joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40fc4b
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040da87
insd dword es:[edi], dx
salc
dec byte [ebx - 0x75]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
and byte [ebx], al
fucompi st(0)
pop ss
fdivp st(7)
dec dword [edi]
scasd eax, dword es:[edi]
xchg ebp, eax
daa
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547

Function at 0x4118b1
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x494284]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push ebx
push esi
push edi
mov ebx, SysStringLen
lea ecx, [ebp - 0x64]
push ebx
call fcn.00419301
lea eax, [ebp - 0x48]
push 0x400
push eax
call fcn.00412523
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0x4118fd
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call fcn.00411cc2
pop ecx
test eax, eax
je 0x41191d
lea eax, [ebp - 0x48]
push eax
push eax
call fcn.00411f52
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
call esi
call fcn.004119d1
xor edi, edi
push edi
push str.PreDownldStatus
push edi
call fcn.0041263c
add esp, 0xc
lea ecx, [ebp - 0x64]
push ebx
call fcn.00419334
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041937b
test eax, eax
jne 0x4119b9
mov ebx, 0x20019
push ebx
lea eax, [ebp - 0x48]
inc edi
push eax
lea ecx, [ebp - 0x64]
call fcn.00419394
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.00404c4e
test esi, esi
jne 0x4119a8
push eax
lea ecx, [ebp - 0x80]
call fcn.00419301
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.00419394
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00404c4e
push eax
lea ecx, [ebp - 0x80]
call fcn.00419334
test esi, esi
jne 0x4119a8
push str.VersionXmlURL
lea ecx, [ebp - 0x80]
call fcn.0041936b
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041937b
test eax, eax
je 0x411952
mov ecx, dword [ebp + 0x3b8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f9b7
add ebp, 0x3bc
leave
ret
Function at 0x411f52
Capabilities:
Get common file path
Parse url

Disassembly:
sub esp, 0x644
mov eax, dword [0x494284]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x654]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x65c]
push 0x3c
pop ebx
push ebx
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.00441390
add esp, 0xc
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x250]
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x3c], eax
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov ebp, 0x104
test eax, eax
je 0x412004
push 0x100
lea eax, [esp + 0x154]
push eax
push ebp
lea eax, [esp + 0x58]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x26c]
push ebx
push eax
call fcn.0044b6b6
lea eax, [esp + 0x70]
push 0x471878
push eax
call fcn.004414f0
add esp, 0x2c
test eax, eax
je 0x412020
push 1
push esi
call fcn.00412824
push eax
lea eax, [esp + 0x58]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x4c]
push eax
push edi
call esi
lea eax, [esp + 0x150]
push eax
push edi
call esi
mov ecx, dword [esp + 0x650]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043f9b7
add esp, 0x644
ret

Function at 0x41205a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x494284]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, 0x9c
lea eax, [ebp - 0x28]
push esi
push 0
push eax
call fcn.00441390
add esp, 0xc
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0x4120a8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x94
push eax
call esi
test eax, eax
je 0x4120c4
cmp dword [ebp - 0x18], 2
jne 0x4120c1
cmp dword [ebp - 0x24], 6
jae 0x4120c1
cmp dword [ebp - 0x24], 4
jb 0x4120c1
call fcn.0041211a
jmp 0x4120c4
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.0043f9b7
add ebp, 0x78
leave
ret
Function at 0x428b17
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x494284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x58]
push edi
mov edi, dword [ebp + 8]
push 0x3c
pop ebx
push ebx
push 0
push eax
call fcn.00441390
mov dword [ebp - 0x58], ebx
add esp, 0xc
xor ebx, ebx
inc ebx
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x44], ebx
jb 0x428b53
mov edi, dword [edi]
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x428b6a
xor al, al
jmp 0x428ba8
mov eax, dword [ebp - 0x4c]
push 3
pop ecx
sub eax, ecx
je 0x428b81
sub eax, 1
je 0x428b7d
mov dword [esi], ebx
jmp 0x428b87
mov dword [esi], ecx
jmp 0x428b87
mov dword [esi], 2
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x48]
call fcn.00402944
push eax
lea ecx, [esi + 4]
call fcn.0040bf06
lea ecx, [ebp - 0x1c]
call fcn.00407d8d
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f9b7
leave
ret

