joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1075b4d0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1075b620
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1075b4f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1075b4e2
add dl, dl
jne 0x1075b501
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1075b554
xor eax, eax
add dl, dl
jne 0x1075b50e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1075b5f5
add dl, dl
jne 0x1075b51d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b528
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b533
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b53e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1075b54a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1075b4ed
mov eax, 1
add dl, dl
jne 0x1075b562
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1075b56d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1075b559
sub eax, ebx
mov ebx, 1
jne 0x1075b5a0
mov ecx, 1
add dl, dl
jne 0x1075b586
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1075b591
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1075b57d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1075b4ed
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1075b5b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1075b5c2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1075b5ae
cmp eax, 0x7d00
jae 0x1075b5e5
cmp eax, 0x500
jb 0x1075b5e0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1075b4ed
cmp eax, 0x7f
ja 0x1075b5e8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1075b4ed
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1075b616
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1075b4ed
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430ad8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5f8320]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp edi, eax
je 0x430b9b
cmp dword [ebp + 0xc], eax
jl 0x430b9b
jg 0x430b06
cmp dword [ebp + 8], eax
jbe 0x430b9b
cmp ebx, eax
je 0x430b9b
cmp dword [ebp + 0xc], eax
jg 0x430b22
jl 0x430b1b
cmp dword [ebp + 8], 0x3c
jae 0x430b22
mov eax, 0x22000009
jmp 0x430ba0
push 0x3c
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00551820
push edi
push 1
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.00558213
add esp, 0x1c
cmp eax, 1
je 0x430b4b
mov eax, 0x22000005
jmp 0x430ba0
push 4
lea eax, [ebp - 0x40]
push str.MSCF
push eax
call fcn.00555de1
add esp, 0xc
test eax, eax
jne 0x430b1b
test byte [ebp - 0x22], 4
jne 0x430b6f
mov eax, 0x2200000e
jmp 0x430ba0
movzx ax, byte [ebp - 0x1b]
movzx cx, byte [ebp - 0x1c]
shl ax, 8
or ax, cx
push 0x14
pop ecx
cmp cx, ax
jne 0x430b68
push 0x3c
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.00552ae0
add esp, 0xc
xor eax, eax
jmp 0x430ba0
mov eax, 0x22000001
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055189a
leave
ret
Function at 0x461c80
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x461cc1
push 0xc3
push str.....Srcopenssl_1.1.1ncrypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.0043fb00
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x465440
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x465475
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
dec ecx
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x465460
pop ebx
pop edi
pop esi
ret

Function at 0x4763a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x4763c8
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4763d0
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x4763b4
test esi, esi
je case.0x476490.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x476417
cmp esi, 1
jbe case.0x476490.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x476417
cmp esi, 2
jbe case.0x476490.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x476417
cmp esi, 3
jbe case.0x476490.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x476490.2
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x476440
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x476440
inc edx
inc eax
cmp edx, edi
jl 0x476433
lea eax, [edi - 1]
test eax, eax
jl 0x476461
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x476461
cmp byte [ecx], 0xff
jne 0x476461
dec eax
dec ecx
test eax, eax
jge 0x476450
cmp edx, eax
jl case.0x476490.2
jle 0x476472
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x476490.2
movzx ecx, byte [ecx + 0x476500]
jmp dword [ecx*4 + 0x4764e0]
mov esi, 7
jmp 0x4764c6
mov esi, 6
jmp 0x4764c6
mov esi, 5
jmp 0x4764c6
mov esi, 4
jmp 0x4764c6
mov esi, 3
jmp 0x4764c6
mov esi, 2
jmp 0x4764c6
mov esi, 1
test byte [esp + 0x10], al
jne case.0x476490.2
and bl, al
cmp bl, al
jne case.0x476490.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x4913b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.005530f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.00459080
mov ebx, eax
push ebx
push esi
call fcn.004591f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x49143c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x491416
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x491409
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.00459260
push esi
call fcn.00458f20
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x49143c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.00459080
mov ebx, eax
push ebx
push esi
call fcn.004591f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4914ae
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x491494
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x491487
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.00459260
push esi
call fcn.00458f20
add esp, 0x10
mov edi, eax
test edi, edi
ja 0x491434
push esi
call fcn.00458f20
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c7c80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8e000]
push edi
jmp 0x4c7c9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c7ca1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7c90
mov eax, 1
add ebx, ebx
jne 0x4c7cb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c7cc4
jne 0x4c7ce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7ce3
dec eax
add ebx, ebx
jne 0x4c7cd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c7ca8
add ebx, ebx
jne 0x4c7cdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c7d35
xor ecx, ecx
sub eax, 3
jb 0x4c7cfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c7d6a
sar eax, 1
mov ebp, eax
jmp 0x4c7d06
add ebx, ebx
jne 0x4c7d06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7cd4
inc ecx
add ebx, ebx
jne 0x4c7d14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c7cd4
add ebx, ebx
jne 0x4c7d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c7d16
jne 0x4c7d32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c7d16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c7d54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c7d46
jmp 0x4c7c96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c7d54
add edi, ecx
jmp 0x4c7c96
pop esi
mov edi, esi
mov ecx, 0x4ad9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c7d72
cmp byte [edi], 0xd
jne 0x4c7d72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c7d77
lea edi, [esi + 0xc4000]
mov eax, dword [edi]
or eax, eax
je 0x4c7def
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xca758]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xca888]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c7da4
mov ecx, edi
jns 0x4c7dd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xca890]
or eax, eax
je 0x4c7de9
mov dword [ebx], eax
add ebx, 4
jmp 0x4c7dc1
call dword [esi + 0xca88c]
mov ebp, dword [esi + 0xca894]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c7e23
sub esp, 0xffffff80
jmp 0x469e16
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3d7a2aa6
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
mov eax, str.__c
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x247c07d3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x413370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4199e0], ecx
add edx, 1
cmp edx, 0x100
jb 0x413372
cmp edx, 0x800
jae 0x41345b
mov edi, edi
mov eax, dword [edx*4 + 0x4195e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4199e0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x4199dc], eax
jb 0x413430
mov dword [0x4199b4], 0x413ab0
call fcn.004135a0
test eax, eax
jne 0x413478
mov dword [0x4199b4], 0x4139d0
ret
Function at 0x4036f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403788
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403768
xor eax, eax
push ebp
push 0x403761
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403768
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x404054
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x4040b5
cmp word [0x40a218], 0xd7b2
jne 0x40407d
cmp dword [0x40a220], 0
jbe 0x40407d
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40908c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4040dc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x4040d1
push 0
push 0x409084
push 0x40908c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404e64
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404eca
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404420
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ea8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404eb4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ed1
lea eax, [ebp - 0x10]
call fcn.004041d8
ret

Function at 0x406cac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406ce5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042c8
jmp 0x406cee
mov eax, ebx
mov edx, esi
call fcn.0040422c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406cf8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406d19
mov al, byte [esp]
jmp 0x406d1b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4073b0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x407218
mov eax, dword [0x4093dc]
cmp byte [eax], 0
je 0x40742c
mov eax, dword [0x409330]
call fcn.00402d60
call fcn.004029a8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406180
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x407474
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x407462
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x409310]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.00404834
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407e50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407eb4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404420
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406048
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ebb
lea eax, [ebp - 0xc]
call fcn.004041d8
ret
Function at 0x402910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45aa20
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4771ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040c1c0
mov ecx, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x28], 0
call fcn.0040a490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4096e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b3d7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4771ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x409794
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [edi + 0x60], al
push 9
mov byte [ebp - 4], 5
mov byte [edi + 0x68], 9
call fcn.0040a490
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x10]
mov byte [ebp - 4], 6
mov byte [ebp - 0xd], 1
test ecx, ecx
jns 0x4097d6
mov eax, ecx
neg eax
je 0x4097d6
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x4097de
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
lea eax, [ebp - 0xd]
and ecx, 0x1f
push eax
push 1
push ecx
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.0040c7a0
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x40980d
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4153f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c150
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4771ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x415437
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x415458
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x415444
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0xc], eax
cmp dword [eax], esi
je 0x41547b
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov edx, dword [edi + 0x10]
jmp 0x415483
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
je 0x415504
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
jb 0x41549b
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x4154a5
mov ecx, dword [edi]
cmp edx, dword [ebp - 0x14]
jne 0x415480
push edx
push eax
push ecx
call fcn.00416cd0
mov edx, dword [edi + 0x10]
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 0xc]
jne 0x415483
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.00416080
push 0x2c
push edi
call fcn.0044eddd
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x415531
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x41554b
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x41556d
cmp eax, esi
jne 0x415553
mov dword [ecx], edi
jmp 0x41556d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x41556d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00416870
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x41591c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x415938
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x415927
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x415971
cmp eax, edi
jne 0x415969
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x415979
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x415979
cmp eax, edi
jne 0x415979
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00416080
push 0x2c
push edi
call fcn.0044eddd
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8