joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d3e8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov ecx, dword [0x4b6074]
mov al, byte [esp + 0x124]
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
xor ebp, ebp
mov ebx, 0
xor ecx, esp
test al, al
mov dword [esp + 0x104], ecx
je 0x46d438
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
test edi, edi
mov dword [esi], 0x4c
je 0x46d451
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
test al, al
mov dword [esi + 0x2c], ebp
je 0x46d461
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x46d468
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x46d485
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
jb 0x46d485
mov byte [edi], 0
test bl, bl
je 0x46d492
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x104]
test esi, esi
setne bl
xor ecx, esp
call fcn.0046ef41
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47f785
Capabilities:
Hash data using murmur3

Disassembly:
sub ecx, 0x7db4094
rol esi, 0xd
add edx, edx
sub dword [0x4b6360], esi
and esi, edi
ror esi, 0x1c
not eax
mov ecx, 0x26cdff69

Function at 0x47f7d3
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
neg edx
xor dword [0x4b6528], 0x8885e4
shl eax, 0x14
xchg esi, edx
shr edi, 2
rol esi, 0x17
call fcn.00419f02
and dword [0x4b614a], 0x1c044a5d
popal
dec ebx
add byte [ebp + 0x4a], bl
add al, 0x1c
inc eax
neg esi
inc eax
ror edx, 0x1f
and dword [0x4b6078], 0x23df5914
dec ebx
add byte [ecx + ebx*2], dl
fbld tbyte [ebx]
dec ebx
add byte [ecx + ebx*2], dl
fbld tbyte [ebx]
loop 0x47f7a2
mov esi, edx
shr eax, 0x1e
dec esi
xor edx, ecx
shr ecx, 3
inc eax
mov ecx, 0x3cf6cd
shl esi, 7
or eax, 0x10c0aec4
shr ecx, 0xc
mov eax, 0x87bd4c5
or esi, edi
xor edi, esp
mov dword [0x4b69d0], ebx
rol edi, 0xa
xor edx, esi
mov eax, 0xc5128b0
ror ebx, 2
dec eax
mov ecx, dword [0x4b6550]
add edi, esp
sub ebx, eax
mov dword [0x4b61f0], ecx
shl edx, 0x19
mov eax, esp
test esi, ecx
jo 0x47f7c1
xor eax, eax
mov edi, esp
neg esi
not ecx
xor edx, 0x1226ef6b
neg esi
sub edi, esi
mov ecx, 0xdb7b5da

Function at 0x47f847
Capabilities:
Hash data using murmur3

Disassembly:
xchg eax, esi
shr esi, 0x1f
rol eax, 0xf
ror ebx, 0x12
xor edi, dword [0x4b6048]
neg esi
xchg eax, eax
inc eax
dec esi
add edi, dword [0x4b68e0]
inc esi
xchg esi, esi
not esi
neg esi
loop 0x47f845
rol ebx, 0x1f
call fcn.0046f415
not edx
call fcn.0046f1b9
sub ebx, esp
sub edx, esp
xor esi, ebx
mov ebx, eax
rol edi, 3
xor ecx, esi
ror esi, 0x10
rol esi, 0x17
xor eax, esp
xor edi, esp
xchg eax, eax
mov esi, eax
not esi
xor esi, edi
mov edx, ebx
shr eax, 0x1b
mov esi, dword [0x4b6120]
or esi, edi
shr esi, 0x15
xor ecx, eax
mov ebx, esp
and esi, edi
xor esi, ebx
mov esi, 0x112be2da
test edx, 0xcdf7310
jb 0x47f901
not eax
xor esi, 0x17dbd3ea
mov ecx, 0xe0f5428
femms
push es

Function at 0x47f91f
Capabilities:
Hash data using murmur3

Disassembly:
femms
inc eax
mov ebx, dword [0x4b6216]
test edx, ecx
jo 0x47f93f
ror esi, 0x11
inc eax
or ebx, dword [0x4b6540]
ror ebx, 1
mov dword [0x4b6370], esi
call fcn.00401d63
loop 0x47f8cb
mov esi, eax
and esi, edi
xor ebx, esp
dec esi
call fcn.0046f415
add eax, 0x62b27d6
xor ecx, 0x4e0111e
shr eax, 0xd
dec edx
shl edx, 0xd
mov esi, eax
not ecx
mov eax, eax
neg eax
ror edx, 0x13
xor esi, eax
sub eax, eax
mov eax, ecx
shr dword [ebx], 0xf0
shr esi, 0x10
mov edx, edx
xor edi, esi
mov eax, 0x6cf7093
add esi, 0xe651b26
and esi, edi
dec eax
and esi, edi
call fcn.00409cce
dec eax
xor esi, eax
not eax
sub edi, ebp
add edi, esi
dec esi
neg esi
dec esi
xor esi, eax
call fcn.004108d9
xor eax, 0x2458ba5
or ecx, dword [0x4b647c]
or esi, edi
push str.KERNEL32.dll
call fcn.00402d10
dec edi
sub esi, eax
xor esi, esi
xchg eax, esi
dec eax
sub esi, 0x149daedc
inc esi
rol esi, 0xe
xor esi, esi
ror ecx, 0x14
xor edi, 0xb615dc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
neg esi
Function at 0x47f98f
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
add ecx, eax
not edx
sub eax, esp
mov dword [0x4baf94], 0x5dd07ca
not edx
xor edi, eax
not esi
xor ebx, eax
mov dword [0x4baed8], ecx
rol edx, 0x11
sub esi, eax
or dword [0x4baf4e], 0x1167ce5
rol esi, 0xe
add esi, eax
add dword [0x4bafac], ebx
xchg edi, eax
ror esi, 0xa
mov dword [0x4baf38], ecx
rol eax, 0x1b
sub edi, esp
add edi, esp
ror eax, 0x1b
or dword [0x4baf01], ecx
rol esi, 0xa
xchg edi, eax
mov dword [0x4baf72], esi
sub esi, eax
ror esi, 0xe
into
push cs
or dword [0x4baf97], 0x5c6f682
add esi, eax
ror edx, 0x11
or dword [0x4baec3], ecx
xor ebx, eax
not esi
xor edi, eax
not edx
xor dword [0x4baebc], 0x143da44a
add eax, esp
not edx
sub ecx, eax
inc eax
neg esi
push 0
xor esi, 0x11768528
ror eax, 0x12
sub ebx, esp
mov dword [0x4bae67], ebx
xor esi, eax
mov dword [0x4bae9b], 0x1e7ee646
sub ecx, 0xd364758
call fcn.004033e3
rol edx, 0x18
add eax, esp
ror eax, 0x1c
inc eax
ror esi, 4
call fcn.0040744f
dec edx
neg ecx
neg ecx
inc edx
call fcn.00402d10
rol esi, 4
dec eax
rol eax, 0x1c
sub eax, esp
ror edx, 0x18
call fcn.00406132
add ecx, 0xd364758
mov dword [0x4baea0], 0x4be5096
xor esi, eax
mov dword [0x4bafc7], ebx
add ebx, esp
rol eax, 0x12
xor esi, 0x11768528
push 0x636f6c6c
xor eax, 0x6a4b78e
call fcn.00409cce
ror ebx, 0x19
xor esi, eax
sub edx, ecx
xor edx, ecx
call fcn.00403b97
inc eax
xchg ebx, esi
not ebx
xor esi, 0x765c624
neg edi
neg edi
xor esi, 0x765c624
not ebx
xchg ebx, esi
dec eax

Function at 0x47fad5
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0040394f
xor edx, ecx
add edx, ecx
xor esi, eax
rol ebx, 0x19
call fcn.0040815e
xor eax, 0x6a4b78e
push 0x416c6175
mov dword [0x4bae76], 0x26ffa5a0
sub dword [0x4baf75], ecx
xor edx, 0x1e904e53
xchg esi, eax
add edi, edx
mov dword [0x4bafe2], edi
xor edx, ecx
ror eax, 2
xor eax, 0x15ecb194
Function at 0x47fb1e
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0x4baefb], 0x105189b7
mov dword [0x4bae3e], 0x1434790c
xor eax, 0x15ecb194
adc eax, 0x3302c0c1
sal dword [ecx], 1
cmp eax, 0x4bae90
sub edi, edx
xchg esi, eax
xor edx, 0x1e904e53
xor dword [0x4baf92], edi
or dword [0x4bafb6], 0x596f9d
push 0x74726956
sub dword [0x4bafa8], edi
mov dword [0x4baf22], edx
xor esi, eax
xor esi, 0x96d6014
xor ebx, ebp
ror esi, 8
inc eax
mov dword [0x4bae56], ecx
inc eax
rol edx, 0xe
inc eax
xor esi, 0x1499868
neg esi
rol edx, 1
sub dword [0x4bafb8], esi
xor ecx, edi
inc esi
add dword [0x4bae49], edx
call fcn.00402265
sub dword [0x4bae9f], edx
add edx, 0x6d4586c
call fcn.00409cce
inc dword [ecx - 0x2ba79316]
push es
call fcn.0040792a
dec esi
xor ecx, edi
mov dword [0x4bae36], edi
ror edx, 1
neg esi
xor esi, 0x1499868
dec eax
ror edx, 0xe
dec eax
sub dword [0x4baf9b], ecx
dec eax
rol esi, 8
xor ebx, ebp
xor esi, 0x96d6014
xor esi, eax
sub dword [0x4baebb], ebx
push esp
mov dword [0x4baf3e], 0x4025158
ror edx, 2
and dword [0x4bae3a], edi
xor ebx, edi
rol esi, 0x1a
call fcn.0040744f
or dword [0x4baf80], 0x171b64f
xor ebx, esp
add esi, esp
sub esi, 0x1ef70c69
mov dword [0x4baf70], ebx
xor ecx, esi
mov dword [0x4baeae], 0x6076f90
xor edi, esp
rol eax, 4
xchg ecx, esi
mov dword [0x4bafdc], edx
mov dword [0x4bae3d], ebx
call fcn.0040744f
xor ecx, eax
call fcn.0040815e
xor ecx, eax
call fcn.00403f95
inc ebx
clc
dec dword [ecx + 0x4bae921d]
add byte [edi + 0x4c8c1f1], al
xor edi, esp
mov dword [0x4bafd0], 0x1be46b64
xor ecx, esi
add esi, 0x1ef70c69
sub esi, esp
xor ebx, esp
call fcn.00409cce
ror esi, 0x1a
xor ebx, edi
mov dword [0x4baeaa], ebx
rol edx, 2
or dword [0x4bafbb], 0x16bca02
push eax
sub edx, 0xd0221c
call fcn.0040108e
sub edi, esp
dec edx
call fcn.00403cf4
not edx
mov dword [0x4bae37], 0x4b89279
xor esi, 0x4ff79f7
sub edx, eax
mov dword [0x4baea2], esi
xor eax, ecx
xor eax, ecx
or dword [0x4baf2c], ebx
add edx, eax
xor esi, 0x4ff79f7
and dword [0x4bae90], 0x11389d58
not edx
call fcn.0040792a
inc edx
add edi, esp
add edx, 0xd0221c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
rol ecx, 0x1d
xor edx, 0xda02ac
call fcn.00402d10
mov dword [0x4bafc3], ecx
inc edx
xor eax, ebp
rol esi, 0xe
mov dword [0x4bafb8], 0x9565b72
xor esi, 0x1f24af1e
xor dword [0x4baee6], ecx
xor esi, 0x1f24af1e
sub dword [0x4baf08], 0x74f5568
ror esi, 0xe
xor eax, ebp
dec edx
or dword [0x4bae76], ebx
xor edx, 0xda02ac
ror ecx, 0x1d
add esp, 0x10
not esi
call fcn.00404f3c
Function at 0x47fb37
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0x4baefb], 0x105189b7
mov dword [0x4bae3e], 0x1434790c
xor eax, 0x15ecb194
adc eax, 0x3302c0c1
sal dword [ecx], 1
cmp eax, 0x4bae90
sub edi, edx
xchg esi, eax
xor edx, 0x1e904e53
xor dword [0x4baf92], edi
or dword [0x4bafb6], 0x596f9d
push 0x74726956
sub dword [0x4bafa8], edi
mov dword [0x4baf22], edx
xor esi, eax
xor esi, 0x96d6014
xor ebx, ebp
ror esi, 8
inc eax
mov dword [0x4bae56], ecx
inc eax
rol edx, 0xe
inc eax
xor esi, 0x1499868
neg esi
rol edx, 1
sub dword [0x4bafb8], esi
xor ecx, edi
inc esi
add dword [0x4bae49], edx
call fcn.00402265
sub dword [0x4bae9f], edx
add edx, 0x6d4586c
call fcn.00409cce
inc dword [ecx - 0x2ba79316]
push es
call fcn.0040792a
dec esi
xor ecx, edi
mov dword [0x4bae36], edi
ror edx, 1
neg esi
xor esi, 0x1499868
dec eax
ror edx, 0xe
dec eax
sub dword [0x4baf9b], ecx
dec eax
rol esi, 8
xor ebx, ebp
xor esi, 0x96d6014
xor esi, eax
sub dword [0x4baebb], ebx
push esp
mov dword [0x4baf3e], 0x4025158
ror edx, 2
and dword [0x4bae3a], edi
xor ebx, edi
rol esi, 0x1a
call fcn.0040744f
or dword [0x4baf80], 0x171b64f
xor ebx, esp
add esi, esp
sub esi, 0x1ef70c69
mov dword [0x4baf70], ebx
xor ecx, esi
mov dword [0x4baeae], 0x6076f90
xor edi, esp
rol eax, 4
xchg ecx, esi
mov dword [0x4bafdc], edx
mov dword [0x4bae3d], ebx
call fcn.0040744f
xor ecx, eax
call fcn.0040815e
xor ecx, eax
call fcn.00403f95
inc ebx
clc
dec dword [ecx + 0x4bae921d]
add byte [edi + 0x4c8c1f1], al
xor edi, esp
mov dword [0x4bafd0], 0x1be46b64
xor ecx, esi
add esi, 0x1ef70c69
sub esi, esp
xor ebx, esp
call fcn.00409cce
ror esi, 0x1a
xor ebx, edi
mov dword [0x4baeaa], ebx
rol edx, 2
or dword [0x4bafbb], 0x16bca02
push eax
sub edx, 0xd0221c
call fcn.0040108e
sub edi, esp
dec edx
call fcn.00403cf4
not edx
mov dword [0x4bae37], 0x4b89279
xor esi, 0x4ff79f7
sub edx, eax
mov dword [0x4baea2], esi
xor eax, ecx
xor eax, ecx
or dword [0x4baf2c], ebx
add edx, eax
xor esi, 0x4ff79f7
and dword [0x4bae90], 0x11389d58
not edx
call fcn.0040792a
inc edx
add edi, esp
add edx, 0xd0221c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
rol ecx, 0x1d
xor edx, 0xda02ac
call fcn.00402d10
mov dword [0x4bafc3], ecx
inc edx
xor eax, ebp
rol esi, 0xe
mov dword [0x4bafb8], 0x9565b72
xor esi, 0x1f24af1e
xor dword [0x4baee6], ecx
xor esi, 0x1f24af1e
sub dword [0x4baf08], 0x74f5568
ror esi, 0xe
xor eax, ebp
dec edx
or dword [0x4bae76], ebx
xor edx, 0xda02ac
ror ecx, 0x1d
add esp, 0x10
not esi
call fcn.00404f3c
Function at 0x47fbb6
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0x4baefb], 0x105189b7
mov dword [0x4bae3e], 0x1434790c
xor eax, 0x15ecb194
adc eax, 0x3302c0c1
sal dword [ecx], 1
cmp eax, 0x4bae90
sub edi, edx
xchg esi, eax
xor edx, 0x1e904e53
xor dword [0x4baf92], edi
or dword [0x4bafb6], 0x596f9d
push 0x74726956
sub dword [0x4bafa8], edi
mov dword [0x4baf22], edx
xor esi, eax
xor esi, 0x96d6014
xor ebx, ebp
ror esi, 8
inc eax
mov dword [0x4bae56], ecx
inc eax
rol edx, 0xe
inc eax
xor esi, 0x1499868
neg esi
rol edx, 1
sub dword [0x4bafb8], esi
xor ecx, edi
inc esi
add dword [0x4bae49], edx
call fcn.00402265
sub dword [0x4bae9f], edx
add edx, 0x6d4586c
call fcn.00409cce
inc dword [ecx - 0x2ba79316]
push es
call fcn.0040792a
dec esi
xor ecx, edi
mov dword [0x4bae36], edi
ror edx, 1
neg esi
xor esi, 0x1499868
dec eax
ror edx, 0xe
dec eax
sub dword [0x4baf9b], ecx
dec eax
rol esi, 8
xor ebx, ebp
xor esi, 0x96d6014
xor esi, eax
sub dword [0x4baebb], ebx
push esp
mov dword [0x4baf3e], 0x4025158
ror edx, 2
and dword [0x4bae3a], edi
xor ebx, edi
rol esi, 0x1a
call fcn.0040744f
or dword [0x4baf80], 0x171b64f
xor ebx, esp
add esi, esp
sub esi, 0x1ef70c69
mov dword [0x4baf70], ebx
xor ecx, esi
mov dword [0x4baeae], 0x6076f90
xor edi, esp
rol eax, 4
xchg ecx, esi
mov dword [0x4bafdc], edx
mov dword [0x4bae3d], ebx
call fcn.0040744f
xor ecx, eax
call fcn.0040815e
xor ecx, eax
call fcn.00403f95
inc ebx
clc
dec dword [ecx + 0x4bae921d]
add byte [edi + 0x4c8c1f1], al
xor edi, esp
mov dword [0x4bafd0], 0x1be46b64
xor ecx, esi
add esi, 0x1ef70c69
sub esi, esp
xor ebx, esp
call fcn.00409cce
ror esi, 0x1a
xor ebx, edi
mov dword [0x4baeaa], ebx
rol edx, 2
or dword [0x4bafbb], 0x16bca02
push eax
sub edx, 0xd0221c
call fcn.0040108e
sub edi, esp
dec edx
call fcn.00403cf4
not edx
mov dword [0x4bae37], 0x4b89279
xor esi, 0x4ff79f7
sub edx, eax
mov dword [0x4baea2], esi
xor eax, ecx
xor eax, ecx
or dword [0x4baf2c], ebx
add edx, eax
xor esi, 0x4ff79f7
and dword [0x4bae90], 0x11389d58
not edx
call fcn.0040792a
inc edx
add edi, esp
add edx, 0xd0221c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
rol ecx, 0x1d
xor edx, 0xda02ac
call fcn.00402d10
mov dword [0x4bafc3], ecx
inc edx
xor eax, ebp
rol esi, 0xe
mov dword [0x4bafb8], 0x9565b72
xor esi, 0x1f24af1e
xor dword [0x4baee6], ecx
xor esi, 0x1f24af1e
sub dword [0x4baf08], 0x74f5568
ror esi, 0xe
xor eax, ebp
dec edx
or dword [0x4bae76], ebx
xor edx, 0xda02ac
ror ecx, 0x1d
add esp, 0x10
not esi
call fcn.00404f3c

Function at 0x47fc5c
Capabilities:
Hash data using murmur3

Disassembly:
inc ebx
clc
dec dword [ecx + 0x4bae921d]
add byte [edi + 0x4c8c1f1], al
Function at 0x47fd5e
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, eax
neg ecx
inc esi
rol esi, 0x1c
add esi, eax
call fcn.004075a6
dec eax
call fcn.00409cce
xchg edx, esi
neg esi
dec esi
mov dword [0x4baf00], ecx
xchg esi, eax
neg eax
neg eax
xchg esi, eax
or dword [0x4baebd], edx
inc esi
neg esi
xchg edx, esi
call fcn.00409cce
inc eax
call fcn.00402d10
sub esi, eax
ror esi, 0x1c
dec esi
neg ecx
xor esi, eax
call fcn.0040744f
not esi
push 0x40
xor dword [0x4bae6a], 0xbd096d2
sub esi, 0x1a911c0
xor dword [0x4baef0], 0x449e575
xchg esi, eax
neg eax
rol eax, 3
not eax
call fcn.00404f3c
or dword [0x4baf90], 0x2182d031
xor ebx, ecx
rol edx, 0xf
xor esi, eax
xor dword [0x4bae44], esi
rol ebx, 0x19
xor esi, eax
neg edx
xor ecx, 0x2900f96a
call fcn.00406711
rol edx, 1
ror edx, 1
call fcn.0040349f
xor ecx, 0x2900f96a
neg edx
xor esi, eax
ror ebx, 0x19
xor esi, eax
ror edx, 0xf
xor ebx, ecx
call fcn.00409cce
not eax
ror eax, 3
neg eax
xchg esi, eax
add esi, 0x1a911c0
mov dword [0x4baef6], 0x1f6d115c
push 0x3000
add dword [0x4baf70], 0x1ec660d8
rol esi, 0x19
sub eax, ecx
inc eax
sub dword [0x4baf56], ebx
inc eax
xor ebx, esi
sub edx, eax
xor edx, ecx
sub edi, esp
xor edx, 0x1976879a
dec esi
inc esi
xor edx, 0x1976879a
add edi, esp
xor edx, ecx
add edx, eax
xor ebx, esi
dec eax
mov dword [0x4baf42], edi
dec eax
add eax, ecx
ror esi, 0x19
and dword [0x4bae82], 0x29128770
push 0x692
xor eax, 0x922f9da
xchg ebx, eax
inc eax
neg edx
ror ecx, 0xd
dec esi
call fcn.00406132
inc eax
call fcn.00402d10
not esi
dec edi
sub eax, ebx
add edi, 0xfd164a6
xor ebx, edi

Function at 0x483ed4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483edf

Function at 0x48425e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00484269

Function at 0x4859d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004859e2
Function at 0x402b74
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x497008], 0x8088405
inc edx
mov dword [ebx + 0x497008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402fcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x497024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403064
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403044
xor eax, eax
push ebp
push 0x40303d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403080
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403044
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x497024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x497024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d28
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49a048], 0
je 0x403d89
cmp word [0x49a21c], 0xd7b2
jne 0x403d51
cmp dword [0x49a224], 0
jbe 0x403d51
mov eax, 0x49a218
call dword [0x49a234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x497070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403db0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x497034], 0
jne 0x403da5
push 0
push 0x497068
push 0x497070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405abe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404114
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b90
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405aa8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ac5
lea eax, [ebp - 0x10]
call fcn.00403ea4
ret

Function at 0x40adcc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae05
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f94
jmp 0x40ae0e
mov eax, ebx
mov edx, esi
call fcn.00403ef8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ae18
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae39
mov al, byte [esp]
jmp 0x40ae3b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b4c0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b338
mov eax, dword [0x498f98]
cmp byte [eax], 0
je 0x40b53c
mov eax, dword [0x498da4]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408504
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b584
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b572
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x498d4c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x49a664]
call fcn.00404f6c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bdd8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40beae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f3c
lea eax, [ebp - 8]
call fcn.004043b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404364
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40be98
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40be91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404364
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40be7b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bec0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40be7b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be98
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40beb5
lea eax, [ebp - 8]
call fcn.00403ea4
ret

Function at 0x40c3c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c424
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404114
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407fa0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c42b
lea eax, [ebp - 0xc]
call fcn.00403ea4
ret

Function at 0x41a878
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49a884
cmp dword [edi], 0
jne 0x41a8f4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x49a880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x497470
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a850
lea eax, [esi + 5]
call fcn.0041a870
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a870
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a8c9
mov dword [0x49a880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41be68
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41be6e
ret
Function at 0x41e510
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e561
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e548
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e538
jmp 0x41e561
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e549
pop ebx
mov esp, ebp
pop ebp
ret