Function at 0x42a906
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x46b348
call fcn.0043f9f7
xor eax, eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
push esi
call fcn.0042a9fa
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push esi
call fcn.0042a9fa
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
push ecx
push esi
call fcn.0042a9fa
push 0x409
push esi
call fcn.0042a9fa
add esp, 0x10
mov eax, esi
call fcn.0043f9c5
ret
Function at 0x4121c0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x441310]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x70
jne 0x4121f3
push 1
call fcn.0041bc42
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004147d1
mov esp, ebp
pop ebp
ret
Function at 0x413680
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fd70
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x441310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.C:UsersDe
lea ecx, [ebp - 0x12c]
call fcn.004079e0
mov dword [ebp - 4], 0
push str.faultDes
lea ecx, [ebp - 0x12c]
call fcn.00409970
push str.ktop
lea ecx, [ebp - 0x12c]
call fcn.00409970
push str._ath
lea ecx, [ebp - 0x12c]
call fcn.00409970
push str.letes
lea ecx, [ebp - 0x12c]
call fcn.00409970
push str..exe
lea ecx, [ebp - 0x12c]
call fcn.00409970
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x12c]
call fcn.00410730
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.0041c0f0
add esp, 8
test eax, eax
jne 0x41375c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00408910
jmp 0x41381f
mov dword [ebp - 0x130], 0x974
mov edx, 0xbcaeac
sub edx, dword [0x442194]
push edx
mov eax, dword [ebp - 0x130]
push eax
push 0x440018
call fcn.004012f0
add esp, 0xc
mov ecx, dword [ebp - 0x130]
push ecx
push 0x440018
call fcn.00412e00
add esp, 8
push 0
lea ecx, [ebp - 0x12c]
call fcn.00410730
push eax
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4137f9
mov dword [ebp - 0x134], 0x976
mov eax, 0x86060
sub eax, dword [0x442194]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
push 0x440990
call fcn.004012f0
add esp, 0xc
mov edx, dword [ebp - 0x134]
push edx
push 0x440990
call fcn.00412e00
add esp, 8
jmp 0x41380d
push str.____CopyFile_failed
call fcn.004014f0
add esp, 4
push 2
call fcn.0041bc42
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00408910
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004147d1
mov esp, ebp
pop ebp
ret

Function at 0x415329
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415368
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415368
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415368
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415368
cmp dword [ecx + 0x74], 0xe
jbe 0x415368
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42070c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434ab8
push 0x434ab0
push str.FlsAlloc
push 0x1f
call fcn.00420577
mov esi, eax
add esp, 0x10
test esi, esi
je 0x420740
push dword [ebp + 8]
mov ecx, esi
call dword [0x430188]
call esi
jmp 0x420746
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42078a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434ac8
push 0x434ac0
push str.FlsGetValue
push 0x21
call fcn.00420577
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4207c1
push dword [ebp + 8]
mov ecx, esi
call dword [0x430188]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4207c9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434ad0
push 0x434ac8
push str.FlsSetValue
push 0x22
call fcn.00420577
mov esi, eax
add esp, 0x10
test esi, esi
je 0x420803
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x430188]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x426287
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x426324
push ebx
push esi
call fcn.00426250
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042508a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4262d1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426323
push edi
push eax
call fcn.00420fef
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4262f1
call fcn.00420298
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426322
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042508a
add esp, 0x20
test eax, eax
jne 0x426310
push edi
call fcn.00420298
jmp 0x426318
push ebx
call fcn.00420298
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x428b6e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041ff50
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x428bdd
cmp esi, dword [ebp - 4]
je 0x428bd8
cmp dword [ebp + 0xc], 0
je 0x428bd8
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x428bb5
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004286c0
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x428bdf
xor eax, eax
inc eax
jmp 0x428bdf
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x428c44
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x441310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0041ff50
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041ff50
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x428cbb
cmp word [ecx], dx
je 0x428cbb
mov eax, dword [0x435354]
push edi
dec eax
push eax
push 0x435240
call fcn.00428be3
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x428d2e
cmp word [eax], dx
je 0x428d2e
mov eax, dword [edi]
test eax, eax
je 0x428cdf
cmp word [eax], dx
je 0x428cdf
lea eax, [ebp - 0x10]
push eax
call fcn.004285c6
jmp 0x428ce8
lea eax, [ebp - 0x10]
push eax
call fcn.00428661
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x428d58
mov eax, dword [0x43523c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x434f30
call fcn.00428be3
add esp, 0xc
test al, al
je 0x428d58
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x428d23
cmp word [eax], di
je 0x428d23
lea eax, [ebp - 0x10]
push eax
call fcn.004285c6
pop ecx
jmp 0x428d5a
lea eax, [ebp - 0x10]
push eax
call fcn.00428661
jmp 0x428d20
mov eax, dword [edi]
test eax, eax
je 0x428d45
cmp word [eax], dx
je 0x428d45
lea eax, [ebp - 0x10]
push eax
call fcn.0042857b
pop ecx
jmp 0x428d58
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x428e23
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00428a68
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x428e23
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x428e23
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x428e23
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x428db0
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00420909
test ebx, ebx
je 0x428e1e
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00420909
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x428e23
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x428e23
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0042d25a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x428e25
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004147d1
leave
ret
Function at 0x42e7f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42e81d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42e81d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40b1b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b1f1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404374
jmp 0x40b1fa
mov eax, ebx
mov edx, esi
call fcn.004042d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b204
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b225
mov al, byte [esp]
jmp 0x40b227
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c570
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c5d4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044fc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408dc4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5db
lea eax, [ebp - 0xc]
call fcn.00404284
ret

Function at 0x41690c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.00415068
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041501d
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.00415058
das
stc
outsd dx, dword [esi]
stosb byte es:[edi], al
lea eax, [ebp - 0x6f4]
push eax
call fcn.00415068
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041501d
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0

Function at 0x416be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
invalid
invalid
Function at 0x423138
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48ca24
cmp dword [edi], 0
jne 0x4231b4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48ca20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48a5e8
mov ecx, 2
call fcn.004028fc
mov edx, 0x423110
lea eax, [esi + 5]
call fcn.00423130
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00423130
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x423189
mov dword [0x48ca20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4246b8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4246be
ret

Function at 0x426ca4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x426cf5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x426cdc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426ccc
jmp 0x426cf5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x426cdd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4472e4
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x48b620]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x4474ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0043f77c
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004409a4
mov eax, dword [esi]
call fcn.0045da60
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x447356
mov eax, dword [esi]
call fcn.0045da60
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0045da6c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x44737a
mov eax, dword [esi]
call fcn.0045da6c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045da54
cmp eax, dword [ebp - 0x18]
jle 0x447390
mov eax, dword [esi]
call fcn.0045da54
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045da48
cmp eax, dword [ebp - 0xc]
jle 0x4473a6
mov eax, dword [esi]
call fcn.0045da48
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00445ddc
push eax
call sub.user32.dll_SetWindowPos
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x44746d
mov eax, ebx
call fcn.0040454c
cmp eax, 0x64
jge 0x44746d
cmp dword [0x48ab48], 0
je 0x44746d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x44746d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x447430
mov bl, 2
jmp 0x44744b
lea edx, [ebp - 0x20]
mov eax, dword [0x48cb9c]
call fcn.0044a534
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x447449
xor ebx, ebx
jmp 0x44744b
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x48ac50]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.00445ddc
push eax
call dword [0x48ab48]
push 4
mov eax, dword [ebp - 4]
call fcn.00445ddc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4474b2
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret