joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001950
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov dword [edi], eax
mov al, byte [ecx + 4]
mov byte [edi + 4], al
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x100042d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x100260c8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
push edi
call fcn.10002470
mov edi, dword [eax + 0x34]
mov esi, dword [eax + 0x30]
cmp esi, edi
je 0x100043ab
push ebp
mov ebp, dword [sym.imp.GDI32.dll_AddFontResourceExA]
nop dword [eax + eax]
push ebx
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.10008340
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x1000432d
mov eax, dword [esi]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10004367
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10004352
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
push str.path_to_font__s_does_not_exist___s_
call fcn.10004040
add esp, 0xc
jmp 0x1000439f
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, dword [esi + 0x14]
test eax, eax
mov eax, esi
je 0x1000438a
cmp ecx, 0x10
jb 0x10004382
mov eax, dword [esi]
push eax
push str.successfully_added_font__s
jmp 0x10004397
cmp ecx, 0x10
jb 0x10004391
mov eax, dword [esi]
push eax
push str.error_adding_font__s
call fcn.10004040
add esp, 8
add esi, 0x18
cmp esi, edi
jne 0x10004310
pop ebp
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000532e
add esp, 0x108
ret
Function at 0x1000ca1a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000ca59
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ca59
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ca59
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000ca59
cmp dword [ecx + 0x74], 0xe
jbe 0x1000ca59
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10010b8e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f450
push 0x1001f448
push str.FlsAlloc
push 0x1f
call fcn.10010a4d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10010bc2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d1cc]
call esi
jmp 0x10010bc8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10010c0c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f460
push 0x1001f458
push str.FlsGetValue
push 0x21
call fcn.10010a4d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10010c43
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d1cc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10010c4b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f468
push 0x1001f460
push str.FlsSetValue
push 0x22
call fcn.10010a4d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10010c85
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001d1cc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10013e7f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10013f1c
push ebx
push esi
call fcn.10013e48
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000f561
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10013ec9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10013f1b
push edi
push eax
call fcn.1000f3c1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10013ee9
call fcn.1000f387
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10013f1a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000f561
add esp, 0x20
test eax, eax
jne 0x10013f08
push edi
call fcn.1000f387
jmp 0x10013f10
push ebx
call fcn.1000f387
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10013f1f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10013f30
pop esi
ret
push ebx
push edi
push esi
call fcn.10013e48
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1000f3c1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10013f58
push ebx
push esi
push edi
call fcn.10005dd0
add esp, 0xc
push 0
call fcn.1000f387
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10014328
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10013f6d
Function at 0x1001bea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001becd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001becd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x401c66
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x497c0b7a
sub dword [ebp - 0x2c], 0xfb29c62f
mov dword [ebp - 0x28], 0x5cfcf45b
sub dword [ebp - 0x28], 0x2ac9a816
mov dword [ebp - 0x24], 0xa541921a
add dword [ebp - 0x24], 0xa70ab214
mov dword [ebp - 0x20], 0xfccfff90
sub dword [ebp - 0x20], 0xfccfff90
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x543891f5
sub eax, 0x53f861a1
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x985a6031
sub dword [ebp - 0x2c], 0x23e7f6db
mov dword [ebp - 0x28], 0x15424a40
sub dword [ebp - 0x28], 0xd3d5e8cb
mov dword [ebp - 0x24], 0xb7114060
sub dword [ebp - 0x24], 0x53a1d3f4
mov dword [ebp - 0x20], 0x91259e3f
add dword [ebp - 0x20], 0x6eda61c1
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x42ac5c00
add eax, 0xbd93d42c
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac36
push 0
call eax
mov ecx, 0x5921
xor edi, edi
add edi, eax
mov edx, 0x2de57727
add edx, 0xd25af8d9
add edx, dword [ebp - 0x1c]
mov esi, 0x2cc37bc8
add esi, 0xc5be3926
add dword [ebp - 0x14], ecx
mov ebx, dword [edx]
sub dword [ebp - 8], 0x8b272a57
sub ebx, esi
sub dword [ebp - 8], 0x734dfa32
mov dword [edi], ebx
xor dword [ebp - 8], 0x3138ed30
add edi, 0x50331657
sub edi, 0x50331653
add edx, 4
loop 0x401d7f
add eax, 0xdea3dbfd
add eax, 0x215d7b5a
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10005a89
pop dword [ebp - 0x30]
mov eax, 0xb9775c57
sub eax, 0xa97701ce
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x8859632f
add dword [ebp - 0x40], 0xc5f8e21c
mov dword [ebp - 0x3c], 0x8a9018c6
add dword [ebp - 0x3c], 0xa7a3337f
mov dword [ebp - 0x38], 0x695667ee
sub dword [ebp - 0x38], 0x1d0a23c0
mov dword [ebp - 0x34], 0xd26dec80
add dword [ebp - 0x34], 0x2d921380
lea eax, [ebp - 0x40]
push eax
mov eax, 0x16bc36b8
add eax, 0xf944896c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1f566058
add dword [ebp - 0x40], 0x551c08fe
mov dword [ebp - 0x3c], 0x3a6892e3
sub dword [ebp - 0x3c], 0xf8fc316e
mov dword [ebp - 0x38], 0x7965a208
add dword [ebp - 0x38], 0xea09ca64
mov dword [ebp - 0x34], 0x50b4a2d5
add dword [ebp - 0x34], 0xaf4b5d2b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x986c972b
add eax, 0x77942901
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37746
push 0
call eax
mov ecx, 0x76ff323f
sub ecx, 0x76feec7a
mov edi, eax
mov ebx, 0x10047400
add ebx, dword [ebp - 0x30]
mov esi, 0xb506b170
sub esi, 0xde23a406
sub dword [ebp - 0x20], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x2c], eax
xor edx, esi
mov dword [ebp - 4], 0xf8eb157a
mov dword [edi], edx
add dword [ebp - 0x10], edi
add edi, 0x90ed5f1c
add edi, 0x6f12a0e8
add ebx, 0x501eb863
sub ebx, 0x501eb85f
loop 0x10005ba5
add eax, 0x109e7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x36f168fa
add ecx, 0xd90e9706
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40fdf7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonSize], eax
call fcn.0040c050
pop ecx
mov ecx, dword [sym.TestTemplateLib.exe_gMozillaPoisonSize]
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40fe2f
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10007fbe
pop dword [ebp - 0x14]
mov eax, 0xb16f7af4
sub eax, 0xa16efb36
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa5bbc31f
add dword [ebp - 0x24], 0xa896822c
mov dword [ebp - 0x20], 0xe7531d7a
add dword [ebp - 0x20], 0x4ae02ecb
mov dword [ebp - 0x1c], 0x647d791f
add dword [ebp - 0x1c], 0xe7cecb0f
mov dword [ebp - 0x18], 0xfc262c0a
add dword [ebp - 0x18], 0x3d9d3f6
lea eax, [ebp - 0x24]
push eax
mov eax, 0xd65b9394
add eax, 0x39a62cec
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xad9c22c4
sub dword [ebp - 0x24], 0x3929b96e
mov dword [ebp - 0x20], 0xf36fc90e
add dword [ebp - 0x20], 0x4dfc9867
mov dword [ebp - 0x1c], 0xb1123bc7
add dword [ebp - 0x1c], 0xb25d30a5
mov dword [ebp - 0x18], 0x263be507
sub dword [ebp - 0x18], 0x263be507
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39f2b
push 0
call eax
mov ecx, 0xb5ad1bf5
add ecx, 0x4a5335d9
xor edx, edx
add edx, eax
mov ebx, 0x71a6899d
add ebx, 0x9e5bde63
add ebx, dword [ebp - 0x14]
mov edi, 0xd8fc7109
sub dword [ebp - 4], 0x805055a1
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0xa35867da
add esi, edi
mov dword [ebp - 4], 0xbffe6d62
mov dword [edx], esi
xor dword [ebp - 4], 0xe3da7392
add edx, 0x9925cedf
add edx, 0x66da3125
add ebx, 4
loop 0x100080d7
add eax, 0x5f70c61b
sub eax, 0x5f6f8c10
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4c6a3fa1
sub ecx, 0x3c6a3fa1
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x10003930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000393f
pop dword [ebp - 0x40]
mov eax, 0x1000393f
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x373a9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4966
xor ebx, ebx
add ebx, eax
mov esi, 0x1000d600
add esi, dword [ebp - 0x40]
mov edx, 0x3087c052
add edx, 0xe77eace5
sub dword [ebp - 0x18], 0x63c4d18
mov edi, dword [esi]
xor dword [ebp - 0x38], 0x5538757e
sub edi, edx
xor dword [ebp - 0x20], 0xde60a09f
mov dword [ebx], edi
xor dword [ebp - 0x18], eax
add ebx, 0x258c0665
add ebx, 0xda73f99f
add esi, 0xdefe8531
sub esi, 0xdefe852d
loop 0x1000398a
add eax, 0x6b0ae7dc
sub eax, 0x6b09cf71
xor ebx, ebx
add ebx, eax
add eax, 0xf1c185f4
sub eax, 0xf1c185ef
mov ecx, 0xd75d42cc
sub ecx, 0xc75d42cc
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x1000928f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b348]
jne 0x10009299
repz ret
jmp fcn.1000966a
Function at 0x405e24
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405e8a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404470
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ea4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405e74
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e91
lea eax, [ebp - 0x10]
call fcn.00404200
ret

Function at 0x40b01c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b055
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042f0
jmp 0x40b05e
mov eax, ebx
mov edx, esi
call fcn.00404254
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b068
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b089
mov al, byte [esp]
jmp 0x40b08b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b720
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b588
mov eax, dword [0x454098]
cmp byte [eax], 0
je 0x40b79c
mov eax, dword [0x453ebc]
call fcn.00402d10
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004087f8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b7e4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b7d2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x453e6c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x455664]
call fcn.00405290
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c040
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c116
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404298
lea eax, [ebp - 8]
call fcn.00404710
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c100
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c0f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c0e3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c128
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c0e3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c100
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c11d
lea eax, [ebp - 8]
call fcn.00404200
ret

Function at 0x40c6f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c75c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404470
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408374
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c763
lea eax, [ebp - 0xc]
call fcn.00404200
ret
Function at 0x41ab8c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0x455884
cmp dword [esi], 0
jne 0x41ac32
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x455880]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x4533ec
mov ecx, 2
call fcn.00402c48
mov edx, 0x41ab64
mov eax, dword [ebp - 8]
add eax, 5
call fcn.0041ab84
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.0041ab84
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x41abf9
mov eax, dword [ebp - 8]
mov dword [0x455880], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41be60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41be66
ret

Function at 0x41e2d8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e329
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e310
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e300
jmp 0x41e329
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e311
pop ebx
mov esp, ebp
pop ebp
ret