joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp]
jae 0x495259
nop
jb 0x495259
mov esp, 0x486fb0a1
add bl, al
nop
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a83e0
add esp, 0xc
cmp ebx, dword [esp]
je 0x495295
mov eax, dword [0x486fb0]
ret
pushf
test dword [esp], esi
shr eax, 0
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
popf
jne 0x495292
jne 0x495295
mov ebp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x76
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x34
mov byte [ebp - 9], 0x33
mov byte [ebp - 8], 0x47
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], 0
jno 0x4952cf
mov esp, esp
jo 0x4952e8
jl 0x4952d5
mov eax, eax
lea ebx, [ebx + 0x7af4]
lea ebx, [ebx - 0x7af4]
mov ecx, ecx
jno 0x4952e8
mov ebx, 0x8af0558a
dec ebp
int1
mov dl, byte [ebp - 0x10]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0xe]
mov bl, byte [ebp - 0xd]
dec dl
dec cl
mov byte [ebp - 0x10], dl
mov dl, byte [ebp - 0xc]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xb]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 9]
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 0xb], cl
mov cl, byte [ebp - 7]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 6]
dec dl
mov byte [ebp - 9], bl
mov bl, byte [ebp - 5]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 4]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
mov byte [ebp - 5], bl
mov byte [ebp - 4], dl
xor esi, dword [esp]
xor esi, dword [esp]
cmp esi, dword [esp + 8]
cmp ecx, edi
not edi
not edi
jo 0x495374
pushf
cmp esp, 0x7100
popf
jae 0x49536e
nop
xchg edx, eax
xchg edx, eax
jno 0x495374
sub eax, 0x1f07
call fcn.00497280
test eax, eax
jne 0x495386
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jb 0x495388
rol edx, 0x10
ror edx, 0x10
jne 0x495396
jg 0x495392
je 0x495396
or dword [ebx], 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0049d0a0
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004a83e0
add esp, 0xc
cld
jae 0x4953bc
jbe 0x4953b7
jg 0x4953b9
jb 0x4953bc
add eax, 0xb75f685
test esi, esi
jne 0x4953cb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jp 0x4953cd
jg 0x4953cf
jle 0x4953dc
pushf
dec eax
inc eax
popf
xchg esp, esp
jg 0x4953dc
sub eax, 0x9e5ee856
add byte [eax], al
push esi
call fcn.0049f240
add esp, 4
ror ebx, 8
ror ebx, 0x18
jl 0x4953fa
pushf
jo 0x4953f1
popf
jae 0x4953f5
jnp 0x4953f7
jge 0x4953fa
mov eax, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49d0a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x49d163
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x49d163
inc ecx
dec ecx
jns 0x49d0ca
mov esp, esp
jns 0x49d0c4
lea edi, [edi]
js 0x49d0ca
mov ecx, 0xfa81b1
add byte [ecx], al
add byte [ebx + 0x27], dh
cmp edx, 0x10000
jae 0x49d0f9
xchg ecx, ecx
xor esp, 0
shl esi, 0
jno 0x49d0f0
pushf
lea edi, [edi]
call 0x49d0e5
lea esp, [esp + 4]
popf
jg 0x49d0ed
jo 0x49d0f0
mov ecx, 0xf9e85052
pushfd
add byte [eax], al
push edx
push eax
call 0x4a6df0
jmp 0x49d11a
xchg ecx, edi
xchg ecx, edi
jnp 0x49d0ff
lea ebx, [ebx]
xchg ecx, edi
xchg ecx, edi
je 0x49d110
jae 0x49d109
xchg esi, eax
xchg esi, eax
jns 0x49d10d
jne 0x49d110
mov ebp, 0x5208458b
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.00496a00
add esp, 8
test eax, eax
je 0x49d16e
cmc
lea esi, [esi + 0x4851]
sub esi, 0x4851
call 0x49d133
add esp, 4
jle 0x49d15c
pushf
lea esi, [esi + 0x1303]
lea esi, [esi - 0x1303]
lea esp, [esp]
lea esi, [esi + 0x7537]
lea esi, [esi - 0x7537]
popf
jl 0x49d159
jg 0x49d15c
mov esi, 0x5d5b5e5f
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x488740
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x49dcc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x486f08
call fcn.004a2e10
add esp, 0xc
mov byte [0x486f08], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4a06f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x488f24]
push esi
push edi
push eax
push 0x488fa1
mov byte [0x488fa0], 0x45
call fcn.004a7960
mov edx, dword [0x488f24]
mov al, 0x2d
mov byte [0x488fa6], al
mov byte [0x488fa7], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x488fa5], cl
mov byte [0x488fa8], cl
mov esi, 0x488fa9
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x478a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x4a073f
mov byte [esi], 0
pop edi
mov eax, 0x488fa0
pop esi
ret
Function at 0x4aa2a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0xb], eax
push 0x488880
mov byte [ebp - 0xc], 0
mov byte [ebp - 7], al
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sidt [ebp - 0xc]
mov eax, dword [ebp - 0xa]
add eax, 8
mov ebx, dword [eax]
add eax, 0x10
mov eax, dword [eax]
and eax, 0xffff
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1e
jne 0x4aa308
xor ecx, 0
shl ecx, 0
xchg ecx, ecx
jb 0x4aa301
pushf
sub eax, 0
popf
jo 0x4aa2fa
jmp 0x4aa2fc
jb 0x4aa2fe
jae 0x4aa301
lcall 0xeb00, 0x2bf
pop ds
mov edi, 2
jmp 0x4aa327
push edi
pop edi
jle 0x4aa30c
je 0x4aa30e
jp 0x4aa322
pushf
lea eax, [eax]
xchg edx, edx
inc esi
dec esi
sub esp, 0
popf
xchg esp, esp
jnp 0x4aa322
ljmp 0x6800:0x4bf
mov edi, 4
push 0x488870
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
dec ebx
inc ebx
js 0x4aa33e
xchg esi, esi
xchg ebx, eax
xchg ebx, eax
jns 0x4aa33e
mov edx, 0x5fc78b19
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ac440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a83e0
add esp, 0xc
jo 0x4ac45a
jno 0x4ac45c
test esi, 0x11c0
jb 0x4ac477
pushf
dec edi
inc edi
shr esp, 0
add esi, 0
cmp esi, ebx
popf
js 0x4ac474
jae 0x4ac477
xor dword [eax - 0x398d4e8d], 0xc600fe45
inc ebp
invalid
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.00497280
test eax, eax
jne 0x4ac4c3
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0049d0a0
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004a83e0
add esp, 0xc
test esi, esi
jne 0x4ac4ed
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
nop
cmp esp, 0x3caf
cmp eax, 0x75a
xor esp, 0
jp 0x4ac505
mov edi, edi
jnp 0x4ac505
jmp 0xe8a1a3cc
push esi
call fcn.0049f240
add esp, 4
test dword [esp + 0xc], edi
ror ecx, 0
jg 0x4ac51e
jp 0x4ac519
jle 0x4ac51e
add eax, 0x458b56b3
or al, 0x8b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4ad920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004a83e0
add esp, 0xc
cmp edx, dword [esp]
jo 0x4ad93e
jno 0x4ad940
jp 0x4ad947
mov ecx, ecx
jnp 0x4ad947
mov ecx, 0x75b066b1
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0x10], 0x7a
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xb], 0x4a
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 9], 0x67
mov byte [ebp - 0xe], al
mov byte [ebp - 7], 0
mov byte [ebp - 0x12], al
mov byte [ebp - 8], 0x70
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xa], 0x6f
push edi
add edi, 0x441f
ror edi, 2
pop edi
rol edx, 0
js 0x4ad98f
jl 0x4ad99c
jo 0x4ad993
jns 0x4ad995
jp 0x4ad997
lea ecx, [ecx]
jge 0x4ad99c
lcall 0xf14d, 0x8af8558a
mov dl, byte [ebp - 8]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0x13]
mov bl, byte [ebp - 0x11]
dec dl
dec cl
mov byte [ebp - 8], dl
mov dl, byte [ebp - 0xd]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x10]
dec bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0xa]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xc]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0x14]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xb]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 9]
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0x12]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x14], cl
mov byte [ebp - 0xb], al
mov byte [ebp - 9], bl
mov byte [ebp - 0x12], dl
or esp, 0
lea edx, [edx + 0x3237]
lea edx, [edx - 0x3237]
je 0x4ada27
pushf
jp 0x4ada19
or esi, esi
and esp, 0xffffffff
popf
jle 0x4ada22
xchg esp, esp
jne 0x4ada27
add eax, 0xfe9854e8
inc dword [ebp - 0x777bf040]
add byte [eax], al
add byte [eax + eax + 0x74], dh
or al, 0x71
add byte [edi + 0x7af287f2], al
add byte [ebp + 2], dh
call fcn.00497280
test eax, eax
je 0x4adabc
je 0x4ada36
je 0x4ada44
jno 0x4ada3a
xchg edx, esi
xchg edx, esi
jp 0x4ada40
jne 0x4ada44
mov ecx, 0xec4d8d3c
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0049d0a0
push 0xe
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.004a83e0
add esp, 0xc
add esp, 0
js 0x4ada71
jb 0x4ada6a
mov ecx, ecx
mov ebx, ebx
jns 0x4ada71
mov edi, 0x4774f685
test esi, esi
je 0x4adabc
lea esi, [esi]
test dword [esp], ecx
lea edi, [edi]
test dword [esp + 0x10], ebx
jne 0x4ada97
pushf
dec ebx
inc ebx
popf
lea edx, [edx + 0x3ad7]
lea edx, [edx - 0x3ad7]
je 0x4ada97
mov eax, 0x56fc758b
mov esi, dword [ebp - 4]
push esi
call fcn.0049f240
add esp, 4
jl 0x4adaa5
or edx, edx
jo 0x4adab6
pushf
lea ebx, [ebx]
popf
jns 0x4adab1
jo 0x4adab3
jno 0x4adab6
lcall 0xd6ff, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406028
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40608e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404648
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403090
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406078
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406095
lea eax, [ebp - 0x10]
call fcn.004043d8
ret

Function at 0x408c0c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x408c3d
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x408c44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x408c75
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x408d5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x408d82
test byte [ebp - 0xc], 0x10
jne 0x408d86
xor eax, eax
jmp 0x408d88
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x408d94
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x409060
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x40bdd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x40be18
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.004044c8
jmp 0x40be23
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040442c
mov esp, ebp
pop ebp
ret 4

Function at 0x40be2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40be5a
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x40be60
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret

Function at 0x40c5e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x400
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040c430
mov eax, dword [0x46b7d4]
cmp byte [eax], 0
je 0x40c67b
mov eax, dword [0x46b5f4]
call fcn.00402efc
call fcn.00402bb4
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
call fcn.00409088
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40c6c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c6b1
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x46b598]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46c664]
call fcn.00405494
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov esp, ebp
pop ebp
ret
Function at 0x40d088
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d166
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404470
lea eax, [ebp - 0xc]
call fcn.004048e8
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40d150
mov eax, dword [ebp - 0x10]
call fcn.00402a28
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x40d149
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d133
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40d174
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d133
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d150
mov eax, dword [ebp - 0x18]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d16d
lea eax, [ebp - 0xc]
call fcn.004043d8
ret

Function at 0x40d84c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d8b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00404648
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408900
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d8bd
lea eax, [ebp - 0x14]
call fcn.004043d8
ret
Function at 0x418ad8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceA
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x418b0e
push ebp
call fcn.00418a68
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x418b34
push ebp
call fcn.00418a68
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00418640
mov esp, ebp
pop ebp
ret 4

Function at 0x41dd88
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x46c884], 0
jne 0x41de35
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [0x46c880]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x46946c
mov ecx, 2
call fcn.00402c48
mov edx, 0x41dd44
mov eax, dword [ebp - 8]
add eax, 5
call fcn.0041dd64
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.0041dd64
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x46c884]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x46c884], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x41ddef
mov eax, dword [ebp - 8]
mov dword [0x46c880], eax
mov eax, dword [0x46c884]
mov dword [ebp - 4], eax
mov eax, dword [0x46c884]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x46c884], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x41f0b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f0b6
ret
Function at 0x421ccc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x421d1d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x421d04
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x421cf4
jmp 0x421d1d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x421d05
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432f70
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x432ea4
call sub.user32.dll_EnumWindows
pop ecx
pop ebp
ret

Function at 0x4330e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x433171
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00432a6c
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, 0x3e8
jbe 0x433114
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004325dc
cmp dword [ebp - 0xc], 0
je 0x43315b
push 0
push 9
mov eax, dword [ebp - 0xc]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433178
lea eax, [ebp - 0xc]
call fcn.004043d8
ret