joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505c08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.005057d4
xor eax, eax
mov dword [ebx + 0x40], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x3c], 0
mov byte [ebx + 0x2e], 0
cmp byte [ebx + 0x2c], 0
je 0x505cd6
jmp 0x505c7b
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x40], eax
mov eax, dword [ebx + 0x40]
sub eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 0x30]
jg 0x505ce2
cmp byte [ebx + 0x2d], 7
je 0x505ce2
mov edx, dword [ebx + 0x24]
cmp byte [edx + 0x58], 7
jne 0x505c6c
mov al, byte [ebx + 0x2d]
cmp al, 6
je 0x505ce2
cmp al, 5
je 0x505ce2
push 0x64
call sub.kernel32.dll_Sleep
mov eax, dword [ebx + 0x24]
call fcn.0049d974
cmp byte [ebx + 0x2e], 0
jne 0x505ce2
cmp byte [ebx + 0x2d], 0
jne 0x505c37
jmp 0x505ce2
call sub.kernel32.dll_GetTickCount
mov esi, eax
mov dword [ebx + 0x40], esi
sub esi, dword [ebx + 0x34]
mov eax, dword [ebx + 0x30]
sub eax, esi
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x40]
sub eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 0x30]
jg 0x505ce2
cmp byte [ebx + 0x2d], 7
je 0x505ce2
mov edx, dword [ebx + 0x24]
cmp byte [edx + 0x58], 7
jne 0x505cc3
mov al, byte [ebx + 0x2d]
cmp al, 6
je 0x505ce2
cmp al, 5
je 0x505ce2
push 0x64
call sub.kernel32.dll_Sleep
mov eax, dword [0x549798]
mov eax, dword [eax]
call fcn.0043b178
cmp byte [ebx + 0x2e], 0
jne 0x505ce2
cmp byte [ebx + 0x2d], 0
jne 0x505c89
mov eax, dword [ebx + 0x40]
sub eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 0x30]
jle 0x505d04
mov byte [ebx + 0x3c], 1
mov byte [ebx + 0x2d], 0
mov eax, dword [ebx + 0x24]
mov edx, dword [eax]
call dword [edx + 0x64]
mov eax, ebx
call fcn.0050479c
cmp dword [ebx + 0x40a8], 0x190
jl 0x505d2f
mov ax, word [ebx + 0x40a8]
push eax
mov ecx, dword [ebx + 0x40ac]
mov dl, 1
mov eax, dword [0x5037ac]
call fcn.005040b4
call fcn.00403688
pop esi
pop ebx
pop ebp
ret
Function at 0x506470
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.004041c0
mov eax, esi
call fcn.00404060
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.00402bd8
cmp byte [ebp - 1], 0
jne 0x5064e3
mov eax, esi
call fcn.00404060
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x5064fc
sub al, 2
jb 0x506503
jmp 0x506508
mov ebx, 2
jmp 0x506508
mov ebx, 1
mov eax, esi
call fcn.00404060
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x5065ea
test edi, edi
jle 0x506564
mov eax, esi
call fcn.00404060
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00404060
mov byte [eax + ebx - 1], 0
jmp 0x5065de
test edi, edi
jge 0x5065aa
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00404060
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x5065de
mov eax, esi
call fcn.00404060
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00404060
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x506520
mov al, byte [ebp - 1]
sub al, 1
jb 0x5065fa
sub al, 2
jb 0x506633
jmp 0x50667a
cmp edi, 2
jne 0x506600
dec ebx
mov eax, ebx
sub eax, 2
jl 0x50667a
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00404060
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x549284]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x506610
jmp 0x50667a
cmp edi, 2
jne 0x506639
dec ebx
test ebx, ebx
jle 0x506675
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00404060
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x549288]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x506645
jmp 0x506675
inc ebx
mov eax, esi
call fcn.00404060
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x506668
mov eax, esi
mov edx, ebx
call fcn.004041c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x51c6b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404044
xor eax, eax
push ebp
push 0x51c759
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x54c534], 0
je 0x51c743
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x54c578]
call fcn.00404054
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x51c743
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 4]
mov edx, 0x51c770
call fcn.00403e98
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e90
push eax
lea eax, [ebp - 4]
call fcn.00404060
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c760
lea eax, [ebp - 4]
call fcn.00403c14
ret
Function at 0x530dfc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x538]
mov edx, 0x80000005
call fcn.00451db8
mov dl, 1
mov eax, dword [0x41a12c]
call fcn.004218a4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x530f5c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402bd8
push 0x4101
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x54c1e4]
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00421c48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x538]
mov edx, dword [ebp - 4]
call fcn.004519e8
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402bd8
push 0x4103
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x54c1e4]
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00421c48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x538]
mov edx, dword [ebp - 4]
call fcn.004519e8
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402bd8
push 0xc101
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x54c1e4]
call fcn.00404054
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00421c48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x538]
mov edx, dword [ebp - 4]
call fcn.004519e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530f63
mov eax, dword [ebp - 4]
call fcn.00402f30
ret
Function at 0x539d3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x20c]
call fcn.0047e0e0
mov esi, eax
dec esi
test esi, esi
jle 0x539d91
mov ebx, 1
mov eax, dword [edi + 0x20c]
mov edx, ebx
call fcn.0047e118
mov edx, 3
call fcn.0047dc6c
xor al, 1
push eax
mov eax, dword [edi + 0x20c]
mov edx, ebx
call fcn.0047e118
mov edx, 3
pop ecx
call fcn.0047dcd8
inc ebx
dec esi
jne 0x539d5b
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x539d98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x20c]
call fcn.0047e0e0
mov esi, eax
dec esi
test esi, esi
jle 0x539ded
mov ebx, 1
mov eax, dword [edi + 0x20c]
mov edx, ebx
call fcn.0047e118
mov edx, 3
call fcn.0047dc6c
xor al, 1
push eax
mov eax, dword [edi + 0x20c]
mov edx, ebx
call fcn.0047e118
mov edx, 3
pop ecx
call fcn.0047dcd8
inc ebx
dec esi
jne 0x539db7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x543190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, 0x542d10
call fcn.00406b4c
xor eax, eax
push ebp
push 0x5438ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x549798]
mov eax, dword [eax]
call fcn.0043b28c
mov eax, dword [0x549798]
mov eax, dword [eax]
mov edx, 0x5438d4
call fcn.0043aeac
mov eax, dword [0x549798]
mov eax, dword [eax]
add eax, 0x38
mov edx, 0x5438e8
call fcn.00403c68
lea eax, [ebp - 0x10]
call fcn.00409858
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5496a8]
call fcn.00403c68
mov eax, dword [0x5496a8]
call fcn.00463b98
mov edx, dword [0x5496a8]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x543900
call fcn.00403edc
mov eax, dword [ebp - 0x10]
call fcn.004649f8
test al, al
jne 0x543251
lea edx, [ebp - 0x14]
mov eax, dword [0x549798]
mov eax, dword [eax]
call fcn.0043b824
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004094c8
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5496a8]
call fcn.00403c68
mov dl, 1
mov eax, dword [0x468360]
call fcn.004684a8
mov dword [0x54c660], eax
xor eax, eax
push ebp
push 0x5433bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [0x54c660]
call fcn.0046854c
mov edx, 0x543918
mov eax, dword [0x54c660]
call fcn.004686dc
test al, al
je 0x5433a7
mov edx, 0x543934
mov eax, dword [0x54c660]
call fcn.00468be8
test al, al
je 0x5433a7
push 0x54c664
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00468d6c
test al, al
je 0x5433a7
mov eax, 0x54c670
mov edx, 0x104
call fcn.004041c0
mov eax, dword [0x54c670]
call fcn.00404054
push eax
mov eax, dword [0x54c664]
push eax
call sub.shell32.dll_SHGetPathFromIDList
test eax, eax
je 0x54330c
mov eax, dword [0x54c670]
call fcn.00404054
call fcn.0040989c
mov edx, eax
mov eax, 0x54c670
call fcn.004041c0
mov eax, 0x54c670
call fcn.00463b98
mov eax, dword [0x54c670]
call fcn.00463bd4
test al, al
je 0x54335e
mov eax, dword [0x5496a8]
mov edx, dword [0x54c670]
call fcn.00403c68
mov eax, dword [0x5496a8]
mov edx, 0x5438d4
call fcn.00403e98
mov eax, dword [0x5496a8]
mov eax, dword [0x5496a8]
call fcn.00463b98
mov eax, dword [0x5496a8]
mov eax, dword [eax]
call fcn.004648a0
cmp dword [0x54c664], 0
je 0x5433a7
push 0x54c668
call sub.shell32.dll_SHGetMalloc
call fcn.00468d6c
test al, al
je 0x5433a7
mov eax, dword [0x54c664]
push eax
mov eax, dword [0x54c668]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jle 0x5433a7
mov eax, dword [0x54c664]
push eax
mov eax, dword [0x54c668]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
mov dword [0x54c664], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5433c6
mov eax, dword [0x54c660]
call fcn.00402f30
ret
Function at 0x4027ec
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402829
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402849
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404284
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402ec4
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x402ef7
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x402efe
cmp edx, dword [ebx + 8]
je 0x402f08
mov eax, 0x65
jmp 0x402f03
mov eax, 5
jmp 0x402f03
call sub.kernel32.dll_GetLastError
call fcn.0040278c
mov eax, ebx
pop ebx
ret

Function at 0x403244
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x415020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4032dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032bc
xor eax, eax
push ebp
push 0x4032b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4032f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x415020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x415020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e78
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x416044], 0
je 0x403ed9
cmp word [0x416218], 0xd7b2
jne 0x403ea1
cmp dword [0x416220], 0
jbe 0x403ea1
mov eax, 0x416214
call dword [0x416230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x415090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f00
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x415030], 0
jne 0x403ef5
push 0
push 0x415088
push 0x415090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405994
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059fa
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404284
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402df0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059e4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a01
lea eax, [ebp - 0x10]
call fcn.00404014
ret

Function at 0x409da4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409ddd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404104
jmp 0x409de6
mov eax, ebx
mov edx, esi
call fcn.00404068
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409df0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409e11
mov al, byte [esp]
jmp 0x409e13
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a498
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a310
mov eax, dword [0x4155bc]
cmp byte [eax], 0
je 0x40a514
mov eax, dword [0x4154dc]
call fcn.00402be8
call fcn.0040276c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040761c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a55c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a54a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4154b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x416660]
call fcn.00404ee4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b1f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b25c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404284
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040714c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b263
lea eax, [ebp - 0xc]
call fcn.00404014
ret

Function at 0x4140c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044a0
xor eax, eax
push ebp
push 0x414229
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 0xf
call fcn.00413f58
mov esi, eax
test esi, esi
je 0x4141fb
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.00413f78
test eax, eax
je 0x4141f5
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404284
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0xc]
call fcn.00407534
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 4]
call fcn.004042b0
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404508
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00406dfc
mov eax, dword [ebp - 0x13c]
push eax
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 4]
call fcn.00406dfc
mov edx, dword [ebp - 0x144]
pop eax
call fcn.004043fc
jne 0x4141d9
mov bl, 1
cmp byte [ebp - 5], 0
je 0x4141d1
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x4141fb
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.00413f98
cmp eax, 1
sbb eax, eax
neg eax
or al, bl
je 0x41413b
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414230
lea eax, [ebp - 0x144]
mov edx, 4
call fcn.00404038
lea eax, [ebp - 0xc]
call fcn.00404014
lea eax, [ebp - 4]
call fcn.00404014
ret
Function at 0x414238
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
test ebx, ebx
jne 0x41425f
mov ecx, 0x38
mov edx, 0x4142fc
mov eax, 0x414328
call fcn.00403ff4
push 6
push 0
call sub.ole32.dll_CoInitializeEx
call fcn.0040f378
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4142e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402cbc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
mov eax, ebx
call fcn.004044b0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], 0x400
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
call fcn.0040b874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4142eb
cmp byte [ebp - 1], 0
je 0x4142e3
call sub.ole32.dll_CoUninitialize
ret

Function at 0x4143fc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044a0
mov eax, dword [ebp - 8]
call fcn.004044a0
xor eax, eax
push ebp
push 0x41445a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.004044b0
push eax
mov eax, dword [ebp - 4]
call fcn.004044b0
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414461
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404038
ret
Function at 0x10001147
Capabilities:
Encode data using xor
Get file size

Disassembly:
push 0x450
mov eax, 0x1003fff3
call fcn.1001a8e8
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x10001173
mov edi, 0xa0
jmp 0x10001306
push ebx
push ebx
push 0x80
push 3
push 1
push 0x80000000
push eax
lea ecx, [ebp - 0x50]
call fcn.10001063
test eax, eax
jne 0x10001318
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x58], eax
cmp eax, 0xffffffff
je 0x10001303
cmp dword [ebp - 0x54], ebx
ja 0x10001303
add eax, 0xffffffc4
cmp eax, 0x12bfffc4
ja 0x10001303
push 0x3c
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x50]
call fcn.10001099
test eax, eax
jne 0x10001318
cmp dword [ebp - 0x4c], 0x33363044
jne 0x100012ff
mov eax, dword [ebp - 0x48]
cmp eax, 0x3c
jb 0x100012ff
cmp eax, dword [ebp - 0x58]
ja 0x100012ff
mov ecx, dword [ebp - 0x58]
sub ecx, eax
cmp dword [ebp - 0x38], ecx
jne 0x100012ff
mov eax, dword [ebp - 0x44]
cmp eax, 1
ja 0x100012ff
cmp eax, dword [ebp + 0xc]
jb 0x100012ff
push dword [ebp - 0x58]
call fcn.1001a311
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x10001235
push 0xe
jmp 0x10001305
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x50]
call fcn.10001102
test eax, eax
jne 0x1000130d
push dword [ebp - 0x58]
lea ecx, [ebp - 0x50]
push esi
call fcn.10001099
test eax, eax
jne 0x1000130d
cmp dword [ebp - 0x44], 1
jne 0x100012be
lea ecx, [ebp - 0x45c]
call fcn.100073d9
push ebx
push 0x4c10db7
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 1
call fcn.100073e9
push 0x10
lea eax, [esi + 0x18]
push ebx
push eax
call fcn.1001a410
add esp, 0xc
push ebx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x45c]
push esi
call fcn.10007428
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x45c]
cmp eax, dword [ebp - 0x34]
je 0x100012b9
push 0xd
pop edi
call fcn.100073e2
jmp 0x10001306
call fcn.100073e2
mov eax, dword [ebp - 0x24]
dec eax
jne 0x100012ea
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x100012d4
cmp dword [ebp + 0x14], ebx
je 0x100012d4
mov dl, byte [eax]
jmp 0x100012d7
mov dl, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x58]
sub eax, ecx
lea ecx, [ecx + esi]
je 0x100012ea
xor byte [ecx], dl
inc ecx
dec eax
jne 0x100012e4
mov dword [edi], esi
cmp dword [ebp - 0x50], ebx
je 0x100012fa
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x10001328
push 0xb
jmp 0x10001305
push 0x18
pop edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
je 0x10001318
push esi
call fcn.1001a3f8
pop ecx
cmp dword [ebp - 0x50], ebx
je 0x10001326
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.1001a96b
ret 0x10