joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x409b47
pop dword [ebp - 0x14]
mov eax, 0x6f13d7a6
add eax, 0x912cc3a1
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x9df8e987
sub dword [ebp - 0x24], 0x4fa6a43c
mov dword [ebp - 0x20], 0x384f9b55
add dword [ebp - 0x20], 0xf9e3b0f0
mov dword [ebp - 0x1c], 0x557455c4
sub dword [ebp - 0x1c], 0x9281196
mov dword [ebp - 0x18], 0x74480c7c
sub dword [ebp - 0x18], 0x74480c7c
lea eax, [ebp - 0x24]
push eax
mov eax, 0x18df2e4f
sub eax, 0x189e5dfb
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xbf04704a
add dword [ebp - 0x24], 0xb56df90c
mov dword [ebp - 0x20], 0xf28509cf
add dword [ebp - 0x20], 0x4ee757a6
mov dword [ebp - 0x1c], 0x45d9ba92
add dword [ebp - 0x1c], 0x1d95b1da
mov dword [ebp - 0x18], 0x5e1e3dc7
sub dword [ebp - 0x18], 0x5e1e3dc7
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x36222
push 0
call eax
mov ecx, 0x3a5d
xor edi, edi
add edi, eax
mov esi, 0x2a528eea
sub esi, 0x2a10deea
add esi, dword [ebp - 0x14]
mov ebx, 0x35964783
add ebx, 0x9ce31dfe
sub dword [ebp - 4], edx
mov edx, dword [esi]
xor dword [ebp - 0x10], edi
sub edx, ebx
xor dword [ebp - 8], 0x3495b801
mov dword [edi], edx
xor dword [ebp - 8], edx
add edi, 0x3caf2494
add edi, 0xc350db70
add esi, 0xcccbcfd1
sub esi, 0xcccbcfcd
loop 0x409c60
add eax, 0x2b56c2f0
sub eax, 0x2b55e6a9
mov ebx, eax
add eax, 0xd53f14a8
add eax, 0x2ac0eb5d
mov ecx, 0xa0e2796d
add ecx, 0x5f5d8693
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0xb46776a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x214c06b6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x402916
Capabilities:
Clear file content
Write file on windows

Disassembly:
push pe_nt_image_headers32
mov eax, 0x57821a
call fcn.0054d2bd
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 8]
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40296b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040db42
push eax
push edi
push str.Error_creating_text_database_file_n___s:_n_s_n_nPlease_ensure_the_path_exists_and_you_have_permission_to_write_it.
push 0x30
push ebx
call fcn.0040fe1f
add esp, 0x18
xor al, al
jmp 0x402a74
push str.Time_Stamp
lea eax, [ebp - 0x114]
push 0x588a54
push eax
call fcn.00401bb0
add esp, 0xc
lea eax, [ebp - 0x118]
push 0
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00552ef0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call edi
xor ebx, ebx
cmp dword [0x5eb8b0], ebx
jle 0x402a51
push dword [ebx*8 + 0x5e9974]
lea eax, [ebp - 0x11c]
push eax
call fcn.0040388c
pop ecx
pop ecx
and dword [ebp - 4], 0
mov ecx, dword [eax]
test ecx, ecx
je 0x4029df
call fcn.00403419
jmp 0x4029e1
xor eax, eax
push eax
lea eax, [ebp - 0x114]
push 0x588a54
push eax
call fcn.00401bb0
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
je 0x402a10
call fcn.00403761
and dword [ebp - 0x11c], 0
push 0
lea eax, [ebp - 0x118]
push eax
push 1
push 0x588b4c
push esi
call edi
push 0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00552ef0
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call edi
inc ebx
cmp ebx, dword [0x5eb8b0]
jl 0x4029b9
push 0
lea ecx, [ebp - 0x118]
push ecx
push 2
push 0x588b50
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
call fcn.0054d26c

Function at 0x403950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x41c]
push edi
push 0x104
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push str._sMSJET40.DLL
push eax
call fcn.00401bce
xor edi, edi
lea eax, [ebp - 0xc]
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040535d
add esp, 0x20
test al, al
jne 0x4039e4
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push str._sMSJET35.DLL
push eax
call fcn.00401bce
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040535d
add esp, 0x20
mov cx, word [ebp - 0xc]
cmp cx, 4
jae 0x403a0b
movzx eax, word [ebp - 0xa]
push eax
movzx eax, cx
push eax
push str.Database_support_requires_that_JET_4.0_or_later_be_installed._n_JET__d._d_detected._
push 0x30
push esi
call fcn.0040fe1f
add esp, 0x14
xor al, al
jmp 0x403a0d
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054d24a
leave
ret
Function at 0x54dfc5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x54e004
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x54e004
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x54e004
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x54e004
cmp dword [ecx + 0x74], 0xe
jbe 0x54e004
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x56dbb7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00568078
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x56dc26
cmp esi, dword [ebp - 4]
je 0x56dc21
cmp dword [ebp + 0xc], 0
je 0x56dc21
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x56dbfe
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0056d709
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x56dc28
xor eax, eax
inc eax
jmp 0x56dc28
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x56e399
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5c5068
push 0x5c5060
push str.FlsAlloc
push 0x1f
call fcn.0056e1c4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56e3cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x587b44]
call esi
jmp 0x56e3d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x56e417
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5c5078
push 0x5c5070
push str.FlsGetValue
push 0x21
call fcn.0056e1c4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56e44e
push dword [ebp + 8]
mov ecx, esi
call dword [0x587b44]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x56e456
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5c5080
push 0x5c5078
push str.FlsSetValue
push 0x22
call fcn.0056e1c4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x56e490
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x587b44]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42b24c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], ah
mov dword [esp + 8], esp
push cx
mov byte [esp], dh
push edi
jmp 0x42b28d
call fcn.0042b277
lea esp, [esp + 2]
mov dword [esp + 8], ebp
pushal
push word [esp + 7]
js 0x42b25b
jns 0x42b25b

Function at 0x42bf94
Capabilities:
Execute anti-debugging instructions

Disassembly:
jle 0x42bf55
mov dx, 0xcace
lea esp, [esp + 2]
jmp 0x42bf5d
mov dx, 0xcace
lea esp, [esp + 2]
jmp 0x42bf1f
push word [esp]
jmp 0x42bf35

Function at 0x42ce86
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr dx, 0
jmp 0x42cea8
jg 0x42cebe
mov dx, word [esp + 2]
push esp
jmp 0x42cec4
mov dx, word [esp + 2]
push esp
jmp 0x42cf0e
xchg dl, dh
add bl, al
mov dl, byte [esp]
mov dh, 0x1f
jmp 0x42ceed
lea esp, [esp + 0xc]
not al
mov edx, dword [esp]
not dx
lea edx, [eax + eax]
mov dx, di
jmp 0x42cec6

Function at 0x42d887
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
mov byte [esp + 2], bh
mov byte [esp + 2], ah
mov dword [esp], esp
mov dword [esp + 0x20], esp
pushal
jmp 0x42d857
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x20], ebx
pushfd
jmp 0x42d86d

Function at 0x42d90d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + ebx]
lea eax, [esp + esi]
mov al, cl
sub esp, 0xbc
mov esi, esp
neg ax
jl 0x42d8d6
jge 0x42d925
pop ss
mov dword [ecx], ebx
js 0x42d88b
dec edi
mov bh, 0x2a
mov eax, 0xcb982adf
bound ebx, qword [ebp - 0x14390014]
jmp 0x42d8ec
jmp 0x42d933
push ecx
int1
popal
add bl, dh
jmp 0x42d8ec
jbe 0x42d988
pushal
pop es
inc eax
jb 0x42d916
add dh, cl
dec ebp
push 0xffffffffffffff85
lea edx, [edx + ebx]
lea eax, [esp + esi]
mov al, cl
call fcn.0042d90f
xor al, 0x60
add byte [esi - 9], ah
rol byte [ebx - 0x6cf0f814], cl
mov byte [edi + 0x24648dd3], 3

Function at 0x42e2af
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x15
jae 0x42e2cf
mov dx, word [esp + 0x30]
jmp 0x42e2d4
lea eax, [edi*4]
lea esp, [esp + 1]
jmp 0x42e786
Function at 0x42ec58
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
lea edx, [edx + edi]
lea edi, reloc.MSVCRT.dll__iob
mov edx, esi
mov edx, ecx
call fcn.0042eb62
bsr dx, cx
bsr dx, di
mov edx, dword [esp]
mov dh, al
xchg dword [esp], edi
jmp 0x42ec02

Function at 0x42f8b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov dword [esp], eax
jmp 0x42f8c0
push ecx
push sp
pushal
mov byte [esp + 0x16], dl
pop word [esp + 0x10]
mov dword [esp + 0x1c], edx
jmp 0x42f9d7
push edx
mov dword [esp + 0x1c], ebx
call fcn.0042f997

Function at 0x42f91d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf041c704
jmp 0x42f951
pushfd
jmp 0x42f1e5
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x42f8dc
jmp 0x42f8f2
xchg edi, ebp
jmp 0x42f937
jmp 0x42f91f
mov edi, dword [esp + 0x2c]
xchg ebx, edx
push dx
xchg si, bx
bsf bp, cx
jmp 0x42f95e
cpuid
setl ah
inc ch
jp 0x42f935
xchg edi, ebp
jmp 0x42f937
jne 0x42f974
lea esp, [esp + 2]
jmp 0x42f978
lea esp, [esp + 2]
lea ebp, [esp]
xchg dx, cx
jmp 0x42f9ab

Function at 0x42f997
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg si
lea ecx, [esi + 0x17]
jmp 0x42f9bb
lea esp, [esp + 2]
mov byte [esp], ah
lea esp, [esp + 2]
mov dword [esp + 0x18], esp
call fcn.0042f91d
neg cl
ja 0x42f980
neg si
lea ecx, [esi + 0x17]
jmp 0x42f9bb
sub esp, 0xc0
mov esi, esp
mov bl, byte [esp]
mov ebx, edi
jmp 0x42f9f7
mov bl, ah
xchg cx, bx
Function at 0x42fa62
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
mov edx, dword [esp + 0xf]
lea esp, [esp + 1]
jmp 0x42f542
lea eax, [esp + ebx]
jmp 0x42f50e
dec ah
jmp 0x42f565
mov edx, ebx
stc
jns 0x42f529
dec ah
jmp 0x42f565
mov eax, 0xae8273a7
jmp 0x42f218
shl edx, 2
rol eax, cl
jo 0x42f54b
mov eax, 0xae8273a7
jmp 0x42f218
not bl
sub esp, 0x13
jbe 0x42f524
lea eax, [esp + ebx]
pop ax
mov edx, dword [esp + 0xf]
lea esp, [esp + 1]
jmp 0x42f542
sub esp, 8
mov dx, 0xe780
xchg al, ch
mov dl, 4
xchg cl, al
bsr eax, edi
jmp 0x42fa83
mov ebx, edi
bsr dx, bx
jno 0x42f9e1
jo 0x42fd2b
add eax, dword [eax]
add byte [ecx - 5], dh
jno 0x42fa07
imul ecx, dword [esi], reloc.MSVCRT.dll__iob
dec eax
pop ecx
fdiv qword [edx + 0x15]
in al, 0x51
test eax, 0xd0d36bc8
or eax, 0xd12b1e3c
sub esp, 1
lea edx, [ecx*4]
xchg dx, ax
lea esp, [esp + 1]
jmp 0x42f585
jg 0x42fa4b
jle 0x42fa4b
mov al, byte [eax]
xchg esi, eax
int1
add byte [ebx + 0x342dbd34], dh
invalid
inc edi
setbe dh
mov al, ch
cmc
jmp 0x42fb7e
mov ah, 0xc2
cmp edx, ebx
call 0x42fa62
and eax, 0xc80f7aeb
jmp 0x42fa6c
mov ax, dx
neg al
xchg ecx, eax
jmp 0x42faab
add edi, 0xca25085
mov dh, pe_nt_image_headers32
mov ax, si
mov ax, word [esp]
cmc
jmp 0x42fa35
lea edx, [ebp - 0x89]
rcl dx, 0xf
jge 0x42fab8
dec dl
jmp 0x42fac7
bswap eax
rol edi, 0
mov ax, 0x1dbe
mov dl, 0xe4
jmp 0x42fa95
dec dl
lea edx, reloc.MSVCRT.dll__iob
jmp 0x42fb14
lea edx, reloc.MSVCRT.dll__iob
jmp 0x42fb14
mov al, byte [esp]
sub esp, 0x14
jb 0x42fb44
rdtsc
jmp fcn.0042fb29
xor edi, 0x544cf651
lea edx, [ebp*4]
sete al
add edi, dword [ebp]
jmp 0x42fafe
rdtsc
jmp fcn.0042fb29
je 0x42fa58
mov ah, 0xc2
cmp edx, ebx
jmp 0x42fa5c
mov dl, 4
xchg cl, al
jmp 0x42f9ee
sub esp, 8
mov dx, 0xe780
xchg al, ch
jmp 0x42fbe2

Function at 0x439946
Capabilities:
Encode data using xor

Disassembly:
jmp 0x41eff2
jmp 0x41f05b

Function at 0x47e482
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr edx, cl
jge 0x47e5a9
jl fcn.0045e890
invalid
jmp fcn.0045e890

Function at 0x4d2f20
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 2]
push ecx
push ebx
pop word [esp]
lea esp, [esp]
jmp 0x4d2f32
pop word [esp]
mov word [esp], ax
mov word [esp], di
mov word [esp], si
jmp 0x4d2f0a
lea esp, [esp + 2]
push edx
push esi
mov byte [esp + 2], ch
lea esp, [esp]
jmp 0x4d2f68
mov byte [esp + 1], bh
push dword [esp]
push dword [esp + 2]
mov dword [esp + 8], ebx
push bp
push word [esp + 1]
jmp 0x4d2f52

Function at 0x5d8e50
Capabilities:
Encode data using xor

Disassembly:
push 0x5d8b64
mov ecx, dword [esp]
add esp, 4
or edi, eax
add eax, 0xfa67273f
sub edi, edi
call fcn.005d8ea6
sub edi, 1
sub eax, 0x279e307f
xor dword [esi], ecx
mov edi, edi
add esi, 2
sub edi, 0xf608d01f
or eax, eax
add eax, 0xe0b47138
cmp esi, edx
jl fcn.005d8e50
or edi, eax
or eax, eax
sub edi, 1
ret
Function at 0x4012bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403c34], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403c30], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011b4
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403c30]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403c38], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401386
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40136d
mov eax, dword [0x403c34]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x1000cac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x100139e8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov esi, dword [eax + esi*4]
mov eax, dword [0x10013e80]
cmp eax, dword [esi + 4]
jg 0x1000cb78
lea eax, [ebx + edi]
cmp eax, ebx
ja 0x1000cb01
mov eax, 0x10dd
jmp 0x1000cb71
mov eax, dword [0x10013e7c]
cmp edi, eax
jbe 0x1000cb0f
push 0x32
pop eax
jmp 0x1000cb71
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
lea esi, [eax - 1]
push ecx
not esi
push dword [edi]
and esi, ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1000cb37
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1000cb71
mov ecx, dword [0x10013e7c]
mov eax, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 4]
dec eax
add eax, ebx
mov dword [edi], edx
not ecx
and ecx, eax
cmp ecx, esi
je 0x1000cb6c
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [0x10013e7c]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000cb2f
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x10013e80
push esi
call fcn.1000cd54
cmp dword [0x10013e80], 0xffffffff
pop ecx
jne 0x1000caf3
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
push esi
mov dword [0x10013e7c], eax
call fcn.1000cd54
mov edi, dword [ebp - 8]
pop ecx
jmp 0x1000caf3

Function at 0x1000cd54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000cd63
pop dword [ebp - 8]
mov eax, 0xfc76d327
add eax, 0x1389fa3c
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x341ab
push 0
mov eax, 0xb0051e83
add eax, 0x5ffc21e1
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xd179e4b7
add ecx, 0x2e864faa
xor esi, esi
add esi, eax
mov edi, 0x10018600
add edi, dword [ebp - 8]
mov edx, 0x38b9abb9
sub edx, 0xde55f692
mov ebx, dword [edi]
xor dword [ebp - 4], edi
add ebx, edx
add dword [ebp - 4], eax
mov dword [esi], ebx
sub dword [ebp - 4], 0x647373af
add esi, 4
add edi, 0x55af030b
sub edi, 0x55af0307
loop 0x1000cdbe
add eax, 0xe8b279f6
add eax, 0x174e4a61
mov ebx, eax
add eax, 5
mov ecx, 0xf80d62dd
sub ecx, 0xe80d62dd
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x405a00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a66
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a50
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a6d
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40ab18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab51
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40ab5a
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ab64
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab85
mov al, byte [esp]
jmp 0x40ab87
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b20c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b084
mov eax, dword [0x4580dc]
cmp byte [eax], 0
je 0x40b288
mov eax, dword [0x457efc]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408318
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b2d0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b2be
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x457eac]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x459664]
call fcn.00404f14
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret