joyce8/EMBER2024-capa huggingface dataset:
Function at 0x951f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x9669fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x952002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00955dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x952002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0094d6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0095620b
push 0x10
call fcn.009561d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x951fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.009421c0
jmp 0x951fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00951b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x951ff0
mov ecx, edi
call fcn.009422c0
push edi
call fcn.009561c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x952021
inc ebx
cmp ebx, 0x20
jb 0x951f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x953250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x967808
push 0x957288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x953329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x953329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.009561d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x953329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x953329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x95332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00953351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x953d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x953d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x953d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x953d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x953d94
push eax
push esi
call fcn.0095620b
add esp, 8
pop esi
ret 0x10

Function at 0x953da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x953e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x953e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x96c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00955dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x953dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x953e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x953ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x953eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x96c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00955dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x953eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x953e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x954000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x954131
push esi
call fcn.00957145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00946080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x954131
push 0
push ebp
call fcn.009463a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00946260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x95408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009462f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x954121
push 0x96c918
push edi
call fcn.009553f0
push eax
push ebx
push esi
call fcn.00953f60
push 0x96c8f8
push edi
call fcn.009553f0
push eax
push ebx
push esi
call fcn.00953f60
push 0x96c8d8
push edi
call fcn.009553f0
push eax
push ebx
push esi
call fcn.00953f60
push 0x96c8c0
push edi
call fcn.009553f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00953f60
push 0x96c8a0
push edi
call fcn.009553f0
push eax
push ebx
push esi
call fcn.00953f60
push 0x96c888
push edi
call fcn.009553f0
push eax
push ebx
push esi
call fcn.00953f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9551b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00955140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00955140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00955140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00955140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x955bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x955c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x96787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x955c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x955c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x710c68
Capabilities:
Encode data using xor

Disassembly:
push 0x7109e9
mov edx, dword [esp]
add esp, 4
sub esi, 0x824ea592
dec esi
sub esi, 0xbcd27252
call fcn.00710cb1
sub esi, esi
inc eax
xor dword [edi], edx
mov esi, eax
push 0x775fa7ef
mov esi, dword [esp]
add esp, 4
inc edi
sub eax, 0xe734d12d
mov esi, 0xc3472637
cmp edi, ecx
jne fcn.00710c68
and esi, esi
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4030dc
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x5d3ccf74
mov esi, 0x6490c6a9
xor esi, edi
mov edx, 0x200100c
mov edi, 0x10b20101
xor edx, edi
xor edx, esi
mov edi, 0x2240c000
mov eax, 0x91e0950
xor edi, eax
xor edx, edi
mov ecx, edx
add esp, 0xfffffffc
mov dword [esp], ecx
pop ebx
add ebx, 0xffffffbf
add ebx, 0xffffffff
mov esi, dword [ebx + 0x42]
xor eax, eax
add eax, esi
mov edi, eax
add edi, 0xffffffff
mov edx, dword [edi + 1]
mov edi, 0x6e017aa4
xor edi, 0x1aceaea1
push 0x7e704acd
mov esi, 0x14f3eade
pop eax
xor esi, eax
xor esi, edi
xor edx, esi
push edx
pop eax
mov edi, 0x9e1123a8
xor eax, edi
xor eax, 0x61eedc57
and eax, 0x6740c282
and edx, 0x98bf3d7d
loop 0x4031d3
cmp eax, 0xc20998bf
pop esi
add esp, 0xfffffffc
mov edi, esp
mov dword [edi], esi
pop edx
add esp, 0xfffffffc
mov dword [esp], edx
mov eax, esi
push eax
pop edi
push 0xc3ec7d05
mov eax, 0x3c1382fa
pop ecx
xor eax, ecx
xor edi, eax
and edi, 0x291fb12c
and esi, 0xd6e04ed3
or esi, edi
invalid
xor edi, esi
mov esi, 0x6e5d5810
mov ecx, 0x2f49da19
xor ecx, esi
mov esi, 0x52fb989a
mov ebx, 0x52f3c8dc
xor ebx, esi
xor ecx, ebx
mov esi, ecx
add esp, 0xfffffffc
mov dword [esp], esi
mov edx, 0x1b53a13
xor edx, 0x1d7394ab
mov ebx, edx
xor ebx, 0xffffffff
and ebx, 0x5d9aada3
and edx, 0xa265525c
or edx, ebx
pop eax
xor edx, eax
mov ebx, edx
sub ebx, 0xfffffff8
dec ebx
mov edx, dword [ebx - 7]
and edi, 0xff0
mov ebx, 0x37e22f3c
mov ecx, 0x44576b29
xor ecx, ebx
mov eax, 0x524cf9e7
xor ecx, eax
xor edi, ecx
push 0x68b0d398
mov ebx, 0x28bc990a
pop eax
xor ebx, eax
xor edi, ebx
mov eax, 0x61f5f540
popal
xor edi, eax
add edx, edi
jmp 0x4031f9
pop eax
mov ebx, 0
mov ecx, 0
xor ebx, ecx
xor ebx, eax
mov esi, ebx
mov ecx, esi
add esp, 0xfffffffc
mov dword [esp], ecx
mov ebx, eax
mov edi, ebx
xor edx, edx
add edx, edi
mov ebx, edx
mov edi, ebx
mov ebx, 0xffffffff
xor edi, ebx
and edi, 0xffffffff
and edx, 0
add byte [eax], al

Function at 0x403154
Capabilities:
Write file on windows

Disassembly:
loop 0x4031d3
cmp eax, 0xc20998bf
add esp, 0xfffffffc
mov ebx, 0
mov ecx, 0
xor ebx, ecx
xor ebx, esp
mov dword [ebx], edx
pop edi
xor ebx, ebx
add ebx, edi
add esp, 0xfffffffc
mov dword [esp], ebx
push 0x6815dc2f
mov eax, 0x6815dc2f
pop edx
xor eax, edx
xor eax, edi
mov ebx, 0xca15b90
xor ebx, 0xf35ea46f
xor eax, ebx
and eax, 0x790c97fc
xchg edi, eax
or al, 0x79
and edi, 0x86f36803
or edi, eax
and edi, 0xffff
xor ecx, ecx
add ecx, edi
xor ebx, ebx
add ebx, ecx
or ebx, edi
invalid
invalid
invalid
add eax, dword [eax]
Function at 0x40316e
Capabilities:
Write file on windows

Disassembly:
loop 0x4031d3
cmp eax, 0xc20998bf
add esp, 0xfffffffc
mov ebx, 0
mov ecx, 0
xor ebx, ecx
xor ebx, esp
mov dword [ebx], edx
pop edi
xor ebx, ebx
add ebx, edi
add esp, 0xfffffffc
mov dword [esp], ebx
push 0x6815dc2f
mov eax, 0x6815dc2f
pop edx
xor eax, edx
xor eax, edi
mov ebx, 0xca15b90
xor ebx, 0xf35ea46f
xor eax, ebx
and eax, 0x790c97fc
xchg edi, eax
or al, 0x79
and edi, 0x86f36803
or edi, eax
and edi, 0xffff
xor ecx, ecx
add ecx, edi
xor ebx, ebx
add ebx, ecx
or ebx, edi
invalid
invalid
invalid
add eax, dword [eax]

Function at 0x403198
Capabilities:
Write file on windows

Disassembly:
loop 0x4031d3
cmp eax, 0xc20998bf
add esp, 0xfffffffc
mov ebx, 0
mov ecx, 0
xor ebx, ecx
xor ebx, esp
mov dword [ebx], edx
pop edi
xor ebx, ebx
add ebx, edi
add esp, 0xfffffffc
mov dword [esp], ebx
push 0x6815dc2f
mov eax, 0x6815dc2f
pop edx
xor eax, edx
xor eax, edi
mov ebx, 0xca15b90
xor ebx, 0xf35ea46f
xor eax, ebx
and eax, 0x790c97fc
xchg edi, eax
or al, 0x79
and edi, 0x86f36803
or edi, eax
and edi, 0xffff
xor ecx, ecx
add ecx, edi
xor ebx, ebx
add ebx, ecx
or ebx, edi
invalid
invalid
invalid
add eax, dword [eax]

Function at 0x4032b8
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
or edx, edi
and edx, 0x7d28fa19
and eax, 0x82d705e6
out 5, al
xlatb
or byte [ecx], 0xd0

Function at 0x4032c4
Capabilities:
Write file on windows

Disassembly:
out 5, al
xlatb
or byte [ecx], 0xd0
cmp eax, 0
jne 0x4032fe
mov eax, 0x68011100
mov edi, 0x1924266
xor eax, edi
mov ecx, 0x7b043951
xor eax, ecx
mov ebx, 0x26bb5901
xor ebx, 0x342c3336
xor eax, ebx
invalid

Function at 0x4032fc
Capabilities:
Write file on windows

Disassembly:
mov dword [edx], esi
pop edx
mov ecx, edx
push ecx
pop ebx
add esp, 0xfffffffc
xor esi, esi
add esi, esp
mov dword [esi], ebx
mov eax, edx
mov ecx, 0x389b99f5
mov ebx, 0xc764660a
xor ecx, ebx
xor eax, ecx
and eax, 0xf259491f
and edx, 0xda6b6e0
or edx, eax
xor esi, esi
add esi, edx
or esi, edx
jne 0x40336f
push 0x6f7fc863
mov eax, 0x5ca1009f

Function at 0x403340
Capabilities:
Write file on windows

Disassembly:
pop ecx
xor eax, ecx
push eax
mov ebx, 0x36d028
mov esi, 0xa010592
xor ebx, esi
pop edi
xor ebx, edi
mov edi, 0x5fb8597e
mov ecx, 0x204441fc
xor ecx, edi
xor ebx, ecx
mov edx, 0x461505c4
xor ebx, edx
xor esi, esi
add esi, ebx
mov edx, esi
push edx
pop edi
mov esi, edi
add esp, 0xfffffffc
mov dword [esp], esi
mov eax, 0x40080240
mov ebx, 0x28001
xor eax, ebx
push 0x290e619c
mov edx, 0x283a0192
pop ebx
xor edx, ebx
xor eax, edx
xor edi, eax
mov esi, 0x18002c2
mov ebx, 0x14702d30
xor esi, ebx
xor edi, esi
mov ebx, 0x2dc25ed6
xor edi, ebx
and edi, 0xffff
push 0x237010cb
invalid
mov ebx, 0x16e06aca
Function at 0x4033b4
Capabilities:
Write file on windows

Disassembly:
and edi, dword [ebx + 0x16e06aca]
pop ecx
xor ebx, ecx
mov eax, 0x7455252c
xor ebx, eax
xor ebx, 0x41c55f2d
xor ebx, edi
or ebx, 0
jne 0x403423
mov edx, 0x4bf563ff
xor edx, 0x282f5832
push edx
mov ecx, 0x5c38aa0e
mov eax, 0x11ad4517
xor eax, ecx
pop ebx
xor eax, ebx
add esp, 0xfffffffc
mov edx, esp
mov dword [edx], eax
mov esi, 0x2d12be5e
xor esi, 0x2b142ece
sub ebp, dword [eax + 0x36]
ficomp dword [esi + 0x36]
mov eax, 0x1e179e72
pop ebx
xor eax, ebx
xor esi, eax

Function at 0x403404
Capabilities:
Write file on windows

Disassembly:
and edi, dword [ebx + 0x16e06aca]
pop ecx
xor ebx, ecx
mov eax, 0x7455252c
xor ebx, eax
xor ebx, 0x41c55f2d
xor ebx, edi
or ebx, 0
jne 0x403423
mov edx, 0x4bf563ff
xor edx, 0x282f5832
push edx
mov ecx, 0x5c38aa0e
mov eax, 0x11ad4517
xor eax, ecx
pop ebx
xor eax, ebx
add esp, 0xfffffffc
mov edx, esp
mov dword [edx], eax
mov esi, 0x2d12be5e
xor esi, 0x2b142ece
sub ebp, dword [eax + 0x36]
ficomp dword [esi + 0x36]
mov eax, 0x1e179e72
pop ebx
xor eax, ebx
xor esi, eax
Function at 0x403494
Capabilities:
Write file on windows

Disassembly:
pop edx
mov eax, 0x143323e7
mov esi, 0x143323e7
xor esi, eax
mov edi, 0x6cff3e56
mov ecx, 0x6cff3e57
xor ecx, edi
xor esi, ecx
sub edx, esi
and edx, 0xffffffff
push 0x2a177706
mov ecx, 0x2a177706
pop esi
xor ecx, esi
xor ecx, edx
push ecx
pop eax
add esp, 0xfffffffc
mov dword [esp], eax
mov eax, 0x2249cc80
mov esi, 0x2249cc80
xor esi, eax
mov eax, 0x78145d0b
mov edi, 0x78145d0b
xor edi, eax
xor esi, edi
xor esi, edx
and esi, edx
jne 0x403467
pop ebx
pop edi
jmp 0x403805
mov ebx, 0x3a8f96fd
xor ebx, 0x3a8f86f5
mov edx, 0xc140
mov ecx, 0x400020
xor edx, ecx
xor ebx, edx
mov edx, ebx
add edx, 5
mov esi, 0xffffffff
add edx, esi
mov eax, dword [edx - 4]
mov esi, 0x4f40e9eb
mov edx, 0x4f40e9eb
xor edx, esi
mov edi, 0x2003fa0e
xor edi, 0x2003fa0e
xor edx, edi
mov esi, edx
add esp, 0xfffffffc
mov dword [esp], esi
mov ebx, 0
xor ebx, esp
add esp, 0xfffffffc
mov ecx, esp
mov dword [ecx], ebx
push 0x57e3cf4f
mov ebx, 0x7b303162
pop edi
xor ebx, edi
mov edi, ebx
xor edi, 0xffffffff
and edi, 0x2cd3fe6d
and ebx, 0xd32c0192
or ebx, edi
mov ecx, ebx
add esp, 0xfffffffc
mov dword [esp], ecx
mov edx, 0x66447dc0
mov esi, 0x6fa931e2
xor esi, edx
mov ebx, 0xbfe316e
xor esi, ebx
xor esi, 0x213e94c
mov ecx, esi
add esp, 0xfffffffc
mov dword [esp], ecx
mov ebx, 0x4208058
mov esi, 0x50181204
xor ebx, esi
mov ecx, 0x62afa9b9
xor ebx, ecx
xor ebx, 0x36d72be5
mov edx, ebx
push edx
call eax
mov edx, 0x4012d0
push edx
pop eax
mov esi, eax
add esp, 0xfffffffc
mov dword [esp], esi
mov edi, edx
mov eax, edi
push eax
pop ecx
xor edi, edi
add edi, ecx
mov ebx, 0x7fea46aa
mov edx, 0x7fea4769
xor edx, ebx
mov eax, 4
mov ebx, 0x230
xor eax, ebx
xor edx, eax
add edi, edx
add edi, 0xffffffff
add ecx, edx
mov esi, edx
mov eax, esi
mov esi, eax
add esp, 0xfffffffc
mov dword [esp], esi
push ecx
pop esi
add esp, 0xfffffffc
mov dword [esp], esi
xor edx, edx
mov dl, byte [edi]
add ecx, edx
mov dl, byte [ecx]
pop ecx
mov byte [edi], dl
add edi, 0xffffffff
pop edx
push 0x5253a1b
mov eax, 0x5253a1a
pop ebx
xor eax, ebx
sub edx, eax
mov esi, 0
mov eax, 0
xor esi, eax
xor esi, edx
add esi, 0
jne 0x403900
pop ebx
mov eax, 0x54642971
xor eax, 0x5f18dfaa
mov edi, 0x1472b231
xor edi, 0x1f4e9552
xor edi, eax
mov ecx, 0
xor ecx, edi
add ecx, 0xffffffcd
add ecx, 0xffffffff
mov edi, dword [ecx + 0x34]
xor ecx, ecx
add ecx, edi
add esp, 0xfffffffc
mov dword [esp], ecx
mov eax, 0x74680280
mov edx, 0xb041916
xor eax, edx
mov edx, 0x4d541b79
xor eax, edx
xor eax, 0x323800ef
mov edx, eax
add esp, 0xfffffffc
mov dword [esp], edx
mov ecx, 0x518a39ab
xor ecx, 0x2a6847bb
mov ebx, 0xbf2a6847
or cl, byte [edi - 0x87ea6a4]
xchg byte [eax], ah
invalid
and dh, byte [ecx]
iretd
xor ecx, ecx
add ecx, edi
sub ecx, 0xffffffce
dec ecx
mov edi, dword [ecx - 0x31]
mov ecx, 0
xor ecx, edi
add esp, 0xfffffffc
mov eax, esp
mov dword [eax], ecx
mov eax, 0x30
mov edx, 0x304
xor eax, edx
mov ecx, 0xc0
mov edx, 3
xor ecx, edx
xor eax, ecx
add eax, ebx
mov ecx, eax
mov esi, ecx
mov ecx, esi
push ecx
mov edx, 0x549ffa29
mov edi, 0x549ff221
xor edi, edx
mov ecx, 0x414c401c
invalid
int1
Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call 0x40322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call 0x40322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret