joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e5a4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409e9c
xor eax, eax
push ebp
push 0x40e666
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040aa64
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040ac14
mov eax, dword [ebx]
call fcn.0040e44c
test al, al
jne 0x40e641
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040aa64
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040ac14
mov eax, dword [ebx]
call fcn.0040e44c
test al, al
jne 0x40e641
mov eax, ebx
call fcn.00409da8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e66d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409e08
lea eax, [ebp - 4]
call fcn.00409da8
pop eax
jmp eax

Function at 0x40ff2c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x422b74
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x422ca4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x422c7c
lea ebx, [ebp - 0x218]
lea eax, [ebx + 4]
mov word [eax], 0
push 0x104
lea eax, [ebp - 0x424]
push eax
push ebx
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x422c65
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x106
call fcn.0040aa64
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040af40
test eax, eax
jle 0x422c65
mov eax, dword [ebp - 4]
test eax, eax
je 0x422c19
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x422c27
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.0040ade4
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, ebx
call fcn.0040aa10
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.0040ac14
jmp 0x422c7c
add ebx, 2
cmp word [ebx], 0
jne 0x422c62
add ebx, 4
test ebx, ebx
je 0x422c76
cmp word [ebx], 0
jne 0x422bc6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422cab
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.00409e08
lea eax, [ebp - 4]
call fcn.00409da8
pop eax
jmp eax
Function at 0x423384
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4233dd
test eax, edx
je 0x4233e0
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42339b
movzx eax, word [eax]
sub eax, ecx
jmp 0x4233c2
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x4233c3
add ecx, 4
js 0x4233b3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4233c0
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4233c2
xor eax, eax
ret
test eax, eax
je 0x4233ec
test edx, edx
jne 0x42338c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x424160
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
mov ebx, eax
mov edx, esp
mov eax, ebx
call fcn.00407b5c
mov dword [esi], eax
cmp dword [esp], 0
sete al
pop edx
inc edi
and esi, edx
add ecx, esi
test dword [0x6b08fd], 0x39bdba41
add eax, 0x6b08fd
inc ecx
mov edx, 0x67b39bd
cmp dword [0x6b68c1], esi
jae 0x424195
or edx, ebx
or edi, edx
call fcn.004b897c
not edx
add ecx, 0x3ff32f30
mov edx, 0x7a79a2a5
call fcn.0051fe13
ror esi, 0x15
or esi, 0x9436cdfb
inc edi
call fcn.0051017a
not esi
call fcn.00531b14

Function at 0x424180
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
mov ebx, eax
mov edx, esp
mov eax, ebx
call fcn.00407b5c
mov dword [esi], eax
cmp dword [esp], 0
sete al
pop edx
inc edi
and esi, edx
add ecx, esi
test dword [0x6b08fd], 0x39bdba41
add eax, 0x6b08fd
inc ecx
mov edx, 0x67b39bd
cmp dword [0x6b68c1], esi
jae 0x424195
or edx, ebx
or edi, edx
call fcn.004b897c
not edx
add ecx, 0x3ff32f30
mov edx, 0x7a79a2a5
call fcn.0051fe13
ror esi, 0x15
or esi, 0x9436cdfb
inc edi
call fcn.0051017a
not esi
call fcn.00531b14

Function at 0x4241c4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
neg edi
sub esi, esi
add esi, 0xe47ba0a1
cmp esi, 0x86beae
jo 0x4241d9
shl edx, 0x16
mov ecx, 0x611f6a29
sub ebx, dword [0x6b01a0]
xchg esi, edx
xor eax, ebp
rol ebx, 0xb
cmp dword [0x6af3bd], 0xeca5272e
jl 0x4241f9
or edx, edi
not eax
xor eax, esi
ror esi, 0x17
not esi
dec ecx
jne 0x4241de
rol ebx, 0x13
mov ecx, 0x381aa78a
Function at 0x424218
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
or ebx, dword [0x6b1688]
dec esi
shl edx, 0x19
cmp esi, ebx
jb 0x42421e
and eax, ebp
mov eax, edi
xor esi, 0xabef2fec
sub ebx, dword [0x6b2dbd]
shl ebx, 4
ror eax, 0x10
test dword [0x6b5bc4], 0x4a659126
je 0x424240
not eax
shl edx, 0xa
xor ebx, ecx
neg ebx
inc edi
dec ecx
jne 0x42420e
mov ecx, 0x6934e06d
rol ebx, 0x1b
mov edx, dword [0x6b5cf6]
not edi
ror eax, 9
rol esi, 0xc
ror edi, 0x1f
dec eax
rol eax, 7
xchg ebx, esi
and ebx, edi
or eax, 0xb21e40c2
mov esi, 0xc5bf7f0b
shr esi, 8
add edx, eax
neg ebx
add edx, 0xc8e5cb3e
ror ebx, 0x16
or eax, eax
inc esi
dec ecx
jne 0x424251
and ebx, 0x56dac5b2
mov edx, 0x56e19214
neg ebx
call fcn.0051792c
dec ecx
call fcn.0044a9d1
xchg esi, edx
xor eax, esi
call fcn.005ec265
ror esi, 0x18
add eax, ebp
ror ecx, 1
dec esi
rol ebx, 0xe
call fcn.00542cbf
not edi
dec eax
xor ecx, esi
call fcn.0044f198
ror ecx, 0x1e
not eax
call fcn.005301c3
not eax
rol ecx, 0x1e
call fcn.00472b37
xor ecx, esi
inc eax
not edi
call fcn.006246ec
ror ebx, 0xe
inc esi
rol ecx, 1
sub eax, ebp
rol esi, 0x18
call fcn.0061b077
xor eax, esi
xchg esi, edx
call fcn.00615356
inc ecx
call fcn.004423c6
neg ebx
add edx, 0x5f754cd2
dec esi
add eax, 0x79f77a9
inc esi
xchg edi, esi
not edi
xor ebx, 0xb5916662
add edx, 0x3b454a3a
not esi
xchg ecx, edx
call fcn.006128c5
call fcn.0049c4c8
xchg ecx, edx
not esi
sub edx, 0x3b454a3a
xor ebx, 0xb5916662
not edi
xchg edi, esi
dec esi
sub eax, 0x79f77a9
inc esi
add edx, 0x49a9211a
rol eax, 0xe
add ebx, eax
dec edx
sub edx, 0xcaef574b
add esi, 0x7b283557
neg esi
add ecx, 0xd6619456
sub ebx, 0x39b8e0b2
jmp 0x424328
loopne 0x424330
cmp ecx, eax
ret 0x8112
ror dword [eax - 0x5e], 0xa1
stosd dword es:[edi], eax
xchg esi, edx
xor ecx, 0x912fff8c
inc esi
ror eax, 2
rol eax, 2
dec esi
xor ecx, 0x912fff8c
xchg esi, edx
sub ecx, 0xaba1a248
ror edx, 0x12
add ebx, 0x39b8e0b2
sub ecx, 0xd6619456
neg esi
sub esi, 0x7b283557
add edx, 0xcaef574b
inc edx
sub ebx, eax
ror eax, 0xe
push edx
call fcn.00528168
neg edi
add eax, ecx
xor ecx, 0xc21e03af
neg ebx
dec esi
sub esi, ebp
rol ecx, 0xe
xor ecx, ebx
call fcn.004e2949
call fcn.00626ff5
xor ecx, ebx
ror ecx, 0xe
add esi, ebp
inc esi
neg ebx
xor ecx, 0xc21e03af
sub eax, ecx
neg edi
call fcn.0057184e
mov ecx, 0x8a53cbc9
xor ecx, 0xcb7e2139
neg esi
rol eax, 2
call fcn.00587bca
ror ecx, 0x1b
inc ecx
xor ebx, ecx
xor ebx, 0x2e54e09d
inc ebx
call fcn.006213c1
call fcn.004a5001
dec ebx
xor ebx, 0x2e54e09d
xor ebx, ecx
dec ecx
rol ecx, 0x1b
call fcn.004cbcab
ror eax, 2
neg esi
xor ecx, 0xcb7e2139
sub ecx, 0xa6a6eab
xor eax, ecx
dec eax
call fcn.004ab11e
dec eax
not esi
add ebx, 0x2209e234
xor ebx, ebp
not esi

Function at 0x424464
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00487b3d
add ecx, edx
ror ebx, 0x19
add eax, edi
xor eax, edx
add edx, 0x81336988
xchg esi, eax
add edx, edi
xor edi, ebx
call fcn.005c6f70
sub ebx, eax
call fcn.0053758e
add ebx, eax
xor edi, ebx
sub edx, edi
xchg esi, eax
sub edx, 0x81336988
xor eax, edx
sub eax, edi
rol ebx, 0x19
sub ecx, edx
call fcn.00617684
not esi
xor ebx, ebp
sub ebx, 0x2209e234
not esi
inc eax
inc eax
Function at 0x4244b4
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, ecx
sub ecx, 0x4db5f0b9
rol edi, 8
xor ebx, 0xe65e4e5f
dec eax
add ebx, eax
dec edx
xor edi, 0x93e03a65
inc edx
rol edx, 0x15
not edi
dec eax
xor esi, ecx
call fcn.004e3dc5
ror esi, 0xe
rol esi, 0xe
xor esi, ecx
inc eax
not edi
ror edx, 0x15
dec edx
xor edi, 0x93e03a65
inc edx
sub ebx, eax
inc eax
xor ebx, 0xe65e4e5f
ror edi, 8
push ecx
xor esi, 0xb777c431
inc edx
inc edi
inc edx
inc edx
invalid
ret

Function at 0x42480c
Capabilities:
Hash data using murmur3

Disassembly:
rol ecx, 0x18
not esi
add edi, eax
xchg ecx, edx
dec ecx
rol edi, 0xb
dec ecx
mov ebx, 0x4ac88ba6
inc eax
xor edx, ebx
rol ebx, 2
inc edi
dec ecx
ror eax, 0xd
dec ebx
add ecx, 0x1c7fee0a
call fcn.00522f27
xor esi, ebx
call fcn.005bef0d
not ebx
rol edi, 7
dec eax
xor esi, edi
inc ecx
call fcn.00663039
xchg ebx, edx
inc ebx
call fcn.004f526a
call fcn.004606db
dec ebx
xchg ebx, edx
call fcn.004f4c2c
dec ecx
xor esi, edi
inc eax
ror edi, 7
not ebx
xor esi, ebx
sub ecx, 0x1c7fee0a
inc ebx
rol eax, 0xd
inc ecx
dec edi
ror ebx, 2
xor edx, ebx
dec eax
and ebx, 0xeae8330a
xor esi, 0x3da1bff0
sub eax, 0x8ba96e19
add edx, ebp
rol eax, 0xc
xor ecx, ebp
ror ebx, 0x17
neg edx
xor edx, 0x5087bd25
inc edi
inc esi
inc edi

Function at 0x4248a4
Capabilities:
Hash data using murmur3

Disassembly:
dec edi
dec esi
dec edi
xor edx, 0x5087bd25
neg edx
rol ebx, 0x17
xor ecx, ebp
ror eax, 0xc
sub edx, ebp
add eax, 0x8ba96e19
xor esi, 0x3da1bff0
add ebx, 0xb537fcfe
call fcn.00510212
neg ecx
xchg ecx, edx
xor ebx, ebp
inc edx
xor ecx, 0x4af0740f
rol ebx, 4
inc ebx
inc edi
dec ebx
rol edi, 0xb
dec edx
call fcn.00405347
call fcn.00569ff1
inc edx
ror edi, 0xb
inc ebx
dec edi
dec ebx
ror ebx, 4
xor ecx, 0x4af0740f
dec edx
xor ebx, ebp
xchg ecx, edx
neg ecx
call fcn.005f8f82
push ebx
xor ecx, eax
call fcn.005af0ea
not eax
call fcn.00610bea
dec ebx
xor edx, edi
ror esi, 7
inc eax
sub edi, ebx
call fcn.00552571
inc edx
dec edi
call fcn.0052c6da
inc edi
dec edx
add edi, ebx
dec eax
rol esi, 7
xor edx, edi
inc ebx
call fcn.005d2b6a
not eax
call fcn.005d068e
xor ecx, eax
mov edi, 0x5d0dbf8f
mov edi, 0x814a5d0d
int1
pushal
fstp xword [ebp - 0x78]
rol eax, 0xb
xor edx, 0x57afecd7
add esi, 0x8f88a4ae
call fcn.004a0285
rol edx, 0x1f
call fcn.0041798a
dec esi
call fcn.00460908
call fcn.00586818
inc esi
call fcn.00591c91
ror edx, 0x1f
sub esi, 0x8f88a4ae
xor edx, 0x57afecd7
ror eax, 0xb
xor ecx, 0x887ddb60
inc edx
or edi, 0x917f9e16
dec eax
sub edi, 0x84f1aae7
xor edi, 0x3fef9b5b
rol ebx, 8
not edx
inc ebx
rol ebx, 5
xor edi, 0x26430859
neg esi
xor ecx, 0x90d2a88b
neg eax
rol eax, 0xf
xor ecx, ebx
xor ecx, 0xce4c608d
sub edx, 0x8ff9f0c9
add esi, ebp
ror edx, 0x11
call fcn.0041388b
call fcn.005baa0b
call fcn.005f8f82
call fcn.00561758
rol edx, 0x11
sub esi, ebp
add edx, 0x8ff9f0c9
xor ecx, 0xce4c608d
xor ecx, ebx
ror eax, 0xf
neg eax
xor ecx, 0x90d2a88b
neg esi
xor edi, 0x26430859
ror ebx, 5
dec ebx
not edx
ror ebx, 8
xor edi, 0x3fef9b5b
add edi, 0x84f1aae7
inc eax
add edi, 0x85efaccd
xchg ebx, eax
sub ebx, edi
dec eax
not esi
dec esi
call fcn.00611f38
rol ecx, 2
neg esi
rol edi, 0x19
xchg ecx, edx
invalid
Function at 0x424c44
Capabilities:
Hash data using murmur3

Disassembly:
ror dword [ecx], 0x87
xlatb
sub ebx, ecx
dec esi
not esi
add ecx, 0x6efe37e9
neg esi
call fcn.00542aa3
call fcn.00420eb8
neg esi
sub ecx, 0x6efe37e9
not esi
inc esi
add ebx, ecx
xchg edi, edx
ror ecx, 9
neg esi
xor eax, edx
push edi
xor edx, 0x60043fd6
not esi
ror ebx, 0x1c
xor ebx, ebp
inc esi
ror ecx, 0xd
dec ecx
xchg edi, eax
add edi, 0xcab959ed
rol edi, 7
xor edx, 0x5304fbac
repne lodsb al, byte [esi]
sti
add al, 0x53
add edi, esi
not edx
ror edi, 0x17
xchg edi, esi
xchg edi, esi
rol edi, 0x17
not edx
sub edi, esi
xor edx, 0x5304fbac
ror edi, 7
sub edi, 0xcab959ed
mov ecx, 0x41c787ca
rol ecx, 0xd
dec esi
xor ebx, ebp
rol ebx, 0x1c
not esi
xor edx, 0x60043fd6
mov edx, 0x6feb98bd
call fcn.005c6f70
or al, 0x23
sbb al, byte [eax]
Function at 0x424f1c
Capabilities:
Hash data using murmur3

Disassembly:
inc ebx
dec ebx
xor edx, 0x71f7bbc
not esi
ror eax, 9
not esi
xor eax, 0x6758c7b
dec esi
xchg ecx, eax
add esi, 0x91adeba8
sub eax, 0xf953453c
rol esi, 0x15
xor edi, edx
ror ecx, 8
neg edi
mov ebx, 0xdaad3d4d
call fcn.00552571
inc eax
xchg ecx, eax
call fcn.005943fa
rol ecx, 0xd
add ebx, ebp
dec edi
rol eax, 8
dec esi
xor esi, ecx
xchg ebx, edx
xchg ebx, edx
xor esi, ecx
inc esi
ror eax, 8
inc edi
sub ebx, ebp
ror ecx, 0xd

Function at 0x424f78
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0041fadf
xchg ecx, eax
dec eax
add ebx, 0x49fe4992
add esi, 0xa3f69bf9
ror ebx, 0x1a
call fcn.0040fc02
xchg ecx, esi
neg eax
xor esi, 0xd0956a2d
rol edx, 0x1d
xor eax, 0x268f64bf
not esi
call fcn.005c1b64
call fcn.004ca8d2
not esi
xor eax, 0x268f64bf
ror edx, 0x1d
xor esi, 0xd0956a2d
neg eax
xchg ecx, esi
rol ebx, 0x1a
sub esi, 0xa3f69bf9
add ebx, 0xdb547961
not esi
xchg esi, eax
dec esi
xchg edx, esi
call fcn.00458575
xor ebx, esp
rol ebx, 0x1a
not eax
invalid
invalid

Function at 0x42514c
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [edi + esi*8], 0x1ac1c1d9
neg esi
ror edx, 0x1d
add esi, esp
sub ecx, 0x50db0902
call fcn.004ca8d2
call fcn.0047c271
add ecx, 0x50db0902
sub esi, esp
rol edx, 0x1d
neg esi
ror ecx, 0x1a
neg ecx
ror edi, 4
sub edx, 0x65f06f71
xor ecx, edi
not ecx
sub edi, 0xdbadadd9
xor esi, esp
sub ebx, 0x7b625fc0
call fcn.005866c0

Function at 0x42519c
Capabilities:
Hash data using murmur3

Disassembly:
neg edx
add edx, ebp
neg eax
inc edi
add ebx, edi
neg edi
inc edx
add ecx, esp
call fcn.0048022b
sub ecx, esp
dec edx
neg edi
sub ebx, edi
dec edi
neg eax
sub edx, ebp
neg edx
call fcn.00467451
add ebx, 0x7b625fc0

Function at 0x4251c8
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, esp
push edi
ror esi, 0xf
call fcn.00583754
neg esi
call fcn.0066168d
rol esi, 0x1e
dec eax
not esi
xor esi, 0x89a39cfa
not edi
xchg edi, edx
add ecx, 0x47add4e2
xor esi, 0xbc75f492
neg ecx
rol ebx, 3
inc eax
invalid
invalid
push 0x73

Function at 0x42523c
Capabilities:
Hash data using murmur3

Disassembly:
and dword [eax], eax
rol esi, 0xf
push 0x51b33
inc edx
xor edi, eax
xor ecx, esp
call fcn.0062a740
ror ebx, 0x10
xor edx, 0x6a222252
call fcn.004a4b3b
add ecx, 0xc3639c50

Function at 0x425264
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, 0x3eff1bed
xchg ebx, eax
xchg ebx, eax
xor eax, 0x3eff1bed
sub ecx, 0xc3639c50
xor edx, 0x6a222252
rol ebx, 0x10
xor ecx, esp
xor edi, eax
dec edx
mov edx, 0x9ae3df7c
not ebx
call fcn.0056dc6e
sub ebx, 0x941a0146
rol eax, 0xc
not ebx
invalid

Function at 0x4252c8
Capabilities:
Hash data using murmur3

Disassembly:
leave
sbb al, 0xf7
fnstenv [ebx]
fiadd word [edi - 0x2008b43f]
xor ebx, 0x8094edf3
call fcn.0047c271
xor eax, 0x40cf9a79
not ebx
ror eax, 0xc
add ebx, 0x941a0146
not ebx
sub edx, 0xdb58c27b
xor esi, 0xf3fe79f7
neg edi
xor edx, edi
add esi, 0xfb8a4049
inc eax
mov bh, bl
Function at 0x425304
Capabilities:
Hash data using murmur3

Disassembly:
inc eax
mov bh, bl
call fcn.005c6f70
not esi
call fcn.00651c48
xor edi, ecx
xor ecx, eax
inc ecx
call fcn.004e8125
add esi, 0xc7162098
not edx
inc eax
sub eax, esp
add eax, esp
dec eax
not edx
sub esi, 0xc7162098
dec ecx
xor ecx, eax
xor edi, ecx
call fcn.00468463
not esi
call fcn.0041388b
sub esi, 0xfb8a4049
xor edx, edi
neg edi
xor esi, 0xf3fe79f7
sub edx, 0xbf8b1d01
xor edi, esi
inc ebx
rol ebx, 0x1d
call fcn.00577103
not esi
ror ebx, 9
xor esi, 0x483cb196

Function at 0x425370
Capabilities:
Hash data using murmur3

Disassembly:
dec edi
neg esi
dec ebx
ror edi, 0x1f
call fcn.0044a9d1
ror eax, 0xd
call fcn.0055a42f
call fcn.0050be5e
rol eax, 0xd

Function at 0x429e34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x429e6d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409f40
jmp 0x429e76
mov eax, ebx
mov edx, esi
call fcn.0040a198
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x429e80
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x429ea4
movzx eax, word [esp]
jmp 0x429ea6
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x42b3bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x42b4e3
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0042b1c4
mov esi, eax
mov eax, dword [0x6b8c2c]
cmp byte [eax], 0
je 0x42b489
mov eax, dword [0x6b87ac]
call fcn.00407a04
call fcn.00407164
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x42b38c]
call fcn.0040cf60
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x42b4fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x42b4c5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x6b8704]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x6bc63c]
call fcn.0040d524
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b4ea
lea eax, [ebp - 4]
mov edx, dword [0x42b38c]
call fcn.0040d084
pop eax
jmp eax
Function at 0x42c504
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42c547
mov eax, dword [ebp - 0x10c]
mov dword [0x6bc95c], eax
mov eax, 0x6bc960
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.0040aa64
mov eax, 0x6bc964
call fcn.00409da8
xor eax, eax
mov dword [0x6bc968], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x6bc820], 0xa
jl 0x42c69d
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x42c6a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x42c69d
xor eax, eax
push ebp
push 0x42c696
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42c704
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42c5f6
cmp dword [ebp - 8], 2
jle 0x42c5f6
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42c5c9
adc edx, 0
mov eax, 0x6bc964
call fcn.0040ab3c
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6bc964]
call fcn.0040a9b0
push eax
push 0
push 0
push 0x42c704
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x42c650
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42c724
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42c650
cmp dword [ebp - 8], 2
jle 0x42c650
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42c625
adc edx, 0
mov eax, 0x6bc964
call fcn.0040ab3c
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6bc964]
call fcn.0040a9b0
push eax
push 0
push 0
push 0x42c724
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x6bc968
push 0
push 0
push 0x42c738
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x42c67d
xor eax, eax
mov dword [0x6bc968], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c69d
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x6b1340], 1
mov esp, ebp
pop ebp
ret
Function at 0x42c7e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42c8ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a1e0
lea eax, [ebp - 4]
call fcn.0040a34c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a9b0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x42c8a2
mov eax, ebx
call fcn.00406ff0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42c89b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a9b0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42c883
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42c8cc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42c883
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c8a2
mov eax, dword [ebp - 0x10]
call fcn.0040700c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c8c1
lea eax, [ebp - 4]
call fcn.00409da8
pop eax
jmp eax

Function at 0x42d924
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a28c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040ff0c
mov edi, eax
cmp edi, 0x104
jbe 0x42d8cf
mov eax, edi
add eax, eax
call fcn.00406ff0
mov esi, eax
jmp 0x42d8d1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040ff0c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42d90a
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42d8f4
mov eax, esp
cmp esi, eax
je 0x42d917
mov eax, esi
call fcn.0040700c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42d950
cmp bl, 0
je 0x42d94c
cmp bl, 0x41
jl 0x42d947
cmp bl, 0x5a
jg 0x42d947
or bl, 0x20
xor al, bl
inc esi
jmp 0x42d92b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42d890

Function at 0x42e260
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040aa64
add esp, 0x800
pop ebx
ret