joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053e70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056ffe
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10072084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10072b74]
cmp eax, 0xffffffff
jne 0x10053ea6
xor ebx, ebx
jmp 0x10053eaf
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10053ef1
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x10053f30
test esi, esi
jne 0x10053f34
push 0x10053970
push 0x10076db4
call fcn.100534e0
mov eax, dword [0x10072b74]
add esp, 8
cmp eax, 0xffffffff
je 0x10053ef1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x10053f1e
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x10053f1e
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10053f76
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x10053f5f
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10053f34
cmp dword [ebx + 0x18], 0
je 0x10053ec0
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10053f9d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10053f9d
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10053990
cmp dword [ebx + 0x18], 0
jne 0x10053f80
jmp 0x10053ec0
Function at 0x401710
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401722
mov eax, dword [0x50f08f]
shl eax, 2
mov dword [0x50f093], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00500264
pop edx
call fcn.004ffe80
call fcn.00500750
push 0
call fcn.005018e4
pop ecx
push 0x50f038
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x50f097], eax
push 0
jmp fcn.0050add4

Function at 0x402f9c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
mov eax, 0x50f8bc
call fcn.00500d08
mov dword [ebp - 0x28], 9
xor dword [ebp - 0x28], 0x85
mov edx, dword [ebp - 0x28]
lea edx, [edx + edx*2]
mov dword [ebp - 0x28], edx
inc dword [ebp - 0x28]
push dword [ebp - 0x28]
push 0x50f7d6
call fcn.00503370
add esp, 8
mov esi, 0x50f470
lea edi, [ebp - 0x25c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
mov esi, 0x50f490
lea edi, [ebp - 0x228]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0x18
mov eax, dword [0x50f690]
mov dword [ebp - 0x234], eax
mov eax, dword [0x50f694]
mov dword [ebp - 0x230], eax
mov word [ebp - 0x14], 0x24
xor edx, edx
mov dword [ebp - 0x23c], edx
shl dword [ebp - 0x28], 6
inc dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
add ecx, ecx
mov dword [ebp - 0x28], ecx
push dword [ebp - 0x28]
push 0x50f7df
call fcn.00503370
add esp, 8
xor eax, eax
mov dword [ebp - 0x23c], eax
mov byte [ebp - 0x229], 0
mov byte [ebp - 0x22a], 0
mov word [ebp - 0x236], 0
mov edx, dword [ebp - 0x23c]
add edx, edx
lea edx, [edx + edx*2]
and edx, 0x80000007
jns 0x403088
dec edx
or edx, 0xfffffff8
inc edx
mov ecx, 0xa
sub ecx, edx
mov eax, dword [ebp - 0x23c]
add eax, eax
lea eax, [eax + eax*2]
test eax, eax
jns 0x4030a1
add eax, 7
sar eax, 3
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
shl eax, 8
mov edx, dword [ebp - 0x23c]
add edx, edx
lea edx, [edx + edx*2]
test edx, edx
jns 0x4030c0
add edx, 7
sar edx, 3
mov ebx, dword [ebp + 8]
movzx edx, byte [ebx + edx + 1]
add eax, edx
sar eax, cl
mov word [ebp - 0x236], ax
movzx eax, word [ebp - 0x236]
sar eax, 5
and al, 1
or al, byte [ebp - 0x229]
add eax, eax
mov byte [ebp - 0x229], al
movzx ecx, word [ebp - 0x236]
sar ecx, 0
and cl, 1
or cl, byte [ebp - 0x229]
mov byte [ebp - 0x229], cl
movzx eax, word [ebp - 0x236]
sar eax, 1
and al, 0xf
mov byte [ebp - 0x22a], al
mov ecx, dword [ebp - 0x23c]
inc ecx
and ecx, 0x80000001
jns 0x40312e
dec ecx
or ecx, 0xfffffffe
inc ecx
shl ecx, 2
xor edx, edx
mov dl, byte [ebp - 0x229]
shl edx, 4
mov eax, dword [ebp - 0x23c]
shl eax, 6
lea eax, [ebp + eax - 0x228]
lea edx, [eax + edx]
xor eax, eax
mov al, byte [ebp - 0x22a]
mov dl, byte [edx + eax]
shl dl, cl
mov ecx, dword [ebp - 0x23c]
sar ecx, 1
jns 0x403169
adc ecx, 0
or byte [ebp + ecx - 0x234], dl
inc dword [ebp - 0x23c]
cmp dword [ebp - 0x23c], 7
jle 0x403059
push 0x20
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x234]
push edx
call fcn.00402c64
add esp, 0x10
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408ab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff34
push esi
push edi
mov eax, 0x510da4
call fcn.00500d08
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov esi, 0x510b48
lea edi, [ebp - 0xcc]
mov ecx, 0x25
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
mov dword [ebp - 0xcc], 0x94
lea eax, [ebp - 0xcc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00500848
add esp, 0xc
mov dword [ebp - 0x34], 9
xor dword [ebp - 0x34], 0x85
mov edx, dword [ebp - 0x34]
lea edx, [edx + edx*2]
mov dword [ebp - 0x34], edx
inc dword [ebp - 0x34]
push dword [ebp - 0x34]
push 0x510d78
call fcn.00503370
add esp, 8
cmp dword [ebp - 0xbc], 2
jne 0x408bc0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407c1c
add esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x408b71
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408528
add esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x408b88
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408054
add esp, 8
mov dword [ebp - 0x28], eax
shl dword [ebp - 0x34], 6
inc dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
add ecx, ecx
mov dword [ebp - 0x34], ecx
push dword [ebp - 0x34]
push 0x510d81
call fcn.00503370
add esp, 8
cmp dword [ebp - 0x28], 0
jne 0x408bf5
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408734
add esp, 8
mov dword [ebp - 0x28], eax
jmp 0x408bf5
xor eax, eax
mov dword [ebp - 0x38], eax
mov word [ebp - 0x14], 0xc
jmp 0x408be1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408390
add esp, 8
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xa
jge 0x408bf5
cmp dword [ebp - 0x28], 0
jne 0x408bf5
mov edx, dword [ebp + 8]
cmp byte [edx], 0
je 0x408bcd
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414f30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push esi
push edi
mov eax, 0x51b260
call fcn.00500d08
mov word [ebp - 0x3c], 0x18
push 0x51851a
lea edx, [ebp - 0x28]
push edx
call fcn.00401bb4
add esp, 8
inc dword [ebp - 0x30]
mov word [ebp - 0x3c], 0xc
mov dword [ebp - 0x50], 0x104
mov esi, 0x516374
lea edi, [ebp - 0x15c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x3c], 0x24
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x15c]
push edx
call sub.KERNEL32.DLL_GetComputerNameA
mov byte [ebp - 0x152], 0
mov esi, 0x516478
lea edi, [ebp - 0x16c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x3c], 0x30
lea eax, [ebp - 0x16c]
push eax
call sub.KERNEL32.DLL_GetSystemTime
mov esi, 0x516488
lea edi, [ebp - 0x270]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x15c]
push eax
movzx edx, word [ebp - 0x166]
push edx
movzx ecx, word [ebp - 0x16a]
push ecx
movzx eax, word [ebp - 0x16c]
push eax
push 0x51851b
lea edx, [ebp - 0x270]
push edx
call fcn.00503650
add esp, 0x18
lea ecx, [ebp - 0x270]
push ecx
call fcn.00414ee0
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
push 0x518524
lea eax, [ebp - 0x270]
push eax
call fcn.00503650
add esp, 0xc
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
mov byte [ebp + edx - 0x270], 0
lea ecx, [ebp - 0x270]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00401d84
add esp, 8
mov word [ebp - 0x3c], 0x48
lea edx, [ebp - 0x28]
push edx
push dword [ebp + 8]
call fcn.00402244
add esp, 8
inc dword [ebp - 0x30]
mov eax, dword [ebp + 8]
mov word [ebp - 0x3c], 0x54
push eax
dec dword [ebp - 0x30]
push 2
lea edx, [ebp - 0x28]
push edx
call fcn.00401c10
add esp, 8
pop eax
mov word [ebp - 0x3c], 0x48
inc dword [ebp - 0x30]
mov edx, dword [ebp - 0x4c]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4155b8
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x144], 0x128
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
je 0x415700
lea ecx, [ebp - 0x120]
push ecx
push 0x518604
call fcn.00500980
add esp, 8
test eax, eax
je 0x415644
lea eax, [ebp - 0x120]
push eax
push 0x51860d
call fcn.00500980
add esp, 8
test eax, eax
je 0x415644
lea edx, [ebp - 0x120]
push edx
push 0x518616
call fcn.00500980
add esp, 8
test eax, eax
jne 0x4156d8
mov byte [ebp - 0xd], 0
push 0x5294a0
mov ecx, dword [0x5294a0]
call dword [ecx + 0x1c]
pop ecx
jmp 0x415692
push 0x5294a0
mov eax, dword [0x5294a0]
call dword [eax + 0x2c]
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x415684
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x5e]
cmp ecx, dword [ebp - 0x13c]
jne 0x415684
mov byte [ebp - 0xd], 1
jmp 0x4156a5
push 0x5294a0
mov eax, dword [0x5294a0]
call dword [eax + 0x20]
pop ecx
push 0x5294a0
mov edx, dword [0x5294a0]
call dword [edx + 0x28]
pop ecx
test al, al
je 0x415659
cmp byte [ebp - 0xd], 0
je 0x4156d8
push dword [ebp - 0x13c]
push 0
push 0x1fffff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4156d8
push 0
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_TerminateProcess
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0
jne 0x4155f8
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov esp, ebp
pop ebp
ret

Function at 0x41b3e8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], 9
xor dword [ebp - 4], 0x85
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
mov dword [ebp - 4], eax
inc dword [ebp - 4]
push dword [ebp - 4]
push 0x51e310
call fcn.00503370
add esp, 8
lea edx, [ebp + 0xc]
mov dword [ebp - 8], edx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x52fe84
call fcn.00503678
add esp, 0xc
push 0x52fe84
call sub.KERNEL32.DLL_OutputDebugStringA
pop ecx
pop ecx
pop ebp
ret

Function at 0x41b674
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jge 0x41b6b6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx + eax]
xor edx, dword [ebp + 8]
and edx, 0xff
mov ecx, dword [edx*4 + 0x51e8d0]
mov eax, dword [ebp + 8]
shr eax, 8
xor ecx, eax
mov dword [ebp + 8], ecx
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jl 0x41b685
mov eax, dword [ebp + 8]
pop ecx
pop ebp
ret
Function at 0x41ba28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x534fa0
push 0xa
push 0x41babc
mov eax, dword [0x527ec0]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x41ba4c
call fcn.0043d8cc
push ebx
mov eax, dword [0x527ec0]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x41ba63
call fcn.0043d8cc
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x41ba75
call fcn.0043d8cc
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x534fa4], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x534fa8], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x534fac], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x534fb0], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x534fb4], ecx
add edx, dword [eax + 0x14]
mov dword [0x534fb8], edx
pop esi
pop ebx
ret

Function at 0x42dc80
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0042d984
dec esi
jne 0x42dca2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x42ee4c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x5352a4
cmp dword [edi], 0
jne 0x42eec8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x5352a0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x51ef08
mov ecx, 2
call fcn.00449cb0
mov edx, 0x42ee24
lea eax, [esi + 5]
call fcn.0042ee44
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042ee44
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42ee9d
mov dword [0x5352a0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x430b54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0044c568
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
je 0x430bac
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x527a30]
mov dl, 1
mov eax, dword [0x4305dc]
call fcn.0043ba64
call fcn.0044b1ac
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00430764
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435ad4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x435b7d
test eax, edx
je 0x435b80
push 0
push 0
cmp word [eax - 0xa], 2
je 0x435afd
push edx
mov edx, eax
mov eax, esp
call fcn.0044c6e0
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x435b13
push eax
lea eax, [esp + 8]
call fcn.0044c6e0
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x435b22
movzx eax, word [eax]
sub eax, ecx
jmp 0x435b49
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x435b63
add ecx, 4
js 0x435b3a
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x435b60
push eax
mov eax, ecx
mov edx, 2
call fcn.0044b900
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x435b47
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x435b49
xor eax, eax
ret
test eax, eax
je 0x435b90
test edx, edx
jne 0x435ae4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x436d94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0044c568
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x436db2
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x436dd3
cmp ebx, 3
je 0x436dd3
cmp ebx, 0x7b
je 0x436dd3
mov eax, esi
call fcn.00436d54
test al, al
jne 0x436dd7
xor eax, eax
jmp 0x436dd9
mov al, 1
pop esi
pop ebx
ret

Function at 0x43b0b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x43b0ed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0044c618
jmp 0x43b0f6
mov eax, ebx
mov edx, esi
call fcn.0044c4dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43b100
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x43b122
movzx eax, word [esp]
jmp 0x43b124
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x43b888
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffff004
push eax
add esp, 0xffffff7c
push 0x800
lea ecx, [esp + 0x88]
call fcn.0043b6c0
mov eax, dword [0x52794c]
cmp byte [eax], 0
je 0x43b91a
mov eax, dword [0x527950]
call fcn.00449e88
call fcn.00449c60
lea eax, [esp + 0x884]
push eax
lea eax, [esp + 0x88]
push eax
call sub.USER32.DLL_CharToOemW
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x88c]
call fcn.004370f8
push eax
lea eax, [esp + 0x890]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x43b968
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x43b953
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x5277d0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x527ec0]
call fcn.0044dc44
push eax
call sub.USER32.DLL_LoadStringW
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x8c]
push eax
push 0
call sub.USER32.DLL_MessageBoxW
add esp, 0x1084
ret

Function at 0x43c578
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43c64e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0044c530
lea eax, [ebp - 4]
call fcn.0044cddc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044c568
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x43c638
mov eax, ebx
call fcn.00449a70
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x43c631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044c568
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x43c61b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43c660
mov eax, dword [ebp - 0x10]
push eax
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x43c61b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c638
mov eax, dword [ebp - 0x10]
call fcn.00449a8c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c655
lea eax, [ebp - 4]
call fcn.0044c4cc
ret
Function at 0x43d703
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0044bbe0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
mov edi, eax
cmp edi, 0x104
jbe 0x43d726
mov eax, edi
add eax, eax
call fcn.00449a70
mov esi, eax
jmp 0x43d728
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
push edi
push esi
call sub.USER32.DLL_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x43d761
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x43d74b
mov eax, esp
cmp esi, eax
je 0x43d76e
mov eax, esi
call fcn.00449a8c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x43d7a8
cmp bl, 0
je 0x43d7a4
cmp bl, 0x41
jl 0x43d79f
cmp bl, 0x5a
jg 0x43d79f
or bl, 0x20
xor al, bl
inc esi
jmp 0x43d783
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x43d6e8

Function at 0x44a428
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x51f384]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x44a4c0
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x44a4a0
xor eax, eax
push ebp
push 0x44a499
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x44a4f8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a4a0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
movzx eax, word [0x51f384]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x51f384], ax
mov esp, ebp
pop ebp
ret

Function at 0x44b660
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x537634], 0
je 0x44b6c1
cmp word [0x537910], 0xd7b2
jne 0x44b689
cmp dword [0x537918], 0
jbe 0x44b689
mov eax, 0x53790c
call dword [fcn.00537928]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push 0x51fae0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x44b6ec
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x51f390], 0
jne 0x44b6dd
push 0
push 0x51fad8
push 0x51fae0
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x44b860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x51f370], 0
je 0x44b886
mov edx, esi
mov eax, ebx
call dword [0x51f370]
jmp 0x44b895
mov eax, 8
call fcn.00449a70
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x537635], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x44b828
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc