joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f91b0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor edi, edi
test ebx, ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
je 0x4f91ea
mov dword [esi + 0x28], ebx
jmp 0x4f9202
lea edx, [esi + 0x28]
push edx
push 0
push esi
push 0x4f9170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
je 0x4f9210
dec eax
jne 0x4f9219
push 1
jmp 0x4f9212
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test ebx, ebx
jne 0x4f9228
test edi, edi
je 0x4f9228
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x4fa620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov byte [eax], 0
mov eax, dword [edi]
xor esi, esi
test eax, eax
mov dword [esp + 8], edi
je 0x4fa73e
call fcn.004fa500
mov eax, dword [edi]
test eax, eax
je 0x4fa651
mov byte [eax + 0x18], 0
mov eax, dword [eax]
test eax, eax
jne 0x4fa647
push ebx
push ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x4fa73c
lea ecx, [ecx]
mov al, byte [ecx + 0x18]
test al, al
jne 0x4fa68f
test esi, esi
je 0x4fa68d
fild dword [edi + 0x78]
fild dword [ecx + 0x14]
fild dword [ecx + 0x10]
fdiv st(2)
fdivp st(1)
fild dword [esi + 0x14]
fild dword [esi + 0x10]
fdiv st(3)
fdivp st(1)
fcompp
fnstsw ax
fstp st(0)
test ah, 0x41
jne 0x4fa68f
mov esi, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4fa660
test esi, esi
je 0x4fa73c
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4fa702
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ebp, [esi + 0x3c]
push ebp
lea ecx, [esi + 0x38]
push ecx
push edx
push eax
call dword [esi + 4]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4fa6d9
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [esi + 0x1a], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [esp + 0x10]
test ebx, ebx
mov dword [esi + 0x34], ebx
je 0x4fa6f0
mov ecx, dword [esp + 0x18]
mov byte [ecx], 1
mov edx, dword [edi + 0xa0]
sub dword [ebp], edx
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4fa702
mov byte [esi + 0x18], 1
xor esi, esi
jmp 0x4fa653
inc dword [esi + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x4fa723
mov ecx, dword [edi + 0x74]
movsx ecx, byte [ecx + edi + 0x10]
cmp dword [eax + 0x44], ecx
je 0x4fa720
mov eax, dword [eax]
test eax, eax
jne 0x4fa713
jmp 0x4fa723
dec dword [eax + 0x14]
mov edx, dword [edi + 0x74]
mov al, byte [esi + 0x44]
mov byte [edx + edi + 0x10], al
mov eax, dword [edi + 0x74]
inc eax
cdq
mov ecx, 0x64
idiv ecx
mov dword [edi + 0x74], edx
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x501ff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [esp + 0x10]
cmp eax, 3
mov ecx, 0x9e3779b9
push edi
mov ebp, eax
mov edi, ecx
mov esi, edx
jb 0x502091
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
add ecx, dword [ebx + 4]
add esi, dword [ebx + 8]
mov eax, dword [ebx]
sub eax, esi
sub eax, ecx
add eax, edi
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor eax, edi
sub ecx, eax
mov edi, eax
shl edi, 8
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 0xd
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 0xc
xor eax, edi
sub ecx, esi
sub ecx, eax
mov edi, eax
shl edi, 0x10
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 5
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 3
xor eax, edi
sub ecx, esi
mov edi, eax
shl eax, 0xa
sub ecx, edi
xor ecx, eax
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 0xf
xor esi, eax
add ebx, 0xc
sub ebp, 3
dec edx
jne 0x502017
mov eax, dword [esp + 0x14]
add esi, eax
dec ebp
je 0x50209c
dec ebp
jne 0x50209e
add ecx, dword [ebx + 4]
add edi, dword [ebx]
sub edi, esi
sub edi, ecx
sub ecx, esi
mov edx, esi
shr edx, 0xd
xor edi, edx
sub ecx, edi
mov eax, edi
shl eax, 8
xor ecx, eax
sub esi, ecx
sub esi, edi
mov edx, ecx
shr edx, 0xd
xor esi, edx
sub edi, esi
sub edi, ecx
mov eax, esi
shr eax, 0xc
xor edi, eax
sub ecx, esi
sub ecx, edi
mov edx, edi
shl edx, 0x10
xor ecx, edx
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 5
xor esi, eax
mov eax, esi
sub edi, eax
sub edi, ecx
mov edx, eax
shr edx, 3
xor edi, edx
sub ecx, eax
mov edx, edi
sub ecx, edi
shl edx, 0xa
xor ecx, edx
sub eax, ecx
sub eax, edi
pop edi
pop esi
shr ecx, 0xf
pop ebp
xor eax, ecx
pop ebx
ret
Function at 0x5025c0
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x5026dd
push ebx
mov ebx, dword [edi + 0x20]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ebx
mov edx, 0x12311998
mov eax, ebp
call fcn.00501ff0
and eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x30]
mov esi, dword [ecx + eax*8]
add esp, 4
test esi, esi
je 0x5026da
xor eax, eax
test ebx, ebx
lea ecx, [esi + 0x14]
jbe 0x502611
mov edx, dword [ecx]
add ecx, 4
cmp edx, dword [ebp + eax*4]
jne 0x502666
inc eax
cmp eax, ebx
jb 0x502601
cmp dword [edi + 0x34], esi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
jne 0x50261f
mov dword [edi + 0x34], eax
cmp dword [edi + 0x38], esi
jne 0x502627
mov dword [edi + 0x38], ecx
test eax, eax
je 0x50262e
mov dword [eax + 0xc], ecx
test ecx, ecx
je 0x502635
mov dword [ecx + 8], eax
mov eax, dword [esi]
test eax, eax
je 0x502641
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x50264c
mov edx, dword [esi]
mov dword [eax], edx
mov ecx, dword [edi + 0x18]
test ecx, ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x14]
jne 0x502671
push eax
push ebx
call fcn.004fc000
add esp, 8
jmp 0x502693
mov esi, dword [esi]
test esi, esi
jne 0x5025f8
pop esi
pop ebp
pop ebx
pop edi
ret
mov cx, word [eax]
movzx edx, word [eax + 4]
neg cx
sbb ecx, ecx
and ecx, 3
inc ecx
imul ecx, edx
movzx edx, word [eax + 2]
movzx eax, word [eax + 6]
imul ecx, edx
lea eax, [ecx + eax*4 + 0x14]
mov ecx, dword [edi + 0x2c]
mov ebp, dword [edi + 4]
mov edx, dword [edi + 0xc]
add ecx, eax
sub ebp, ecx
mov ecx, dword [edi + 0x18]
dec edx
test ecx, ecx
mov dword [edi + 4], ebp
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0x10]
push eax
push ebx
jne 0x5026c9
call fcn.0041ea80
add esp, 8
push esi
call fcn.00527b30
add esp, 4
pop esi
pop ebp
pop ebx
pop edi
ret
call fcn.00501fd0
add esp, 8
push esi
call fcn.00527b30
add esp, 4
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x51bc90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x2c]
add edx, edx
add esi, esi
test ecx, ecx
mov dword [esp + 0xc], edx
jle 0x51be30
mov eax, dword [esp + 0x28]
sub eax, edx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x24]
sub eax, edx
mov edx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x34], eax
push ebp
mov eax, ebx
sub eax, esi
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x28]
lea edx, [edx + eax*4]
mov ebp, edi
sub ebp, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x48]
add eax, ecx
lea eax, [edx + eax*4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
jmp 0x51bd01
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx*4 + 0x548210]
lea ecx, [edi + esi*2]
push ecx
lea edx, [esi + edi]
push edx
push edi
push ebp
push eax
mov dword [esp + 0x34], eax
call fcn.0051b9b0
lea eax, [edi + esi*2 + 0x10]
push eax
lea ecx, [esi + edi + 0x10]
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [edi + 0x10]
push edx
lea eax, [ebp + 0x10]
push eax
push ecx
call fcn.0051b9b0
mov edx, dword [esp + 0x3c]
mov eax, dword [edx]
lea ecx, [ebx + esi*2]
push ecx
add ebp, 0x20
lea edx, [esi + ebx]
push edx
mov dword [esp + 0x50], ebp
mov ebp, dword [eax*4 + 0x548210]
mov eax, dword [esp + 0x68]
push ebx
push eax
push ebp
add edi, 0x20
call fcn.0051b9b0
lea ecx, [ebx + esi*2 + 0x10]
push ecx
mov ecx, dword [esp + 0x78]
lea edx, [esi + ebx + 0x10]
push edx
lea eax, [ebx + 0x10]
push eax
add ecx, 0x10
push ecx
push ebp
call fcn.0051b9b0
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x68]
add eax, 0x20
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x80]
add esp, 0x50
lea edx, [eax + ecx*2]
push edx
add ecx, eax
push ecx
push eax
mov eax, dword [esp + 0x48]
push eax
push ebp
add ebx, 0x20
call fcn.0051b9b0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
lea edx, [eax + ecx*2]
push edx
add ecx, eax
push ecx
push eax
mov eax, dword [esp + 0x70]
push eax
push ebp
call fcn.0051b9b0
mov ebp, dword [esp + 0x58]
mov eax, 0x10
add esp, 0x28
add ebp, eax
mov dword [esp + 0x30], ebp
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x50]
add edx, eax
add ecx, eax
add ebp, eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov eax, 4
add edx, eax
add ecx, eax
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x50], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x51bcfd
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x51c6e0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x55ce00]
test eax, eax
je 0x51c72e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x623d18], eax
call esi
push 0
push 0
push 0
push 0x51c6a0
push 0
push 0
mov dword [0x623d14], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x55ce00], 0
pop esi
mov eax, dword [0x623d18]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
ret
Function at 0x524dd0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
cdq
and edx, 7
push ebx
mov ebx, dword [esp + 0x10]
add eax, edx
push ebp
sar eax, 3
and ecx, 7
test eax, eax
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
jle 0x524e1c
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.00520000
xor edx, edx
mov ecx, ebx
shr ecx, 8
mov dh, bl
xor eax, ecx
and eax, 0xff
xor edx, dword [eax*4 + 0x54d580]
dec edi
mov ebx, edx
jne 0x524df6
pop edi
test ebp, ebp
jle 0x524e48
push 1
mov ecx, esi
call fcn.00520000
mov ecx, ebx
shr ecx, 0xf
and ecx, 1
and ebx, 0x7fff
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x524e45
xor ebx, 0x8005
dec ebp
jne 0x524e20
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x5272b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
mov ebp, ecx
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp + 0x1a4]
test edi, edi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
je 0x527335
push esi
lea esi, [ebp + 0x28]
lea ecx, [ecx]
mov eax, dword [edi + 0x14]
mov ecx, dword [esi]
mov ebx, dword [edi + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
inc ecx
cmp ecx, eax
jbe 0x52731b
test eax, eax
je 0x52730c
add eax, eax
jmp 0x527311
mov eax, 0x3e8
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00526610
mov edx, dword [esi]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x14]
mov dword [eax + edx*8], ebx
mov dword [eax + edx*8 + 4], ecx
inc dword [esi]
mov edi, dword [edi + 8]
test edi, edi
jne 0x5272f0
pop esi
lea edx, [ebp + 0x28]
push edx
mov ecx, ebp
call fcn.00526fd0
lea ecx, [esp + 0x14]
call fcn.00525fe0
lea eax, [esp + 0xc]
mov ebx, 1
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
push 0
mov ecx, ebp
mov dword [esp + 0x1c], edx
mov byte [ebp + 0x1a0], bl
call fcn.00527120
lea ecx, [esp + 0x14]
mov byte [ebp + 0x1a0], 0
mov byte [ebp + 0x25], 0
call fcn.00525fe0
pop edi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x527590
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
push edi
lea eax, [esp + 0x30]
push eax
mov edi, ecx
call ebx
mov esi, dword [edi + 0x18]
lea ecx, [esp + 0x10]
inc esi
push ecx
mov dword [edi + 0x18], esi
call ebx
mov eax, dword [edi + 0x28]
test eax, eax
lea esi, [edi + 0x28]
jne 0x5275cf
mov ecx, edi
call fcn.005272b0
jmp 0x5276c4
lea edx, [esp + 0x28]
push edx
call ebx
mov eax, dword [0x623e60]
or eax, dword [0x623e64]
jne 0x5275ee
push 0x623e60
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [0x623e64]
mov edx, dword [0x623e60]
mov eax, dword [ebp + 8]
push ecx
push edx
push 0
push eax
call fcn.004d1b40
push 0
push 0x3e8
push edx
push eax
call fcn.004d1b80
add eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
adc edx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
mov eax, dword [esi]
test eax, eax
je 0x52767f
mov ecx, dword [0x55ced8]
cmp eax, ecx
jbe 0x527637
mov eax, ecx
test eax, eax
jbe 0x527662
mov ebx, eax
lea ecx, [ecx]
mov eax, dword [esi]
mov edx, dword [esi + 8]
dec eax
mov dword [esi], eax
mov ecx, dword [edx + eax*8]
mov eax, dword [edx + eax*8 + 4]
push esi
push eax
push ecx
mov ecx, edi
call fcn.00526ca0
dec ebx
jne 0x527640
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x20]
push eax
call ebx
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x1c]
jb 0x527625
ja 0x52767f
mov edx, dword [esp + 0x20]
cmp edx, dword [esp + 0x18]
jb 0x527625
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [edi + 0x1cc]
sub ecx, eax
mov eax, dword [esp + 0x24]
sbb eax, esi
cmp eax, edx
jb 0x5276c4
ja 0x5276ae
cmp ecx, dword [edi + 0x1c8]
jbe 0x5276c4
mov dword [edi + 0x1c8], ecx
mov dword [edi + 0x1cc], eax
mov dword [edi + 0x1d0], 0
lea ecx, [esp + 0x28]
push ecx
call ebx
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
sub edx, esi
mov esi, dword [edi + 0x10]
sbb eax, ecx
mov ecx, dword [edi + 0x14]
add esi, edx
adc ecx, eax
mov dword [edi + 0x14], ecx
lea ecx, [esp + 0x28]
push ecx
mov dword [edi + 0x10], esi
call ebx
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x34]
mov edx, dword [edi + 0x1cc]
sub ecx, ebx
sbb eax, esi
cmp eax, edx
jb 0x527734
ja 0x52771e
cmp ecx, dword [edi + 0x1c8]
jbe 0x527734
mov dword [edi + 0x1c8], ecx
mov dword [edi + 0x1cc], eax
mov dword [edi + 0x1d0], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x527760
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebp
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
call ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov ecx, esi
mov dword [esp + 0x28], edx
mov byte [esi + 0x25], 1
call fcn.00525de0
lea eax, [esp + 0x1c]
push eax
call ebx
mov edi, dword [esi + 0x1a4]
test edi, edi
je 0x527805
add esi, 0x28
mov ebx, dword [edi + 0x10]
mov ebp, dword [edi + 0x14]
mov eax, ebx
test eax, eax
mov dword [esp + 0x18], ebp
je 0x5277f4
mov ecx, dword [esi]
mov eax, dword [esi + 4]
inc ecx
cmp ecx, eax
jbe 0x5277e6
test eax, eax
je 0x5277d7
add eax, eax
jmp 0x5277dc
mov eax, 0x3e8
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00526610
mov edx, dword [esi]
mov eax, dword [esi + 8]
mov dword [eax + edx*8], ebx
mov dword [eax + edx*8 + 4], ebp
inc dword [esi]
mov edi, dword [edi + 8]
test edi, edi
jne 0x5277b5
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esi + 0x10]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esi + 0x14]
sub edx, ebp
sbb eax, ebx
add edi, edx
adc ecx, eax
mov dword [esi + 0x14], ecx
push 0x19
mov ecx, esi
mov dword [esi + 0x10], edi
call fcn.00527590
lea ecx, [esp + 0x24]
call fcn.00525fe0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x405b20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b86
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404208
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b70
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b8d
lea eax, [ebp - 0x10]
call fcn.00403f98
ret

Function at 0x40ac00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac39
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404088
jmp 0x40ac42
mov eax, ebx
mov edx, esi
call fcn.00403fec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac4c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac6d
mov al, byte [esp]
jmp 0x40ac6f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b2f4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b16c
mov eax, dword [0x465948]
cmp byte [eax], 0
je 0x40b370
mov eax, dword [0x465760]
call fcn.00402af0
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408474
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b3b8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b3a6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x465710]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x466664]
call fcn.00405034
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bc0c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bce2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404030
lea eax, [ebp - 8]
call fcn.004044a8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404458
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bccc
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bcc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404458
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bcaf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bcf4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bcaf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bccc
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bce9
lea eax, [ebp - 8]
call fcn.00403f98
ret

Function at 0x40c230
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c294
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404208
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407f68
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c29b
lea eax, [ebp - 0xc]
call fcn.00403f98
ret

Function at 0x41a370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x466884
cmp dword [edi], 0
jne 0x41a3ec
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x466880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4643ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a348
lea eax, [esi + 5]
call fcn.0041a368
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a368
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a3c1
mov dword [0x466880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b968
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b96e
ret
Function at 0x41de04
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41de55
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41de3c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41de2c
jmp 0x41de55
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41de3d
pop ebx
mov esp, ebp
pop ebp
ret