0x4b4008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4b4024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403c38
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403c18
xor eax, eax
push ebp
push 0x403c11
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403c54
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c18
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4b4024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4b4024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4049c4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4be04c], 0
je 0x404a25
cmp word [0x4be220], 0xd7b2
jne 0x4049ed
cmp dword [0x4be228], 0
jbe 0x4049ed
mov eax, 0x4be21c
call dword [0x4be238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4b4074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404a4c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b4034], 0
jne 0x404a41
push 0
push 0x4b406c
push 0x4b4074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404ba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402b6c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4be04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404b68
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406ddc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406e42
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404e5c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040359c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406e2c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e49
lea eax, [ebp - 0x10]
call fcn.00404bec
ret

Function at 0x409a18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004050ac
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409a31
test al, 0x10
jne 0x409a35
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c8a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c8dd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404cdc
jmp 0x40c8e6
mov eax, ebx
mov edx, esi
call fcn.00404c40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c8f0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c911
mov al, byte [esp]
jmp 0x40c913
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cfa8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ce10
mov eax, dword [0x4bd524]
cmp byte [eax], 0
je 0x40d024
mov eax, dword [0x4bd178]
call fcn.004033a4
call fcn.00402cf8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409e70
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d06c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d05a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4bd0dc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4be668]
call fcn.0040622c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d91c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d9f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404c84
lea eax, [ebp - 8]
call fcn.004050fc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004050ac
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d9dc
mov eax, ebx
call fcn.00402b6c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d9d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004050ac
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d9bf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40da04
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d9bf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9dc
mov eax, dword [ebp - 0x10]
call fcn.00402b9c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9f9
lea eax, [ebp - 8]
call fcn.00404bec
ret

Function at 0x40e004
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e068
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404e5c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409678
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e06f
lea eax, [ebp - 0xc]
call fcn.00404bec
ret

Function at 0x423bc0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00423a18
dec esi
jne 0x423be2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x424d24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4be894
cmp dword [edi], 0
jne 0x424da0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4be890]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b45f4
mov ecx, 2
call fcn.00402d8c
mov edx, 0x424cfc
lea eax, [esi + 5]
call fcn.00424d1c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00424d1c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x424d75
mov dword [0x4be890], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x426fa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42702c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10c]
mov eax, 0x427040
call fcn.00410424
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404e5c
lea eax, [ebp - 0x110]
call fcn.004102a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427033
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404c10
ret

Function at 0x427cc8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x427d47
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x427d58
call sub.kernel32.dll_GetVolumeInformationA
lea edx, [ebp - 0x10]
mov eax, 0x427d64
call fcn.00410848
mov eax, dword [ebp - 4]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x14]
mov eax, 0x427d98
call fcn.00410848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427d4e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404c10
ret

Function at 0x4289f4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404e5c
add esp, 0x104
pop ebx
ret

Function at 0x42a6d8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42a6de
ret
Function at 0x42cb94
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42cbe5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42cbcc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42cbbc
jmp 0x42cbe5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42cbcd
pop ebx
mov esp, ebp
pop ebp
ret