joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424772
Capabilities:
Encode data using xor

Disassembly:
les edx, [ebx - 0x1b]
jo 0x4247a4
jmp 0x42479a
lodsd eax, dword [esi]
pop eax
pop ecx
xor cl, al
int1
clc
in al, 0x9c
lahf
cmp esi, dword [0xa7787c16]
cmpsd dword [esi], dword es:[edi]
xor eax, 0xa7787c16
cmpsd dword [esi], dword es:[edi]
clc
mov bl, 0xd1
mov dh, 0x36
dec esi
js 0x42476e
outsd dx, dword [esi]
insd dword es:[edi], dx
ror byte [esi], 0x38
cmpsb byte [esi], byte es:[edi]
pop ebp
nop
jne 0x424763
cmp byte [ebp + 0x38], dh
jae 0x424797
xchg esp, eax
mov eax, 0xd3d0e47e
mov dl, 0x1a
xlatb
mov cl, 0xeb
shl dword [ebx - 0x6f878c42], cl
mov esi, 0xb0907873
movsd dword es:[edi], dword [esi]
js 0x42472b
nop
mov al, 0xa5
fcom dword [ebx - 0x2a99c9a5]
salc
sbb edx, eax
into
aas
jb 0x42479b
shr byte [ebx + 0x1d9583d3], cl
jnp 0x424799
push ss
push ecx
out dx, al
mov edi, 0xae7d0935
dec ebp
pop edx
mov ebx, 0x6c51f6b3
push cs
ljmp 0xc2d6

Function at 0x4249d0
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xb76ed2fe], al
iretd
sbb eax, 0x674b979b
leave
mov bl, 0xda
stosb byte es:[edi], al
invalid
inc byte [ecx - 0x63]
push esp
lodsd eax, dword [esi]
std
enter 0xffffffffffffe1e4, 0xffffffffffffff97
salc
cmc
jp 0x424937
std
sub byte [ecx + 0x6a3ed8cd], 0xbf
sub al, 0xa2
mov byte [esi - 0x10ec52c0], ch
and al, 0x10
lodsd eax, dword [esi]
jg 0x4249fe
mov ebx, 0x61d8cf76
cli
imul ebx, esp, 0x156f18d7
inc ebx
movsb byte es:[edi], byte [esi]
mov eax, dword [0x55ee26f8]
out dx, al
push ebp
inc eax
lahf
movsb byte es:[edi], byte [esi]
int1
cmpsd dword [esi], dword es:[edi]
inc edx
push ss
jge 0x424945
sar dword [ecx - 0x21], 1
lds eax, [edx + 0x51]
leave
inc esi
pop esi
aam 0x78
or edi, edx
test byte [eax - 0xd], dl
test eax, 0x88391e9
invalid
test byte [esi - 0x55], bl
jg 0x42497c
or byte [esi + ebx*2 - 0x32598055], al
repe cmpsd dword [esi], dword es:[edi]
int 0xf3
cmpsd dword [esi], dword es:[edi]
in eax, dx
leave
cli
les esi, [edi + 0xe3cdd95]
mov ebp, 0xd7416e35
sbb byte [edx], dl
or dh, byte [esi - 0x68d98867]
in eax, dx
fmul dword [ebx + 0x65ddffc9]
mov byte [0x9abf], al
out 0xc0, al
mov esi, 0x24ff2cb6
movsd dword es:[edi], dword [esi]
sub al, 0xff
and al, 0xa5
pop ebp
sti
inc esi
xor byte [ecx + 0x6d], ch
out 0x5a, al
xchg ecx, eax
jo 0x4249f6
jle 0x4249b1
pushal
xor al, 0x2a
cmp al, byte [esi]
sahf
cmpsd dword [esi], dword es:[edi]
Function at 0x43b8a8
Capabilities:
Encode data using xor

Disassembly:
adc byte [edx - 0x74dcdcd3], cl
popal
jnp 0x43b8ff
xchg byte [ebx + 9], dh
je 0x43b867
sar ecx, 0xfb
shl ebx, 1
adc edx, edx
push es
mov dword [esi], esi
mov ecx, 0x52132e88
inc edi
invalid
Function at 0x47555e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00475751
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004802a6
xor ebx, ebx
cmp eax, ebx
jne 0x47570c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00475751
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047cf85
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4ce87a
add esp, 0x10
test eax, eax
jne 0x475627
push esi
call fcn.00472c10
mov esi, eax
cmp esi, ebx
pop ecx
je 0x475627
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x475612
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x475627
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x475620
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004817b9
cmp byte [esp + 0x13], bl
je 0x475657
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0047578e
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4756c7
push 0x14
call 0x4cdae7
cmp eax, ebx
pop ecx
je 0x475681
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x475683
xor edi, edi
cmp edi, ebx
je 0x4756c7
push esi
push edi
call fcn.00474cb4
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00474d7c
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474ea5
add esp, 0x18
call fcn.00475751
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047f973
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4756de
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4756f0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x475733
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x475733
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00474d7c
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474ea5
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fcf0
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xb58b751d
inc edi
insb byte es:[edi], dx
adc edx, dword [ecx + edi*4 + 0x18]
invalid
and dword es:[edi - 0x62], 0x7d73a841
and dword [edi - 0x62], 0x7d73a841
imul ecx, dword [esi], 0x43
jecxz 0x47fcbe
adc edi, eax
aam 0x1d
or al, 0x42
enter 0xffffffffffffa638, 0xffffffffffffffc4
dec esi
fcom qword [esi]
ror dword [ecx + esi], cl
aad 0xb4
inc esp
xor dword [eax + edi*8 - 0x660a6c7b], esi
loope 0x47fcf1
int3
Function at 0x493e09
Capabilities:
Encode data using xor

Disassembly:
adc esp, dword ds:[ebx + 0x38]
stc
cmc
pushal
adc dword gs:[edi + 0x20], 0x60
and dl, byte [ebp + 0x74b9d106]
xchg ebp, eax
push es
invalid
invalid
je 0x493e67
invalid
xchg ebp, eax
push es
sar dword [ecx - 0x359b8e8c], 1
pop es
adc bl, byte [ebp + esi*8 - 0x30]
salc
jbe 0x493de3
retf 0x1207
das
mov bh, 0xd4
mov bl, 0xdf
ja 0x493e3e
adc ch, byte [ecx + edx*4 + 0x70]
ja 0x493e55
dec esp
invalid
cmp byte ss:[esi + 0x6c], 0xd3
push es
mov esp, 0xab448458
adc al, byte [edi]
pop es
push eax
test byte [ecx + 7], bl
cdq
mov dl, 0xc9
pushal
xchg esi, eax
xor edx, dword gs:[ebp + ecx*4 + 0x2c]
xor edx, dword [ebp + ecx*4 + 0x2c]
imul esp, dword [edi + 0x622eaea3], 0xffffffcf
mov dword [0xcf622eae], eax
mov ah, 0xd2
pop ss
loop 0x493e53
push edx
sal ebp, 0x84
mov al, byte [0xfa4e2ff2]
in al, dx
dec ebp
jo 0x493edc
inc ebp
invalid

Function at 0x496a54
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
scasb al, byte es:[edi]
dec eax
cwde
adc al, 0x67
mov ah, 0x7e
push ecx
outsb dx, byte [esi]
bound ebx, qword [edx]
inc edx
out 0xcd, al
ljmp 0x31ef
xchg ecx, eax
in al, 0x6e
push esi
xor dword [ebx], ecx
inc edi
and edi, 0x40224e39
mov bl, pe_nt_image_headers32
mov dh, 0x1e
mov byte [0x44ad59a6], bl
nop
ja 0x496a9a
push ebx
mov dl, 0x50
xchg edx, eax
xchg esp, eax
loope 0x496a41
xchg ebp, eax
inc edi
cdq
sub ebx, dword [ecx + 0x39c6085d]
ror dword [esi + 1], 0
jle 0x4969c4
cmp byte [esi], 0xe7
invalid
out 0x8f, eax
or dword es:[edi - 0x19cedf0], ebp
adc byte [edx], dl
arpl si, di
push eax
jl 0x4969ff
aas
out dx, eax
pop ebp
xor esi, dword [ebx]
sbb ah, byte [esi]
rcr dword [edi + 0x13], 0x49
and dword [ebx - 0x2f], edi
je 0x496a48
pop ss
rcl byte [ebp + 0x58b908b4]
cmp edi, edi
stc
xchg ebp, eax
mov ah, 8
mov ecx, 0xf9ff3958
loopne 0x496aa5
pop es
nop
sub dh, byte [ebx + 0x7b]
inc ebx
mov ds, word [edi + 0x6996d45b]
wait
test eax, 0x547210b2
xor dl, byte [edx]
int 0xef
ja 0x496a15
invalid
xor bh, dl
and byte [ebp - 0x19da1a89], bh
nop
ja 0x496b22
jl 0x496a61
mov edi, 0x620e6182
push edi
pop esi
aas
xchg bl, ah
invalid
push eax
rol dword [ebp + esi*8 - 0x5a], 0xa1
retf 0xf7b9

Function at 0x496d80
Capabilities:
Encode data using xor

Disassembly:
invalid
imul esp, edi, 5
loop 0x496dec
invalid
imul esi, dword [edx - 7], 0x47
jb 0x496d7c
inc edi
jle 0x496d7c
push esi
sbb byte [eax - 0x1b], 0x95
jl 0x496d12
retf
cmpsb byte [esi], byte es:[edi]
ljmp 0x25e0
Function at 0x4a0287
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov bl, 0xdb
jg 0x4a02b8
or al, 0x1f
mov al, byte [0x4906a27a]
adc eax, 0xa71dc2a6
invalid
ret 0xa71d
cmp eax, 0x77caa619
fld dword [eax - 0x3fceb959]
mov esp, 0xb4b14e27
clc
xor cl, byte [ecx + 0x6f]
sal dword [edx - 0x459f23f3], 1
rcr ebx, cl
cmp eax, 0xc0ccd829
mov word [eax + 0x7d78606a], ds
sahf
fmul st(4)
ror byte [eax + ebx*4 + 0x7d78606a], 0x2e
sahf
mov ebx, 0x6c1dfddf
cdq
mov byte [0xd7add472], al
xchg esp, eax
pop esp
fnstsw word [esi - 0x1d72c845]
pop edi
dec ebp
cdq
je 0x4a0294
clc
sbb dword [ecx + edi], eax
xor dh, byte [edx]
fsubrp st(2)
mov ecx, 0xe2d0897e
jle 0x4a034b
inc ecx
cld
jns 0x4a035a
repne insd dword es:[edi], dx
sub al, 0x3f
jp 0x4a0309
loope 0x4a02d7
adc bh, byte [ecx - 0x5d]
xchg esi, eax
xor cl, 0xb9
xor ah, byte [ebx - 0x1c6c5cac]
pop esp
dec eax
mov word [ebx + 0x6c9e33b4], fs
xchg dword [edi + 0x5e00759f], esi
les esp, [ecx - 0x76578aac]
jmp 0x9aa1ed11
push ebp
invalid
sbb al, 0xe9
popal
mov ecx, 0xdf8f4f67
sbb dword [esi + 0x1f3b84e8], 0xd980d86b
xor byte [ebx - 0x5f], 0x74
jp 0x4a037c
invalid
xor eax, 0x1a6f3697
or byte [ebx + 0x30], al
popfd
jns 0x4a03b1
movsb byte es:[edi], byte [esi]
clc
inc eax
sub ebp, dword [eax + 0x63bb0d5f]
add ecx, dword [ebx]
inc eax
and ch, dh
ret 0x264
or dword [eax], ebx
invalid
Function at 0x4a34be
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a36b1
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004ae206
xor ebx, ebx
cmp eax, ebx
jne 0x4a366c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a36b1
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004aaee5
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4fc7da
add esp, 0x10
test eax, eax
jne 0x4a3587
push esi
call fcn.004a0b70
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a3587
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a3572
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a3587
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a3580
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004af719
cmp byte [esp + 0x13], bl
je 0x4a35b7
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a36ee
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a3627
push 0x14
call 0x4fba47
cmp eax, ebx
pop ecx
je 0x4a35e1
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a35e3
xor edi, edi
cmp edi, ebx
je 0x4a3627
push esi
push edi
call fcn.004a2c14
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a2cdc
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2e05
add esp, 0x18
call fcn.004a36b1
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004ad8d3
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a363e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a3650
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a3693
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a3693
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a2cdc
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2e05
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adc50
Capabilities:
Encode data using xor

Disassembly:
ret
mov edx, 0x7ab4591d
pop edi
dec ecx
jmp 0x608cf087
stosd dword es:[edi], eax
push esp
wait
int 0xb1
jp 0x4adc16
ror byte [edi + 0x7a], 1
push edx
insb byte es:[edi], dx
sahf
loope 0x4adbd2
invalid
sub dword [edi + 0x38], 0x8c5b694b
mov bh, 0x39
jno 0x4adcd0
outsd dx, dword [esi]
cmp byte [ebx + 0x69], cl
pop ebx
invalid
cmp dword [ecx + 0x75], esi
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
jne 0x4adc9e
sbb dword [ecx], edx
sbb ebp, ecx
adc eax, 0x7d969f9d
adc al, 0xb4
vpcmpeqw ymm5, ymm7, ymmword [ecx + 0x3056860]
push es
jge 0x4adc58
imul esi, dword [edx - 0x2b51db3e], 0xffffffa0
mov dl, 0xc2
and al, 0xae
aam 0xa0
jns 0x4adce4
loope 0x4adc42
lds eax, [ecx]
test ebx, esp
jmp 0xfea99e53
xor eax, 0x96b7f58d
push esi
sti
jnp 0x4adcb0
nop
add dword [ebp*4 + 0x28e47a37], esp
pop ecx
mov byte [ebp + 0x6215f76c], bl
pushal
mov al, 0xa0
sub esp, dword [ebx - 0x11]
jg 0x4adcc0
adc byte [edx], bl
cmc
popal
or bl, 0xd6
loop 0x4adc76
js 0x4add43
sbb dword [esi + eax*8 + 0x42], esi
add eax, 0xf01cbd95
sbb al, 0xf0
ljmp 0xa162:0x5777951d
int 0x71
mov ecx, dword [edi - 0x13ed95e5]
mov esp, 0x4d69b6b
inc esp
jne 0x4add2f
imul eax, dword [esi - 0x5e], 0xfffffffd
cmp bh, bl
rcr ebx, 1
invalid
in al, 0x7a
test byte [eax], ah
pop ss
mov esp, 0x4153f056
jo 0x4add39
invalid
add byte [eax - 0x203073e], 0x40
cld
std
inc eax
xchg esp, eax
inc ebp
hlt
salc
push ebp
mov bh, 0x6f
sub ch, 0xe0
adc ch, bh
add dword [0x7db31bce], ebp
xchg esp, eax
xor bl, byte [edi + 0x3a7c94eb]
inc ebp
loop 0x4addc6
pop eax
nop
adc dword [ecx], ebp
clc
mov dword [0x416631e7], eax
je 0x4add1d
mov ah, 0xa5
outsd dx, dword [esi]
and eax, 0x352ba887
jg 0x4adcfb
jae 0x4add33
pop esi
invalid
ret 0x66eb

Function at 0x4af91a
Capabilities:
Check for software breakpoints

Disassembly:
out 0xd6, eax
inc esp
add al, 0xda
imul dword [ebx + 0x79]
invalid
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7d56189b
mov eax, 0x3d571cdf
xor eax, edx
push 0x187d4133
mov ecx, 0x10d1aa3b
pop ebx
xor ecx, ebx
xor eax, ecx
mov ebx, eax
push ebx
mov esi, 0x69b1821a
xor esi, 0x6939834d
mov eax, 0x61e7813d
xor eax, 0x29c25535
xor esi, eax
pop edi
xor esi, edi
mov eax, 0xfffffffc
xor esi, esi
add esi, eax
mov ebx, esi
push ebx
pop eax
jmp 0x403f29

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dd0
add esp, 0x104
pop ebx
ret
Function at 0x41b1c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8fca40]
xor edx, edx
cmp eax, edx
jne 0x41b1e6
xor eax, eax
mov byte [eax + 0x8fc940], al
inc eax
cmp eax, 0x100
jl 0x41b1ce
mov dword [0x8fca40], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8fc940
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41b277
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41b24a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41b218
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41b2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41b343
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41b32a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x41f841
cmp eax, 8
jg 0x41f841
cmp dword [esp + 0x8c], 2
jl 0x41f841
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x41f841
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x41f841
mov eax, dword [esp + 0x80]
test eax, eax
je 0x41f6a7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x41f82a
mov ebp, dword [0x488478]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x41f6d9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x41f811
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x41f6f9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x48848c]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x41f738
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x488484]
lea ecx, [esp + 0x28]
push ecx
call dword [0x488444]
test eax, eax
jne 0x41f7f8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.0041ec30
cmp eax, 1
jne 0x41f822
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0041f4e0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x41f6ed
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x41f82a
jmp 0x41f6c4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.0041e830
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c