joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7172c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
push dword [esp + 1]
ja 0x717308
lea esp, [esp + 3]
jmp 0x717352
lea esp, [esp + 3]
mov word [esp + 2], bx
pop word [esp]
lea esp, [esp + 3]
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], edi
jmp 0x71730a
jmp 0x7172e6
lea esp, [esp + 0x3c]
jmp 0x717329
push 0xf070a428
jmp 0x71732c
mov dword [esp + 0x40], esi
jmp 0x7172fb
pushfd
jmp 0x717310
cpuid
mov dx, 0x4848
mov esi, dword [esp + 0x2c]
jmp 0x71733c
bts dx, bp
jle 0x717361
mov ch, byte [esp]
bsf eax, esi
mov bl, 0x77
jmp 0x71736f
mov word [esp + 2], bx
pop word [esp]
lea esp, [esp + 3]
jmp 0x717323
mov ch, byte [esp]
bsf eax, esi
jmp 0x71736d
mov bl, 0x77
lea ebp, [esp]
bsf cx, ax
jno 0x7173e8
lea edx, [edx*4]
sub esp, 0x10
call fcn.007173bf
xchg esi, eax
lea edx, [edx*4]
sub esp, 0x10
lea esp, [esp + 5]
jmp 0x717473
jmp 0x7173ab
lea esp, [esp + 3]

Function at 0x717388
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
mov dword [esp + 0x44], ebp
call fcn.007172c1
lea esp, [esp + 5]
lea esp, [esp + 3]
jmp 0x717477
dec eax
bsf ebx, esp
jo 0x71741d
dec eax
jmp 0x71741e
sub esp, 0xb8
mov edi, esp
jmp 0x71743f

Function at 0x7173bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov edx, ebx
mov eax, dword [esp]
add dl, 0xca
xchg dword [esp], ebp
jmp 0x7173d2
bsf cx, sp
push ebp
lea esp, [esp + 2]
rol di, 3
sub esp, 7
jmp 0x71740a
lea eax, reloc.mscoree.dll__CorExeMain
mov ecx, 0x8b23e0b5
rdtsc
not dx
pushfd
push dword [esp + 0x10]
ret 0x14
lea esp, [esp + 1]
lea ebp, [ebp + 0xe]
bsf edi, ebx
push ebp
rdtsc
xchg dword [esp + 0xc], ebp
jmp 0x7173ea

Function at 0x72c839
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 0x39]
lea esp, [esp + 0x48]
jmp 0x70c5f4
mov ecx, dword [esp + 0x34]
mov ebx, esp
mov ebx, 0xc1896efc
bswap ebx
not ebx
mov bx, word [esp]
jmp 0x72c7af
pop word [esp]
setae bl
lea esp, [esp + 2]
jmp 0x72c7ef

Function at 0x72c89a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x72d892
jmp 0x70ceff
jmp 0x70cf59
jmp fcn.0070cf15

Function at 0x756c9b
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x756c64
movzx eax, byte [eax + 0xf]
jmp 0x756c92
xor edx, esi
bsr di, cx
add ebx, ecx
movzx esi, byte [eax + 0xe]
mov edi, 0x9f95ac83
jmp 0x756c4e
shl edx, 8
call 0x756c9b
pop ebp
mov ebx, edi
pop ebp
xor edx, esi
jmp 0x756d06
mov dword [ecx + 0xc], edx
jmp 0x756ce2
shr eax, 0x10
lea esi, [esi + ebp]
mov bh, ah
inc si
jmp 0x756cf0
mov eax, edx
bsr esi, eax
mov si, 0x7cf0
bts ebx, ebp
jmp 0x756ccc
mov esi, 0xff
jmp 0x756d29
lea edi, [eax + ecx]
shl edx, 8
btc ebp, edx
xor edx, eax
jmp 0x756ca2
lea ebp, [ebp*4]
lea ebp, reloc.mscoree.dll__CorExeMain
mov eax, dword [ebp]
jmp 0x756d30
and eax, esi
push ebp
mov ebp, eax
jmp 0x756d13
pop ebp
mov bp, word [esp]
neg bx
setg bl
jmp 0x757058
lea esp, [esp + 0x30]
Function at 0x756fc5
Capabilities:
Encrypt data using aes

Disassembly:
push eax
add esp, 1
jmp 0x756f1e
and edi, 0xff0000
bsf ebp, ebp
setg bl
inc bh
jmp 0x756f0a
and edi, esi
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
mov bp, word [esp]
xchg bp, bx
jmp 0x756d5e
mov edi, edx
shr edi, 8
mov ebx, dword [esp]
lea ebx, reloc.mscoree.dll__CorExeMain
jmp 0x756d74
push ebx
mov ebx, edi
lea ebx, [ebx*4]
jmp 0x756dad
lea ebx, reloc.mscoree.dll__CorExeMain
movzx edi, byte [ebx]
pop ebx
stc
neg ebp
jmp 0x756de7
mov ebp, eax
mov ebp, dword [esp]
mov edi, edx
shr edi, 0x18
jmp 0x756d9d
lea ebp, [edx + ebp]
bswap ebp
jmp 0x756def
xor eax, edi
mov edi, edx
and edi, esi
jmp 0x756dd1
mov edi, dword [edi*4 + reloc.mscoree.dll__CorExeMain]
lea ebp, reloc.mscoree.dll__CorExeMain
neg bp
jmp 0x756e98
lea esp, [esp + 2]
lea esp, [esp + 8]
and eax, 0xff000000
xor eax, edi
jmp 0x756dc5
mov di, 0xa20a
lea edi, [esp + eax]
bswap edi
lea esp, [esp + 0x20]
xor eax, dword [ecx]
jmp 0x756e6b
sub esp, 0x1e
stc
lea esp, [esp + 2]
xor eax, edi
mov edi, eax
jmp 0x756e24
mov dword [edi], eax
sub esp, 7
lea esp, [esp + 3]
jmp 0x756ebb
mov di, word [esp]
lea edi, [ebx*4]
lea edi, [ecx + 0x10]
xor ebx, eax
call fcn.00756e52
add esp, 1
lea esp, [esp + 3]
jmp 0x756e54
mov ebp, 0xff00
pushfd
add esp, 0
and edi, ebp
jmp 0x756e44
stc
jmp 0x756ede
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
jmp 0x756ea5
mov ebx, edi
mov ax, 0xda71
jmp 0x756eea
mov dword [ecx + 0x18], eax
dec bh
mov bh, byte [esp]
xor edx, eax
jmp 0x756ec5
push edi
mov edi, ecx
add edi, 0x1c
jmp 0x756fdc
mov ebx, dword [ecx + 4]
mov ebp, esi
not bp
sub esp, 0xa
mov dword [esp + 3], esi
jmp 0x756e13
mov ax, bp
lea esp, [esp + 3]
mov eax, edi
mov dx, 0xff1a
stc
jmp 0x756f90
mov ebx, 0x71689c
lea esp, [esp + 4]
jmp 0x756a3c
mov edi, edx
jmp 0x756f71
shr ecx, 8
lea edi, [esp + esi]
bsr edi, ebx
neg edi
jmp 0x756f4e
and ecx, esi
clc
stc
push edx
jmp 0x756fb1
xchg ecx, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
neg edi
jmp 0x756f64
pushal
lea edx, reloc.mscoree.dll__CorExeMain
xchg dx, bp
mov dword [esp + 0x14], ecx
clc
call fcn.00756f78
jmp 0x757007
mov dword [edi], edx
pop edi
mov dx, word [esp]
rdtsc
mov ebx, 0x18c32773
mov ch, 0x52
jmp 0x756f40
and edi, esi
jmp 0x75702b
shr edi, 0x10
clc
pushfd
add esp, 2
lea esp, [esp + 2]
jmp 0x756ff1
lea edx, reloc.mscoree.dll__CorExeMain
mov edi, dword [edx]
pop edx
jmp 0x757037
push edx
mov edx, edi
lea edx, [edx*4]
jmp 0x757015
lea esp, [esp + 4]
and ecx, 0xff0000
call fcn.00757073
jbe 0x7570aa
mov al, byte [0x8e751ae3]
xor dword [eax + reloc.mscoree.dll__CorExeMain], esi
sub dword [ebp + reloc.mscoree.dll__CorExeMain], ebp
and al, 0x30
xor eax, 0x1000000
add ebp, 0x7ed7ae9e
lea ebp, [ebx*4]
jmp 0x756d8d
sahf
cld
invalid

Function at 0x75712f
Capabilities:
Encrypt data using aes

Disassembly:
not di
jmp 0x7571ae
xor ecx, edi
neg edi
jmp 0x757119
xor ecx, edx
xchg dh, dl
lea edx, [eax*4]
and edx, ebp
neg edi
mov di, word [esp]
lea edi, [ecx + esi]
lea edi, [edi*4]
jmp 0x75716b
Function at 0x7e503f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], bp
lea esp, [esp + 8]
mov dword [esp + 9], esp
jmp 0x7e5046
mov edi, 0x723100d2
jmp 0x7e5029
mov byte [esp + 0x1b], dl
lea ebx, [eax + ebx]
xchg bp, si
popal
add esp, 1
mov ecx, 0x6f3d0e8b
jmp 0x7e50ac
xchg cx, si
not ecx
mov dl, byte [esp]
not edi
jmp 0x7e50c0
lea ecx, reloc.mscoree.dll__CorExeMain
xchg byte [esp], ah
rdtsc
std
inc bp
mov bl, byte [esp]
jmp 0x7e5072
mov si, bp
lea ebp, reloc.mscoree.dll__CorExeMain
add esp, 0
mov al, 0x85
xchg bp, di
cmc
jmp 0x7e5088
lea eax, [ecx*4]
mov byte [esp], bl
bsr esi, edx
neg ah
stc
lea edi, [edx*4]
jmp 0x7e5591
mov bx, word [esp + 4]
push bp
pop cx
pop edx
mov si, 0x278f
push esi
jmp 0x7e53dc
mov bp, 0xb936
sub esp, 0xa
xchg al, dl
setge cl
add esp, 4
pop word [esp + 2]
jmp 0x7e5480
Function at 0x7e5343
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov cl, 0x88
lea ecx, [ecx + edx]
jmp 0x7e5396
add esp, 4
mov dh, byte [esp + 1]
cpuid
setg ch
xchg ah, bl
btc ax, cx
call fcn.007e5380
rdtsc
mov bl, ch
lea esp, [esp + 0xe]
mov al, byte [esp]
mov edi, esp
jmp 0x7e540e
mov si, 0x3ae2
xchg ebx, edi
mov bp, word [esp]
mov bl, 0xc5
mov dh, dl
cmc
jmp 0x7e53eb
Function at 0x7e5380
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7e53c3
mov byte [esp + 2], ch
push dword [esp + 6]
push dword [esp + 0xa]
xor ecx, 0x721f2097
jmp 0x7e53ad

Function at 0x7e54aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ch, bh
mov dword [esp + 0x17], esi
mov edx, 0xba86dde1
xchg dword [esp + 0x10], ebx
jmp 0x7e54e9
sub esp, 0x12
jmp 0x7e5494
bsr edi, ecx
adc si, di
mov al, bh
not eax
xchg al, bh
xchg bp, cx
jmp 0x7e54d3

Function at 0x7e5638
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
bts edi, esi
sub esp, 0x19
jmp 0x7e5677
stc
bsf bx, dx
popal
lea ebp, [edx*4]
ror ebp, 8
xchg word [esp + 2], bx
jmp 0x7e5661

Function at 0x7e5b8e
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x7e403f
call fcn.007e4044
call 0x7e444b
jmp 0x7e5ca9
movzx ebx, word [eax + 0x3c]
jmp 0x7e5c7c
jmp 0x7e5bc7
mov byte [esp], ch
lea esp, [esp]
mov dword [esp], esp
mov dword [esp + 0x1c], esi
call fcn.007e5bb1
lea esp, [esp]
push word [esp]
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x7e5c26
push ecx
jmp 0x7e5c34
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7e5c10
pushal
mov dword [esp + 0x18], eax
call fcn.007e5d65
pop ecx
jmp 0x7e5d10
sub eax, 0x10000
jmp 0x7e5cad
add ebx, eax
cmp word [ebx], 0x4550
je 0x7e341c
xlatb
invalid
jne 0x7e5c66
in al, dx
cmc
pushfd
outsd dx, dword [esi]
test byte [esi], bl
xchg esi, eax
add al, 0x63
sahf
sbb dword [ebx + ecx - 0x73f20165], ecx
lodsb al, byte cs:[esi]
and al, byte [ebp - 0x4c]
dec edx
cmp dword [eax], ebx
jnp 0x7e5cf9
int 0x5c
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x7e4474
jne 0x7e5c66
scasb al, byte es:[edi]
xor esp, dword [ebx - reloc.mscoree.dll__CorExeMain]
xor al, 0xaa
int 0x3c
aad 0xa2
and dword [ecx - reloc.mscoree.dll__CorExeMain], esi
invalid
js 0x7e5c86
push cs
test al, 0x2a
mov eax, 0xcad42adf
dec edi
fistp qword [edx - 0x1f9f5ab7]
jbe 0x7e5d1d
loopne 0x7e5d17
popfd
in al, dx
mov eax, dword [eax + 8]
push eax
jmp 0x7e4446
invalid
test dword [edx - 0x3e], esp
inc esp
fidivr dword [ebp - 0xe8b51b4]
popal
add bl, dh
pop ds
jbe 0x7e5d1f
ret 0xda44
pushal
pop es
invalid

Function at 0x7e5bb1
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov word [esp + 1], cx
lea esp, [esp + 2]
jmp 0x7e5bd9
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x40295b
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4121c4], 0
jne 0x402969
call fcn.00402931
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402996
test cl, 7
je 0x402996
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
dec esi
inc ecx
jmp 0x402977
cmp esi, 8
jb 0x402a1a
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4121c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
dec edi
jne 0x4029a0
xor edx, edx
test esi, esi
jbe 0x402a3a
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4121c0]
inc edx
cmp edx, esi
jb 0x402a21
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x402b28
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004048a0
test esi, esi
jne 0x402b5e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404990
jmp 0x402b7c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a3c
mov edi, eax
test esi, esi
je 0x402b7c
cmp dword [ebx], 0
je 0x402b7c
dec esi
jmp 0x402b65
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40314c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4b1008], 0x8088405
inc edx
mov dword [ebx + 0x4b1008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4b1024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403998
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403978
xor eax, eax
push ebp
push 0x403971
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4039b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403978
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4b1024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4b1024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404680
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b504c], 0
je 0x4046e1
cmp word [0x4b5220], 0xd7b2
jne 0x4046a9
cmp dword [0x4b5228], 0
jbe 0x4046a9
mov eax, 0x4b521c
call dword [0x4b5238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4b1074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404708
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b1034], 0
jne 0x4046fd
push 0
push 0x4b106c
push 0x4b1074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404854
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402800
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4b504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40481c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406900
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406966
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404b10
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403338
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406950
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40696d
lea eax, [ebp - 0x10]
call fcn.004048a0
ret

Function at 0x409520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d60
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409539
test al, 0x10
jne 0x40953d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40962c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d60
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x409640
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404d60
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409662
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c14c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c185
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404990
jmp 0x40c18e
mov eax, ebx
mov edx, esi
call fcn.004048f4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c198
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c1b9
mov al, byte [esp]
jmp 0x40c1bb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40c840
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c6b8
mov eax, dword [0x4b4138]
cmp byte [eax], 0
je 0x40c8bc
mov eax, dword [0x4b3d30]
call fcn.00402f70
call fcn.00402968
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004098a4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c904
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c8f2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4b3c98]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b5668]
call fcn.00405df8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d1d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d2a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404938
lea eax, [ebp - 8]
call fcn.00404db0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d60
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d290
mov eax, ebx
call fcn.00402800
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d289
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d60
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d273
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d2b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d273
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d290
mov eax, dword [ebp - 0x10]
call fcn.00402820
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d2ad
lea eax, [ebp - 8]
call fcn.004048a0
ret

Function at 0x40d85c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d8c0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b10
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409180
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d8c7
lea eax, [ebp - 0xc]
call fcn.004048a0
ret
Function at 0x420180
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4201cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0041ffc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4201e5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4201ec
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041ffc0
dec esi
jne 0x42020e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x421350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4b588c
cmp dword [edi], 0
jne 0x4213cc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4b5888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b1404
mov ecx, 2
call fcn.004029fc
mov edx, 0x421328
lea eax, [esi + 5]
call fcn.00421348
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00421348
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4213a1
mov dword [0x4b5888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x422918
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42291e
ret

Function at 0x424d6c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x424dbd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x424da4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x424d94
jmp 0x424dbd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x424da5
pop ebx
mov esp, ebp
pop ebp
ret