joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080f0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b05c2
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x627fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c0], esi
push edi
mov dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x220]
push 0x200
push 1
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2b0], 0x67452301
mov dword [ebp - 0x2ac], 0xefcdab89
mov dword [ebp - 0x2a8], 0x98badcfe
mov dword [ebp - 0x2a4], 0x10325476
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.0057bbdf
add esp, 0x10
test eax, eax
je 0x4081bd
nop
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x2b8]
call fcn.00407e50
push edi
push 0x200
lea eax, [ebp - 0x220]
push 1
push eax
call fcn.0057bbdf
add esp, 0x14
test eax, eax
jne 0x408190
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x20]
call fcn.00407f00
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4081f1
mov eax, dword [esi]
jmp 0x4081f3
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x2bc], 1
nop dword [eax]
mov bh, byte [ebp + edi - 0x20]
mov ecx, dword [esi + 0x14]
mov al, bh
shr al, 4
cmp al, 0xa
sbb bl, bl
add al, 0x57
and bl, 0xd9
add bl, al
mov eax, dword [esi + 0x10]
cmp eax, ecx
jne 0x40825e
inc eax
cmp eax, 0xfffffffe
ja 0x408304
cmp ecx, eax
jae 0x408249
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406a00
jmp 0x40825e
test eax, eax
jne 0x40825e
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x408259
mov eax, dword [esi]
jmp 0x40825b
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x408268
mov ecx, dword [esi]
jmp 0x40826a
mov ecx, esi
mov eax, dword [esi + 0x10]
and bh, 0xf
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
cmp bh, 0xa
mov eax, dword [esi + 0x10]
sbb bl, bl
and bl, 0xd9
add bl, 0x57
mov byte [eax + ecx], 0
add bl, bh
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jne 0x4082c0
inc eax
cmp eax, 0xfffffffe
ja 0x408304
cmp ecx, eax
jae 0x4082ab
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406a00
jmp 0x4082c0
test eax, eax
jne 0x4082c0
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x4082bb
mov eax, dword [esi]
jmp 0x4082bd
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x4082ca
mov ecx, dword [esi]
jmp 0x4082cc
mov ecx, esi
mov eax, dword [esi + 0x10]
inc edi
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
mov byte [eax + ecx], 0
cmp edi, 0x10
jb 0x408210
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f52c
mov esp, ebp
pop ebp
ret
push 0x5fe374
call fcn.0057098c
int3
Function at 0x408f20
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x408f61
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.00574f20
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.004084a0
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.00574f20
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.004084a0
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.00574f20
add esp, 0x1c
pop edi
pop esi
ret
Function at 0x411dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b10f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x627fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x411efe
cmp byte [ebx + 0x3d], 0
je 0x411efe
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x411e29
xor al, al
jmp 0x411f00
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004061a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x411e8f
sub eax, 1
je 0x411e93
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x411ee6
xor bl, bl
jmp 0x411ee8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x411ec8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0057c7cf
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x411e8b
cmp byte [ebx + 0x3d], 0
je 0x411ee6
test esi, esi
jne 0x411e51
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00406950
jmp 0x411e4e
mov bl, 1
cmp ecx, 0x10
jb 0x411efa
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.004067b0
mov al, bl
jmp 0x411f00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f52c
mov esp, ebp
pop ebp
ret
Function at 0x414080
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b14d9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x627fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], 0x600538
mov dword [esi + 0x14], 0
lea ebx, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [ebx], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.00414d90
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.00413880
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [0x5c3470]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x414208
call dword [0x5c3518]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x638d08]
cmp ecx, dword [edx + 4]
jle 0x4141aa
push 0x638d08
call fcn.0056f671
add esp, 4
cmp dword [0x638d08], 0xffffffff
jne 0x4141aa
call fcn.00404a40
push 0x638d08
call fcn.0056f632
add esp, 4
mov ecx, dword [0x638d30]
mov eax, dword [0x638d34]
mov dword [ebp - 0x1c], edi
cmp ecx, 0x25c5e09b
jne 0x4141c7
cmp eax, 0x8fafd21e
