joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd0d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505770
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x53b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4cd107
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4cd11b
mov al, 1
jmp 0x4cd2a2
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x4cd125
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd150
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b290
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ccd30
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp ebx, 0xffffffff
jne 0x4cd198
xor al, al
jmp 0x4cd2a2
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x4cd1a2
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd1d0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b290
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004ccc60
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b220
test bl, bl
je 0x4cd191
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4cd219
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x4cd114
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004cd7c0
test al, al
je 0x4cd263
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x4cd263
mov bl, 1
jmp 0x4cd291
cmp dword [esi + 0x14], 8
jb 0x4cd26b
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x44]
call fcn.0040a730
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004ccc60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.0040b220
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9681
mov esp, ebp
pop ebp
ret
Function at 0x4cd2e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x53b008]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4cd31e
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x4cd326
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4cd386
xor eax, eax
lea edx, [esp + 0xc]
mov word [esp + 0x216], ax
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4cd350
sub edx, esi
lea eax, [esp + 0xc]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.0040b290
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e9681
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e9681
add esp, 0x210
ret
Function at 0x4cf890
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x53b008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4cf8f5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cf8d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4cf8f5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004e9681
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004e9681
add esp, 8
ret 4
Function at 0x4e54b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4e54bb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004e54d0
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x14971f1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x3fef6379
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4383c4
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x4a8
mov eax, 0x4ae728
call fcn.0043d05b
mov edi, ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
jne 0x4383e6
xor eax, eax
jmp 0x438577
lea ecx, [ebp - 0x2a4]
push 3
mov dword [ebp - 0x2a8], ecx
lea ecx, [ebp - 0x2a8]
push eax
call fcn.0043825d
mov ebx, 0x104
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0043f630
push ebx
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0043f630
add esp, 0x18
push dword [ebp - 0x2a8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00438324
push dword [ebp - 0x2a8]
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00438324
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x4c3cb4
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.0040a421
lea eax, [ebp - 0x224]
push eax
push 0xffffffffffffffff
push 0x4385c8
push 0x4385ad
push 0x4385d1
push 0x4385bf
push 0x4385b6
push fcn.004385e3
push 0x4385da
call dword [edi + 4]
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x43855b
push 0x108
lea eax, [ebp - 0x4b4]
push esi
push eax
call fcn.0043f630
lea eax, [ebp - 0x4b4]
push eax
push esi
push 0x4385e8
push esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [edi + 8]
push ebx
call dword [edi + 0xc]
add esp, 0x2c
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43855b
cmp dword [ebp - 0x4b4], 0
je 0x43854e
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp - 0x3ac]
push 3
lea eax, [ebp - 0x4b0]
push eax
call fcn.004381a3
push dword [ebp - 0x3ac]
mov byte [ebp - 4], 1
call fcn.00432c83
mov esi, eax
lea eax, [ebp - 0x3a8]
pop ecx
cmp dword [ebp - 0x3ac], eax
je 0x43854e
push dword [ebp - 0x3ac]
call fcn.00443bd1
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2a4]
cmp dword [ebp - 0x2a8], eax
je 0x438575
push dword [ebp - 0x2a8]
call fcn.00443bd1
pop ecx
mov eax, esi
call fcn.0043d005
ret 4

Function at 0x45bb6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b82d

Function at 0x45bb75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b9ae

Function at 0x45ffb0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fc70

Function at 0x4601c5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004600ca
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x411ed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x411eea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ee0
mov eax, 1
add ebx, ebx
jne 0x411f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ef8
jne 0x411f14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ef8
xor ecx, ecx
sub eax, 3
jb 0x411f28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411f9a
mov ebp, eax
add ebx, ebx
jne 0x411f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411f40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411f64
inc ecx
add ebx, ebx
jne 0x411f50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411f45
jne 0x411f61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411f45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411f84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411f75
jmp 0x411ee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411f84
add edi, ecx
jmp 0x411ee6
pop esi
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411fec
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14330]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x143ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411fa1
mov ecx, edi
jns 0x411fd0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x143f4]
or eax, eax
je 0x411fe6
mov dword [ebx], eax
add ebx, 4
jmp 0x411fbe
call dword [esi + 0x143f0]
mov ebp, dword [esi + 0x143f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412020
sub esp, 0xffffff80
jmp 0x403956
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1014
push ebp
mov ebp, esp
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
or eax, 0xffffffff
mov dword [0x415c84], 9
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
mov dword [ebp - 8], eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
mov ecx, 0x1000
xor eax, eax
lea edx, [ebp - 0x1010]
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
mov edi, eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
test eax, eax
mov esi, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404770
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4047d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b14
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004029a0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4047c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4047dd
lea eax, [ebp - 0x10]
call fcn.004038b0
ret

Function at 0x407738
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, esp
add ebp, 0x24
push esp
call fcn.00405598
pop ebp

Function at 0x407794
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb eax, 0xa164b998
xor byte [eax], al
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40775c
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00405598
nop
cmp al, 0xc6
push ebp
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00405598
fdivr qword [edx]
push 0x348b49e7
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x407785
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x407785
call fcn.00405598
jle 0x407744
fisub dword [ecx + 0x3245a8b]
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00405598
sar byte [edx + 0x75fffa74], 8
push dword [ebp + 4]
push dword [ebp]
call fcn.00405d98
add al, 0xf
mov bh, 0xc0
shr eax, 0xa
mov dword [esi + 8], eax
push esi
mov esi, 0x407838
mov edi, 0x4090c4
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
cmp dword [0x4090b4], 4
jle 0x407807
cmp dword [0x4090b0], 2
jne 0x407807
mov byte [esi + 0xd], 1
jmp 0x407816
push 0x4a
call sub.user32.dll_GetSystemMetrics
test eax, eax
setne al
mov byte [esi + 0xd], al
push 0x2a
call sub.user32.dll_GetSystemMetrics
test eax, eax
setne bl
mov byte [esi + 0xc], bl
test bl, bl
je 0x407830
push ebp
call fcn.00407738
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x403e59
pop dword [ebp - 0x44]
mov eax, 0x4fdfe698
add eax, 0xb06057c1
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xda07a9ad
sub dword [ebp - 0x54], 0x8bb56462
mov dword [ebp - 0x50], 0x90b0889b
sub dword [ebp - 0x50], 0x5e7d3c56
mov dword [ebp - 0x4c], 0xdd1c852a
sub dword [ebp - 0x4c], 0x90d040fc
mov dword [ebp - 0x48], 0x2ff7a6d8
sub dword [ebp - 0x48], 0x2ff7a6d8
lea eax, [ebp - 0x54]
push eax
mov eax, 0xb2a7b07a
add eax, 0x4d98d012
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd32da277
add dword [ebp - 0x54], 0xa144c6df
mov dword [ebp - 0x50], 0x3d0a4ced
add dword [ebp - 0x50], 0x4621488
mov dword [ebp - 0x4c], 0xd7fb608c
sub dword [ebp - 0x4c], 0x748bf420
mov dword [ebp - 0x48], 0x763657fc
add dword [ebp - 0x48], 0x89c9a804
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x9c02f331
sub eax, 0x9bc2725d
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x31d39
push 0
call eax
mov ecx, 0x9489668d
add ecx, 0x6b76cdc4
xor edx, edx
add edx, eax
mov edi, 0xec801d60
sub edi, 0xec3f0d60
add edi, dword [ebp - 0x44]
mov esi, 0xadeab333
mov ebx, dword [edi]
xor dword [ebp - 0x3c], 0x18364cf4
add ebx, esi
sub dword [ebp - 4], edi
mov dword [edx], ebx
xor dword [ebp - 0x2c], 0x6cb6d387
add edx, 4
add edi, 0x2df31e8e
sub edi, 0x2df31e8a
loop 0x403f77
add eax, 0xc417
xor ebx, ebx
add ebx, eax
add eax, 0xcf514c08
sub eax, 0xcf514c03
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x45af40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0045b500
push dword [0x4e7ca8]
call fcn.0040e430
mov eax, dword [0x4e788c]
add esp, 4
test eax, eax
je 0x45af66
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.00462ea0
push 2
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
cmp eax, 3
jne 0x45af85
call fcn.00464d20
call fcn.00460f60
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp + 8]
call fcn.0049b80a
int3

Function at 0x45b290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040de10
push dword [0x4be594]
mov esi, eax
lea eax, [ebp - 0x68]
push str._.70s_Command_Line_Error
push eax
call fcn.004089b0
add esp, 0x14
lea eax, [ebp - 0x68]
push 0x10
push eax
push esi
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040e430
add esp, 4
push 1
call fcn.0049b80a
int3

Function at 0x45b540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 1
jne 0x45b589
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4e8090]
js 0x45b575
cmp eax, 0x32
jl 0x45b671
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
call esi
mov dword [0x4e8090], eax
jmp 0x45b659
cmp eax, 3
jne 0x45b618
push 0x6c
push dword [0x4ea4c4]
call fcn.00403060
mov ecx, dword [0x4e8064]
add esp, 8
mov esi, eax
test ecx, ecx
je 0x45b5c1
push 0x20001
push 0
push dword [esi]
call ecx
test eax, eax
jne 0x45b659
push dword [esi]
lea eax, [ebp - 0x58]
push str.Unable_to_play_sound_file_n_s_nUsing_default_sound_instead
push eax
call fcn.004089b0
push dword [0x4be594]
lea eax, [ebp - 0xbc]
push str._.70s_Sound_Error
push eax
call fcn.004089b0
add esp, 0x18
lea eax, [ebp - 0xbc]
push 0x30
push eax
lea eax, [ebp - 0x58]
push eax
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push 0x66
push dword [0x4ea4c4]
call fcn.00403560
add esp, 0xc
jmp 0x45b659
cmp eax, 4
jne 0x45b659
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4e8094]
js 0x45b632
cmp eax, 0x32
jl 0x45b671
cmp dword [0x4ea410], 2
jne 0x45b64a
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x45b652
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
call esi
mov dword [0x4e8094], eax
mov eax, dword [0x4ea4ac]
cmp dword [eax + 0x134], 0
jne 0x45b671
push 2
call fcn.0045c6c0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046addd
mov esp, ebp
pop ebp
ret

Function at 0x45d9f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [0x4ea4b8]
push 0x45b150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret