joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e180c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e19e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a00
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0xc]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a10
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040810c
mov dword [ebx + 0x35], eax
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a1c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a30
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040810c
mov edx, eax
mov eax, ebx
call fcn.0047fb34
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a40
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040810c
mov dword [ebx + 0x20], eax
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a54
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x14]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a64
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040810c
mov dword [ebx + 0x39], eax
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a74
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x3d]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1a88
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040810c
mov dword [ebx + 0x45], eax
push 0x10
lea ecx, [ebp - 0x10]
mov edx, 0x4e1a98
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x1b4]
push esi
lea esi, [ebp - 0x10]
lea edi, [ebx + 0x4d]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x10
lea ecx, [ebp - 0x10]
mov edx, 0x4e1ab0
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x1b4]
push esi
lea esi, [ebp - 0x10]
lea edi, [ebx + 0x61]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
lea ecx, [ebp - 0x14]
mov edx, 0x4e1ac8
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x49]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1adc
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x5d]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1af0
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x71]
call fcn.00403c40
lea ecx, [ebp - 0x14]
mov edx, 0x4e1b04
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x75]
call fcn.00403c40
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov dword [ebx + 0x41], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e19f0
lea eax, [ebp - 0x14]
call fcn.00403bec
ret
Function at 0x4e2644
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e280b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xc]
mov ecx, 0x4e2828
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e27ee
push dword fs:[eax]
mov dword fs:[eax], esp
or edx, 0xffffffff
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 4]
lea edx, [ebp - 0x40]
mov eax, dword [ebx + 0x42]
call fcn.004080dc
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e2840
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x38]
lea edx, [ebp - 0x40]
mov eax, esi
call fcn.004080dc
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e284c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x38]
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004080dc
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e2858
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x38]
lea edx, [ebp - 0x40]
mov eax, dword [ebp + 0xc]
call fcn.004080dc
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e2864
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x38]
lea edx, [ebp - 0x40]
mov eax, dword [ebp + 8]
call fcn.004080dc
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e2870
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x38]
call fcn.00409934
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x40]
mov eax, 0x4e2880
call fcn.0040a508
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e2898
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x38]
mov ecx, dword [ebx + 0x21]
mov edx, 0x4e28a8
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov dword [ebp - 0x10], 0x29
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x39]
push eax
call sub.kernel32.dll_GetComputerNameA
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x39]
call fcn.00408bc0
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e28b8
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov dword [ebp - 0x10], 0x29
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x39]
push eax
call sub.advapi32.dll_GetUserNameA
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x39]
call fcn.00408bc0
mov ecx, dword [ebp - 0x40]
mov edx, 0x4e28c8
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x38]
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
mov edx, 0x4e28dc
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x180]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e27f5
mov eax, dword [ebp - 0xc]
call fcn.00403090
ret
Function at 0x4e6784
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040401c
mov eax, dword [ebp - 8]
call fcn.0040401c
mov eax, dword [ebp + 0x10]
call fcn.0040401c
mov eax, dword [ebp + 0xc]
call fcn.0040401c
xor eax, eax
push ebp
push 0x4e685c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 4]
call fcn.00408a40
lea eax, [ebp - 0x208]
mov edx, dword [ebp - 8]
call fcn.00408a40
lea eax, [ebp - 0x308]
mov edx, dword [ebp + 0x10]
call fcn.00408a40
lea eax, [ebp - 0x508]
mov edx, dword [ebp + 0xc]
call fcn.00408a40
lea eax, [ebp - 0x108]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x408]
call fcn.00408bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6863
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c10
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00403c10
ret
Function at 0x41f4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x414015
lea edi, [esi - 0x13015]
push edi
or ebp, 0xffffffff
jmp 0x41f4c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f4c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f4b8
mov eax, 1
add ebx, ebx
jne 0x41f4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f4d0
jne 0x41f4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f4d0
xor ecx, ecx
sub eax, 3
jb 0x41f500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f572
mov ebp, eax
add ebx, ebx
jne 0x41f50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f53c
inc ecx
add ebx, ebx
jne 0x41f528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f51d
jne 0x41f539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f51d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f54d
jmp 0x41f4be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f55c
add edi, ecx
jmp 0x41f4be
pop esi
mov edi, esi
mov ecx, 0x5fc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f57a
cmp byte [edi], 5
jne 0x41f57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41f57f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f5ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23d7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23e54]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f5ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23e5c]
or eax, eax
je 0x41f5e8
mov dword [ebx], eax
add ebx, 4
jmp 0x41f5c9
call dword [esi + 0x23e58]
mov ebp, dword [esi + 0x23e60]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41f622
sub esp, 0xffffff80
jmp section.sect_0
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x406243
pop dword [ebp - 8]
mov eax, 0x406243
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf5f8d0e5
add dword [ebp - 0x18], 0x58597466
mov dword [ebp - 0x14], 0x94277228
sub dword [ebp - 0x14], 0x61f425e3
mov dword [ebp - 0x10], 0x68724286
add dword [ebp - 0x10], 0xe3da01a8
mov dword [ebp - 0xc], 0xa9243738
add dword [ebp - 0xc], 0x56dbc8c8
lea eax, [ebp - 0x18]
push eax
mov eax, 0x7ce0778a
add eax, 0x8360097a
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x7e98a2a1
sub dword [ebp - 0x18], 0xa26394b
mov dword [ebp - 0x14], 0xcb9d8338
sub dword [ebp - 0x14], 0x8a3121c3
mov dword [ebp - 0x10], 0xf7f81541
add dword [ebp - 0x10], 0x6b77572b
mov dword [ebp - 0xc], 0x67ca3830
add dword [ebp - 0xc], 0x9835c7d0
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35d0f
push 0
call eax
mov ecx, 0x432c
xor ebx, ebx
add ebx, eax
mov edi, 0x46e400
add edi, dword [ebp - 8]
mov edx, 0x3f6f12ab
xor dword [ebp - 4], 0x6f8c016d
mov esi, dword [edi]
xor esi, edx
mov dword [ebx], esi
sub dword [ebp - 4], edi
add ebx, 0x68cd247c
add ebx, 0x9732db88
add edi, 4
loop 0x40634b
add eax, 0xfa589f8a
sub eax, 0xfa57a007
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x403484
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4034c0
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4034e0
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405854
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4037b4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004055e4
test esi, esi
jne 0x4037ea
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004056d4
jmp 0x403808
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004036b8
mov edi, eax
test esi, esi
je 0x403808
cmp dword [ebx], 0
je 0x403808
dec esi
jmp 0x4037f1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40383c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x56f008], 0x8088405
inc edx
mov dword [ebx + 0x56f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40449c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x56f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404534
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404514
xor eax, eax
push ebp
push 0x40450d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404550
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404514
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x56f024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x56f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405390
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x58504c], 0
je 0x4053f1
cmp word [0x585220], 0xd7b2
jne 0x4053b9
cmp dword [0x585228], 0
jbe 0x4053b9
mov eax, 0x58521c
call dword [0x585238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x56f768
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405418
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x56f030], 0
jne 0x40540d
push 0
push 0x56f760
push 0x56f768
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405568
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x56f038], 0
je 0x40558e
mov edx, esi
mov eax, ebx
call dword [0x56f038]
jmp 0x40559d
mov eax, 8
call fcn.0040320c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x58504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405530
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40c698
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c6ea
test eax, edx
je 0x40c6ed
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40c6ad
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c6d3
add ecx, 4
js 0x40c6c3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40c6d0
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40c6f9
test edx, edx
jne 0x40c6a0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40d52c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405a74
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40d54a
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40d56b
cmp ebx, 3
je 0x40d56b
cmp ebx, 0x7b
je 0x40d56b
mov eax, esi
call fcn.0040d4ec
test al, al
jne 0x40d56f
xor eax, eax
jmp 0x40d571
mov al, 1
pop esi
pop ebx
ret

Function at 0x40d574
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40d58d
test al, 0x10
jne 0x40d591
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40d738
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x40d74c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405a74
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40d76e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x41121c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411255
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004056d4
jmp 0x41125e
mov eax, ebx
mov edx, esi
call fcn.00405638
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411268
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41128a
movzx eax, byte [esp]
jmp 0x41128c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41191c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x411794
mov eax, dword [0x583e24]
cmp byte [eax], 0
je 0x411998
mov eax, dword [0x583770]
call fcn.00403c7c
call fcn.004033d8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040dc9c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4119e0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4119ce
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x583678]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5877f8]
call fcn.00406dd0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x4122d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4123a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040567c
lea eax, [ebp - 4]
call fcn.00405acc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x412390
mov eax, ebx
call fcn.0040320c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x412389
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x412373
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4123b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x412373
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412390
mov eax, dword [ebp - 0x10]
call fcn.00403228
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4123ad
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x4257cc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00425508
dec esi
jne 0x4257ee
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x426960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x58bc30
cmp dword [edi], 0
jne 0x4269dc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x58bc2c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x57029c
mov ecx, 2
call fcn.004035b8
mov edx, 0x426938
lea eax, [esi + 5]
call fcn.00426958
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00426958
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4269b1
mov dword [0x58bc2c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42a730
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42a89a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040567c
mov eax, dword [ebp - 4]
call fcn.0042a1b0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x42a782
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00405b1c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0042ab74
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x42a857
xor eax, eax
push ebp
push 0x42a850
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0042a35c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0042a8a8
test al, al
je 0x42a82e
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004056d4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x42a82e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x42a828
mov eax, dword [ebp - 8]
call fcn.00405a74
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004057dc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0042a730
dec ebx
cmp ebx, 0xffffffff
jne 0x42a7e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a857
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0042a35c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0042a348
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a8a1
lea eax, [ebp - 0x3c]
call fcn.004055e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret