joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576df0
Capabilities:
Encode data using xor

Disassembly:
add esp, edx
test byte [ebx], 0x1c
outsb dx, byte [esi]
scasb al, byte es:[edi]
add edi, dword [ecx + 0x64]
test dword [0xd3db1e0f], ebp
xor al, 0xff
ja 0x576df5
jno 0x576e1a
and dword [esi - 0x70], esi
add al, 0x68
adc dword [edx], edx
add al, 0x4c
salc
mov ebp, dword [esi - 0x59]
lea edx, [0x8aa9ca90]
push esp
mov cs, eax
mov dl, 0xb4
pop eax
dec ebp
adc esi, edi
pop edi
mov edi, 0xb662c6ef
mov bl, 0xe6
cmp al, byte [ecx + 0x65]
and ebx, dword [esi - 0x5a9ae557]
nop
jbe 0x576e20
or dword [eax + ebp*2 - 0x1a], esi
cmp ch, byte [ecx + 0x4efa57e4]
fild word ds:[eax]
push edx
call [edi + 0x450122d1]
mov ah, 0x58
invalid

Function at 0x57a313
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
rcr byte [eax], 1
test al, 0xbd
and al, 0xdb
xchg esp, eax
aas
add dword [0x3cfa737d], esi
movsb byte es:[edi], byte [esi]
push edi
inc ebp
xchg ebx, eax
xor dh, byte [esi + eax*2]
push edi
cmp al, 4
inc esi
sbb al, 0xf4
aad 0x54
push edx
loop 0x57a318
push ss
xor bl, ch
cmpsd dword [esi], dword es:[edi]
adc al, 0xe1
arpl word [ecx + 0x7fa5041a], ax
leave
test ebx, edx
js 0x57a36a
arpl di, dx
jge 0x57a365
cmp ebx, edi
xlatb
clc
or al, 0xa8
arpl word [ebp + 0x1ec4ea25], si
mov cl, 0xe0
push edi
rcl byte [edx + edi], cl
arpl word [edi], bp
mov esi, 0x25e0e68f
jmp 0x57a39e
lea edx, [edi + eax*2 + 0x49e80946]
inc ebx
push cs
xor byte [ebx - 0x21], dl
stosd dword es:[edi], eax
dec byte [0xc4fc8e55]
push cs
call 0x3065e6b8
push ebx
fild qword [ebx - 0x71aaf202]
cld
les ecx, [esi]
push ebx
mov al, byte [0x4ef7506e]
dec edi
invalid
std
inc ecx
inc edx
inc ecx
xchg ebp, eax
scasd eax, dword es:[edi]
invalid

Function at 0x57a810
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4344f671
loop 0x57a876
push ds
jl 0x57a84e
stosb byte es:[edi], al
jecxz 0x57a844
or edx, dword [edi + 0x44a2e965]
stosd dword es:[edi], eax
xchg ebx, eax
add eax, 0xd7d75e06
sub dl, byte [ecx]
xor eax, 0x59dcb036
std
mov edx, 0xb035cb52
mov ecx, 0x5b5a9de5
out dx, al
adc eax, 0xe0ebba87
mov word [ecx - 5], ss
pop eax
xchg edi, eax
push esp
into
xor al, byte [edi]
xchg esi, eax
push ss
xor eax, ebp
sub byte [ebp + ecx*2 - 0x6d], bh
inc ebp
or ch, dh
invalid
sbb ah, al
pop ecx
test byte [esi - 0x3acfa9d9], 0xb6
push ss
xchg esi, eax
mov dword [ebx + edx*4 + 0x2a], edi
pop esi
sti
inc ebx
jo 0x57a819
je 0x57a88f
invalid
xchg ebx, eax
iretd
Function at 0x588244
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0xffffffffffffffc4
cmp al, 0x65
xor eax, 0xce006f92
invalid

Function at 0x58bcd7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushfd
sbb dl, byte [edi]
xchg dword [ebx - 0x39], edx
pop es
mov edi, dword [ebx - 0x74]
stosb byte es:[edi], al
les esi, [edi]
mov edi, dword [edx]
retf
jo 0x58bcd1
je 0x58bc15
jecxz 0x58bce7
mov ecx, 0x2b360e4e
dec ebx
sub ecx, dword [edi]
push edx
wait
sbb dl, byte [eax - 0x38724237]
add dword [edx - 0x137e2ae5], 0x515ab996
cdq
jecxz 0x58bd33
jne 0x58bcdb
adc byte [ecx], 0x47
insb byte es:[edi], dx
adc dword [edi + 0x6c], eax
cmc
pushfd
jnp 0x58bc8b
pop edx
retf
hlt
popfd
adc ebp, 0x40

Function at 0x58f133
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x896bcf0e
sbb eax, 0x96a49c16
sbb ebx, dword [edx - 0x2e41d1e]
push 0x3b
xchg edi, eax
inc eax
into
add eax, 0x37e35168
jbe 0x58f096
test al, dl
push edx
sub dl, cl
aam 0x4e
aaa
or byte [ecx - 0x18], bl
out 0x4c, eax
ror byte [ebp + 0xc], cl
rol dword [ebp + 0x3a], 0x33
push 0xc8bba309
jp 0x58f0fe
fmulp st(0)
imul eax, ecx, 0x9f5f9d13
jno 0x58f07a
xchg edx, eax
sub al, byte [edi - 0xe7d13a8]
xor dword [esp + ebx*4 - 0x1443d29d], esi
adc ecx, ebx
daa
mov bl, byte [ecx + 0x66]
fsubr qword [ebx + 0x514f333c]
mov byte [esi + 0x7cddab1f], ch
ret
and edi, ebp
adc cl, al
test byte [ebx], bh
or al, 0x28
pop ecx
cld
stosb byte es:[edi], al
or al, 0xf4
sub ebp, edx
xchg byte [0xf34fa6b7], bh
in al, dx
js 0x58f0ca
mov esi, 0x361046f1
mov byte [0x7df0219d], al
sub al, 0x4e
jecxz 0x58f183
fnstsw word cs:[eax - 0xc]
jae 0x58f177
idiv byte [edi]
push 0xa8c7101d
or byte [ebp - 0x4e], dl
mov dl, 0xed
loopne 0x58f1a9
popal
fimul dword [ecx]
mov dh, 0x30
insd dword es:[edi], dx
and eax, 0x111ee3be
xor esi, edi
in eax, dx
xor byte [ebp + 0x25], ch
mov esi, 0x33111ee3
imul ebp
jne 0x58f13b
or byte [esi], bh
dec ecx
or dword [edi + eax + 0x1e], 0xffffffb2
dec esi
push ds
mov dl, 0x4e
xchg esp, eax
pushfd
lodsd eax, dword [esi]
fnstenv [ebx]
jae 0x58f156
pop es
test dword [edi + 0x4f], 0xae9f8764
push ds
sal byte [ebx + 0x5ab9165e], 1
insb byte es:[edi], dx
dec eax
aas
std
mov bh, 0x4c
sal dl, 0xe4
inc esi
jg 0x58f14d
movsd dword es:[edi], dword [esi]
inc edx
push cs
lea esi, [eax - 0x74]
stc
sbb edi, dword [ebx - 0x17b8ef88]
mov byte [ebp - 0x3e45eb32], bl
test eax, 0xf5cb1d36
push esi
shr dword [ecx - 0xa34e2ca], 0x56
insb byte es:[edi], dx
xchg byte [ebx - 0x2932e987], bl
mov ch, 0x2d
invalid
dec esp
push ds
pop ss
mov al, byte [0x5850767]
xor ebx, esp
stosd dword es:[edi], eax
insb byte es:[edi], dx
jle 0x58f1b6
jmp dword [esi - 0x46a36584]
cmpsb byte [esi], byte es:[edi]
jl 0x58f154
pop esp
mov ecx, 0x4952fe85
rol byte [ecx - 0x6a13359b], 0x6c
push eax
invalid
Function at 0x58f868
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xfad8fb47
jne 0x58f810
test dword [ebx - 0x6a], eax
in eax, dx
and eax, 0x99ca0dfa
aaa
fidiv dword [esi]
mov bl, 0xa3
adc ah, byte [edx - 0x10]
inc edx
fidivr word [edx + 0x25]
movsd dword es:[edi], dword [esi]
ffreep st(7)
inc dword [eax + edi]
nop
mov cl, 0x60
mov esp, 0x5fbc391e
fmul st(0), st(0)
push ds
cmp dword [edi + ebx*2 + 0x11dec8dc], edi
ficom word [ecx]
pop es
int 0x48
test dword [ecx + 0x1996c273], eax
cmp ebx, dword [ebx - 0x39]
jnp 0x58f836
inc ebx
xor bl, ch
xchg esp, eax
lcall 0xd372, 0x594edce4
pop esi
fcom dword [edx + 0x71]
into
jle 0x58f857
cmp dh, ah
pop ebp
jo 0x58f8e9
retf
jecxz 0x58f87d
push edi
cmp dl, ch
cmp eax, 0xda445c7
cwde
sub ecx, ebx
dec ecx
dec ecx
ja 0x58f8f7
clc
xor al, 0x4a
mov dh, 0x99
sbb ah, byte [ebx - 0x1bc9cc4f]
push eax
xchg ecx, eax
or ah, byte [esi]
mov byte [0xf0017e48], al
Function at 0x68d83f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xor ecx, ecx
lea ebx, [ebp]
mov word [ebx + 0x200], 0
add ebx, 2
mov word [ebx + 0x200], 0
add ebx, 2
mov word [ebx + 0x200], 0
add ebx, 2
mov word [ebx + 0x200], 0
add ebx, 2
add ecx, 8
cmp ecx, 0x100
jl 0x68d844
xor ecx, ecx
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov byte [ebx], cl
inc cx
cmp cx, 0x100
jl 0x68d881
xor ecx, ecx
xor edx, edx
and edx, 0xff
mov ebx, edx
add ebx, ebp
add dl, byte [ebx + 0x200]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
add dl, byte [ebx]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov al, byte [ebx]
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov ah, byte [ebx]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov byte [ebx], ah
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov byte [ebx], al
inc cx
cmp cx, 0x100
jl 0x68d89a
xor edi, edi
add cl, 1
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
add dl, byte [ebx]
mov al, byte [ebx]
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov ah, byte [ebx]
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov byte [ebx], ah
and edx, 0xff
mov ebx, edx
add ebx, ebp
mov byte [ebx], al
and ecx, 0xff
mov ebx, ecx
add ebx, ebp
mov al, byte [ebx]
and edx, 0xff
mov ebx, edx
add ebx, ebp
add al, byte [ebx]
and eax, 0xff
mov ebx, eax
add ebx, ebp
mov ch, byte [ebx]
xor ch, byte [esi + edi]
mov byte [esi + edi], ch
inc edi
cmp edi, dword [ebp + 0x108]
jne 0x68d8f1
ret
Function at 0x402b08
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404348
test esi, esi
jne 0x402b3e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404438
jmp 0x402b5c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a1c
mov edi, eax
test esi, esi
je 0x402b5c
cmp dword [ebx], 0
je 0x402b5c
dec esi
jmp 0x402b45
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e14
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f5008], 0x8088405
inc edx
mov dword [ebx + 0x4f5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f5024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40337c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40335c
xor eax, eax
push ebp
push 0x403355
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403398
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40335c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4f5024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f5024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404128
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f804c], 0
je 0x404189
cmp word [0x4f8220], 0xd7b2
jne 0x404151
cmp dword [0x4f8228], 0
jbe 0x404151
mov eax, 0x4f821c
call dword [0x4f8238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4f5070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041b0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4f5034], 0
jne 0x4041a5
push 0
push 0x4f5068
push 0x4f5070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4042fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027e0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4f804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4042c4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406720
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406786
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004045b8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e9c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406770
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40678d
lea eax, [ebp - 0x10]
call fcn.00404348
ret

Function at 0x409704
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x409735
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40973c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x40976d
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x409854
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40987a
test byte [ebp - 0xc], 0x10
jne 0x40987e
xor eax, eax
jmp 0x409880
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x409af8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x409b20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404808
push eax
mov eax, dword [ebp - 4]
call fcn.00404808
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x409db8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404808
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x40d258
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x40d2a0
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.00404438
jmp 0x40d2ab
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040439c
mov esp, ebp
pop ebp
ret 4

Function at 0x40d2b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d2e2
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x40d2e8
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret

Function at 0x40da70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x400
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040d8b8
mov eax, dword [0x4f7d1c]
cmp byte [eax], 0
je 0x40db03
mov eax, dword [0x4f7910]
call fcn.00402c44
call fcn.00402948
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
call fcn.00409de4
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40db48
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40db39
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x4f7874]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4f8668]
call fcn.00405c18
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov esp, ebp
pop ebp
ret
Function at 0x40e59c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40e67a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004043e0
lea eax, [ebp - 0xc]
call fcn.00404858
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404808
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40e664
mov eax, dword [ebp - 0x10]
call fcn.004027e0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x40e65d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404808
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40e647
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40e688
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e647
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e664
mov eax, dword [ebp - 0x18]
call fcn.00402800
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e681
lea eax, [ebp - 0xc]
call fcn.00404348
ret

Function at 0x40ee80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40eeea
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.004045b8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409390
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eef1
lea eax, [ebp - 0x14]
call fcn.00404348
ret
Function at 0x40f7c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x4f795c]
cmp dword [eax], 0
je 0x40f7fb
push 0xa
push 0x40f854
mov eax, dword [0x4f795c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x4f795c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
jmp 0x40f84d
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4f7db4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f84d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0xa
push 0x40f854
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f84d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40f810
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4232e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceA
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x42331a
push ebp
call fcn.00423274
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x423340
push ebp
call fcn.00423274
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00422c78
mov esp, ebp
pop ebp
ret 4

Function at 0x4272e8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x427335
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004270bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42734d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x427354
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setge dl
mov eax, dword [ebp - 4]
call fcn.004270bc
cmp dword [ebp - 8], 1
jne 0x427388
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
pop ecx
pop ecx
pop ebp
ret

Function at 0x428c24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x4f888c], 0
jne 0x428cd1
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [0x4f8888]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x4f56d0
mov ecx, 2
call fcn.004029dc
mov edx, 0x428be0
mov eax, dword [ebp - 8]
add eax, 5
call fcn.00428c00
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.00428c00
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x4f888c]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4f888c], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x428c8b
mov eax, dword [ebp - 8]
mov dword [0x4f8888], eax
mov eax, dword [0x4f888c]
mov dword [ebp - 4], eax
mov eax, dword [0x4f888c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x4f888c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x42a374
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42a37a
ret

Function at 0x42d20c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42d25d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42d244
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x42d234
jmp 0x42d25d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42d245
pop ebx
mov esp, ebp
pop ebp
ret