je 0x4141d6
cmp ecx, 0x257edf0d
jne 0x4141dd
cmp eax, 0xb2ab117a
jne 0x4141dd
test edi, edi
setne al
jmp 0x4141ed
mov eax, dword [0x638d28]
mov ecx, 0x638d28
push edi
mov eax, dword [eax + 0x18]
call eax
mov byte [ebp - 0x18], al
mov dword [ebp - 0x14], 0x638d28
test al, al
je 0x414208
mov edx, 0x6005cc
lea ecx, [ebp - 0x1c]
call fcn.004056f0
cmp byte [ebp + 0x10], 0
je 0x414257
push ebx
call dword [0x5c34dc]
push 0xc
call fcn.00439398
add esp, 4
mov dword [ebp + 0x10], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x414237
push ecx
push esi
mov ecx, eax
call fcn.004151f0
mov ebx, eax
jmp 0x414239
xor ebx, ebx
mov edi, dword [esi + 0x60]
test edi, edi
je 0x414254
push dword [edi + 4]
call dword [0x5c3488]
push 0xc
push edi
call fcn.0056f9dd
add esp, 8
mov dword [esi + 0x60], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x421300
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b272b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x627fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], 0x6009fc
mov ecx, dword [ecx]
call fcn.0041c0c0
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], eax
call fcn.00413880
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00420bc0
push 0x4214f0
push 0x422ba0
push 4
push 0x1c
lea eax, [esi + 0x38]
mov byte [ebp - 4], 2
push eax
call fcn.0056faf5
push 0x420210
push 0x4201e0
push 3
push 0xc
lea eax, [esi + 0xa8]
mov byte [ebp - 4], 3
push eax
call fcn.0056faf5
mov byte [ebp - 4], 4
mov dword [esi + 0xcc], 0
push 0xc
mov byte [esi + 0xd0], 0
mov dword [esi + 0xd4], 0
mov byte [esi + 0xd8], 0
call fcn.00439398
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
mov byte [ebp - 4], 5
test edi, edi
je 0x421426
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00439398
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x421412
mov dword [eax], 0x6009dc
mov dword [eax + 0xc], esi
jmp 0x421414
xor eax, eax
push 0
push eax
mov ecx, edi
call fcn.00413ce0
mov dword [esi + 0xd4], edi
jmp 0x421430
mov dword [esi + 0xd4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x428550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b333e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x627fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 2
push ebx
call fcn.00571258
add esp, 8
mov dword [ebp - 4], 0
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
lea esi, [edi + 4]
push 0
mov dword [edi], 0
push 0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0042a330
mov dword [esi], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 2
mov ecx, edi
push 8
mov dword [edi], 0x3f800000
call fcn.00429490
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434e10
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x627fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x600fe0
push 0x600f84
mov esi, ecx
mov dword [ebp - 0x14], 0
call dword [0x5c3430]
push eax
call dword [0x5c342c]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x601040
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
call dword [0x5c3450]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x434eed
push edi
push 0x828
call fcn.004393cf
mov edi, eax
add esp, 4
test edi, edi
je 0x434eec
push 0x828
push 0
push edi
call fcn.00574f20
add esp, 0xc
lea eax, [ebp - 0x14]
push 0
push eax
push 0x826
push edi
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
call dword [ebp - 0x18]
test eax, eax
je 0x434ee1
cmp dword [ebp - 0x14], 0
jbe 0x434ee1
mov eax, dword [edi + 0x10]
test eax, eax
je 0x434ee1
cmp eax, 0xffffffff
je 0x434ee1
lea ecx, [eax + edi]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi], al
lea esi, [esi + 1]
test al, al
jne 0x434ed3
push 0x28
push edi
call fcn.0056f9dd
add esp, 8
pop edi
test ebx, ebx
je 0x434efd
cmp ebx, 0xffffffff
je 0x434efd
push ebx
call dword [0x5c3488]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0056f52c
mov esp, ebp
pop ebp
ret
Function at 0x4376d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
sub ecx, edx
cmp ecx, 4
ja 0x4376ec
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
movsx eax, byte [edx + 2]
push ebx
movzx ebx, al
movsx eax, byte [edx + 3]
shl eax, 8
or ebx, eax
movsx eax, byte [edx + 1]
movzx eax, al
shl ebx, 8
or ebx, eax
movsx eax, byte [edx]
movzx eax, al
shl ebx, 8
push edi
or ebx, eax
xor edi, edi
lea eax, [ecx - 4]
push eax
lea ecx, [ebp - 0xc]
call fcn.004385a0
mov eax, dword [esi + 4]
lea ecx, [edi + 4]
sub eax, dword [esi]
cmp eax, ecx
jbe 0x43774c
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
mov al, byte [eax + ecx]
xor al, 0xb8
mov byte [edx + ecx - 4], al
inc ecx
movzx eax, al
xor edi, eax
mov eax, dword [esi + 4]
sub eax, dword [esi]
cmp ecx, eax
jb 0x437732
cmp edi, ebx
je 0x437763
lea ecx, [ebp - 0xc]
xor bl, bl
call fcn.00411b00
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
cmp esi, eax
je 0x437797
mov ecx, esi
call fcn.00411b00
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc]
mov bl, 1
call fcn.00411b00
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x58d9f7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058d876
Function at 0x402a5c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404564
test esi, esi
jne 0x402a92
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404654
jmp 0x402ab0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402970
mov edi, eax
test esi, esi
je 0x402ab0
cmp dword [ebx], 0
je 0x402ab0
dec esi
jmp 0x402a99
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4035e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403680
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403660
xor eax, eax
push ebp
push 0x403659
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40369c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403660
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47d020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404344
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47f048], 0
je 0x4043a5
cmp word [0x47f21c], 0xd7b2
jne 0x40436d
cmp dword [0x47f224], 0
jbe 0x40436d
mov eax, 0x47f218
call dword [0x47f234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47d070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043cc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47d030], 0
jne 0x4043c1
push 0
push 0x47d068
push 0x47d070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404518
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402734
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x47f049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4044e0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406520
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406586
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004047d4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403044
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406570
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40658d
lea eax, [ebp - 0x10]
call fcn.00404564
ret

Function at 0x40bb84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bbbd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404654
jmp 0x40bbc6
mov eax, ebx
mov edx, esi
call fcn.004045b8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bbd0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bbf1
mov al, byte [esp]
jmp 0x40bbf3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c278
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c0f0
mov eax, dword [0x47ecc8]
cmp byte [eax], 0
je 0x40c2f4
mov eax, dword [0x47e95c]
call fcn.00402ea4
call fcn.0040289c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004092b0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c33c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c32a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x47e8d0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x47f664]
call fcn.00405a34
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cb90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cc66
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004045fc
lea eax, [ebp - 8]
call fcn.00404a74
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a24
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cc50
mov eax, ebx
call fcn.00402734
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cc49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a24
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cc33
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cc78
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cc33
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc50
mov eax, dword [ebp - 0x10]
call fcn.00402754
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc6d
lea eax, [ebp - 8]
call fcn.00404564
ret

Function at 0x40d1ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d250
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004047d4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408d18
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d257
lea eax, [ebp - 0xc]
call fcn.00404564
ret

Function at 0x41b954
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041b7ac
dec esi
jne 0x41b976
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x41cab8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x47f888
cmp dword [edi], 0
jne 0x41cb34
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x47f884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47d3f0
mov ecx, 2
call fcn.00402930
mov edx, 0x41ca90
lea eax, [esi + 5]
call fcn.0041cab0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041cab0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41cb09
mov dword [0x47f884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e0c8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e0ce
ret

Function at 0x4205a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4205f1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4205d8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4205c8
jmp 0x4205f1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4205d9
pop ebx
mov esp, ebp
pop ebp
ret