joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x4047b4
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.0040337c
push eax
push ebx
call fcn.00403940
test eax, eax
jne 0x4047b4
cmp dword [esp + 4], 4
je 0x4047b9
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x4047c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.0040337c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call fcn.00403940
test eax, eax
sete al
pop ebp
ret

Function at 0x404950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x40497d
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040337c
push eax
push ebx
call fcn.00403940
test eax, eax
je 0x404981
xor eax, eax
jmp 0x404983
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x404a00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404ac0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00409a08
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call fcn.00403938
test eax, eax
jne 0x404aaa
cmp dword [ebp - 8], 0
jbe 0x404aa8
mov eax, dword [ebp - 8]
inc eax
call fcn.00402438
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404a86
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403128
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004099f8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call fcn.00403920
cmp eax, 0x103
jne 0x404a69
mov eax, ebx
call fcn.00402458
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ac7
lea eax, [ebp - 0x10]
call fcn.00402ff8
ret
Function at 0x404ad0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404b90
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00409a08
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call fcn.00403938
test eax, eax
jne 0x404b7a
cmp dword [ebp - 8], 0
jbe 0x404b78
mov eax, dword [ebp - 8]
inc eax
call fcn.00402438
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404b56
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403128
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004099f8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call fcn.00403928
cmp eax, 0x103
jne 0x404b39
mov eax, ebx
call fcn.00402458
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b97
lea eax, [ebp - 0x10]
call fcn.00402ff8
ret
Function at 0x40669c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4067ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x10
test esi, esi
jne 0x4066d9
or ebx, 0x8000000
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00402610
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], si
mov dword [ebp - 0x28], 1
cmp dword [ebp + 8], 0
je 0x406707
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor esi, esi
cmp dword [ebp - 8], 0
je 0x406719
mov eax, dword [ebp - 8]
call fcn.0040337c
mov esi, eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00403090
mov edx, dword [ebp - 0x10]
mov eax, 0x40681c
call fcn.0040345c
test eax, eax
jle 0x406760
mov edx, dword [ebp - 0x10]
mov eax, 0x406828
call fcn.0040345c
test eax, eax
jg 0x406760
push 0x406828
push dword [ebp - 0x10]
push 0x406828
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040323c
cmp dword [ebp - 0x10], 0
je 0x406777
test edi, edi
je 0x406777
lea eax, [ebp - 0x10]
mov edx, 0x40681c
call fcn.00403184
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push 0
push ebx
push 0
push 0
push 0
lea eax, [ebp - 0x68]
mov ecx, edi
mov edx, dword [ebp - 0x10]
call fcn.004031c8
mov eax, dword [ebp - 0x68]
call fcn.0040337c
push eax
push 0
call fcn.00403970
test eax, eax
je 0x4067e1
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x64]
push eax
call fcn.004039f8
test eax, eax
jne 0x4067ca
mov eax, dword [ebp - 0x64]
push eax
call fcn.00403950
mov byte [ebp - 9], 1
jmp 0x4067d8
cmp dword [ebp + 8], 0
je 0x4067d8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
mov eax, dword [ebp - 0x60]
push eax
call fcn.00403950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406806
lea eax, [ebp - 0x68]
call fcn.00402ff8
lea eax, [ebp - 0x10]
call fcn.00402ff8
ret

Function at 0x407958
Capabilities:
Get file attributes

Disassembly:
call fcn.00403e98
push eax
call fcn.00403998
inc eax
je 0x40796c
dec eax
and al, 0x10
sete al
ret

Function at 0x408cf4
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x408d00
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x408d1c
push eax
je 0x408d1d
call dword [0x41b12c]
pop eax
push 5
push dword [eax + 0x28]
call fcn.00403c80
ret
mov byte [eax + 0x177], dl
push 0
push ecx
call fcn.00403c80
pop eax
call dword [0x41b12c]
ret
Function at 0x413d84
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040336c
xor eax, eax
push ebp
push 0x413e9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040337c
mov esi, eax
push esi
call fcn.00403a08
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x413e77
mov eax, dword [ebp - 8]
call fcn.004078d8
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call fcn.00403a00
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x413ea8
push ebx
call fcn.00403a10
push 0x413ecc
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov edx, 4
call fcn.004076c8
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00403ca8
movzx eax, ax
lea ecx, [ebp - 0x20]
mov edx, 4
call fcn.004076c8
push dword [ebp - 0x20]
push 0x413ee8
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040323c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040337c
push eax
push ebx
call fcn.00403a10
test eax, eax
je 0x413e6d
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00403128
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00402458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413ea1
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040301c
lea eax, [ebp - 4]
call fcn.00402ff8
ret

Function at 0x41403c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040336c
xor eax, eax
push ebp
push 0x414176
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040304c
lea eax, [ebp - 0x110]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004033d4
mov eax, dword [ebp - 0x110]
mov edx, 0x41418c
call fcn.004032c8
jne 0x414148
lea ecx, [ebp - 0x114]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00407848
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
call fcn.00403090
lea ecx, [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x414198
call fcn.00404388
mov eax, dword [ebp - 4]
call fcn.0040779c
neg eax
mov dword [ebp - 8], eax
mov eax, 0x105
call fcn.004078d8
mov ebx, eax
push 0x104
push ebx
mov eax, dword [ebp - 0xc]
call fcn.0040337c
push eax
call fcn.00403978
push ebx
call fcn.004039d8
mov esi, eax
push 0xfe
lea eax, [ebp - 0x10b]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call fcn.00403c00
push esi
call fcn.00403980
mov eax, ebx
call fcn.00402458
mov eax, edi
lea edx, [ebp - 0x10b]
mov ecx, 0xff
call fcn.00403164
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41417d
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040301c
lea eax, [ebp - 0xc]
call fcn.00402ff8
lea eax, [ebp - 4]
call fcn.00402ff8
ret
Function at 0x41ab50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040336c
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x41acc1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0040a5e8
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.0040a608
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x41ac93
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00403164
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040798c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407820
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, 0x41acd8
call fcn.00407820
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004032c8
je 0x41ac6f
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00403164
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407820
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00407820
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004032c8
jne 0x41ac84
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call fcn.004039e0
push eax
call fcn.004039f0
mov edx, esi
mov eax, ebx
call fcn.0040a628
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x41abce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41acc8
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040301c
lea eax, [ebp - 4]
call fcn.00402ff8
ret
Function at 0x11bc85a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0145c86b
adc si, 0xebf2
cmc
mov esi, dword [eax + 0x3c]
ror dx, 7
sal dx, 0xe
add esi, eax
sar dl, cl
neg edx
shr dh, 2
mov edx, dword [esi + 0x78]
stc
test dh, ah
test edx, edx
call fcn.011bd41a
push 0x42917a77
clc
jmp 0x2088101
mov ah, dl
push 0x8dc006b
lahf
lea edi, [edi + 1]
mov byte [esp], 0xbf
mov eax, dword [esp + 8]
pushfd
pushal
jmp 0x11c3b5c
push esi
lea esp, [esp + 0x34]
ja 0x11c1376
jmp 0x11ba3ac
bt bp, 1
cmp al, byte [edi]
jmp 0x11c0472

Function at 0x145feef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x44]
je 0x145ec7f
bsf si, si
sal si, 6
mov esi, dword [eax + 0x3c]
and dx, dx
lea edx, [ebp*2 - 0x59e8dad0]
add esi, eax
mov dl, 0xad
lea edx, [ebx - 0x28c9e39b]
setno dl
clc
mov edx, dword [esi + 0x78]
bt bp, 9
pushal
bt edx, esi
test edx, edx
pushfd
mov byte [esp + 4], 0xf1
lea esp, [esp + 0x24]
je 0x145ec7f
bswap ecx
lea ecx, [ecx*4 - 0x68a97716]
stc
bt eax, edx
add edx, eax
push ebx
not cl
mov ecx, dword [esi + 0x7c]
bt esp, 6
mov word [esp], 0xabc
add ecx, edx
test edi, esi
stc
push ebp
clc
mov dword [ebp - 0x10], ecx
rol ch, 3
setl ch
sbb ecx, edi
mov ecx, dword [ebp + 0xc]
test al, 0xed
stc
cmp sp, ax
cmc
cmp ecx, 0xffff
push edi
push dword [esp + 4]
jmp 0x1461c7c
pop ss
nop
scasd eax, dword es:[edi]
mov ah, 0x27
daa
invalid
lea esp, [esp + 0x10]
jbe 0x145aacd
cmp cl, bl
bt dx, si
mov edi, dword [edx + 0x24]
bt esi, 0x14
add edi, eax
shrd bx, di, cl
movsx ecx, al
mov ebx, dword [edx + 0x20]
cmc
add ebx, eax
lea ecx, [ebx + 0x71a74f49]
mov dword [ebp - 8], 0
cmc
adc ecx, ebx
mov ecx, dword [edx + 0x18]
stc
clc
bt si, di
cmp ecx, dword [ebp - 8]
call fcn.02087d72
jnp 0x1461c5a
and dword cs:[eax - 0x66], esi
int1
and ebp, dword [ebx + 0x3d]
add esp, ebp
jecxz 0x1461c56
cmovs ebp, dword [edi - 0x29c709c1]
ret
Function at 0x403104
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40da73
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ad0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406aac
mov edi, eax
cmp edi, 0x104
jbe 0x40da96
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da98
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406aac
push edi
push esi
call fcn.00406b44
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40dad1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40dabb
mov eax, esp
cmp esi, eax
je 0x40dade
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40db18
cmp bl, 0
je 0x40db14
cmp bl, 0x41
jl 0x40db0f
cmp bl, 0x5a
jg 0x40db0f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40daf3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da58

Function at 0x40f9fc
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd98
mov eax, esi
mov edx, 8
test al, 1
je 0x40fa18
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fa1a
shr eax, 1
dec edx
jne 0x40fa0b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40fa04
pop esi
ret

Function at 0x40fa47
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd94], 0
jne 0x40fa53
call fcn.0040f9fc
push 1
push 0x41cd94
call fcn.00406958
mov eax, edi
test esi, esi
je 0x40fa7e
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40fa59
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x405d6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405dd2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404120
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b30
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405dbc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405dd9
lea eax, [ebp - 0x10]
call fcn.00403eb0
ret

Function at 0x40874c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404370
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408765
test al, 0x10
jne 0x408769
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b404
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]

Function at 0x40b450
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b471
mov al, byte [esp]
jmp 0x40b473
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40baf8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b970
mov eax, dword [0x467894]
cmp byte [eax], 0
je 0x40bb74
mov eax, dword [0x4675a0]
call fcn.0040299c
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408b70
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bbbc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bbaa
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46752c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x468664]
call fcn.00405280
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c410
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c4e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f48
lea eax, [ebp - 8]
call fcn.004043c0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404370
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c4d0
mov eax, ebx
call fcn.004026cc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c4c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404370
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c4b3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c4f8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c4b3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4d0
mov eax, dword [ebp - 0x10]
call fcn.004026ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4ed
lea eax, [ebp - 8]
call fcn.00403eb0
ret

Function at 0x40ca10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40ca74
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404120
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408398
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ca7b
lea eax, [ebp - 0xc]
call fcn.00403eb0
ret

Function at 0x41ad68
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x41adb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0041aba8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41adcd
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x41add4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041aba8
dec esi
jne 0x41adf6
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x41bf4c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x468888
cmp dword [edi], 0
jne 0x41bfc8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x468884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4663ec
mov ecx, 2
call fcn.004028c8
mov edx, 0x41bf24
lea eax, [esi + 5]
call fcn.0041bf44
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041bf44
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41bf9d
mov dword [0x468884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d1e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d1ea
ret

Function at 0x41f664
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41f6b5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41f69c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41f68c
jmp 0x41f6b5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41f69d
pop ebx
mov esp, ebp
pop ebp
ret