joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES3_S3_RiPPKcjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x48b430
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x48b468
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x48b410
test al, al
jne 0x48b440
cmp dl, al
jne 0x48b41e
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x48b3ef
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x48b410
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x48b410
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x48b402
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x48b402
Function at 0x48e050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x48e1c0
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x48e1e8
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x48e1a2
test al, al
jne 0x48e1d0
cmp bl, cl
jne 0x48e1b0
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x48e17d
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x48e210
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x48e1a2
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x48e228
movzx eax, word [eax]
cmp ax, 0xffff
mov ebx, 0
mov ebp, 0
cmove ebx, esi
cmovne ebp, ecx
jmp 0x48e18f
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x48e1db
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x48e1f3
Function at 0x4a8c00
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x4a8c23
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x4a8c41
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x4a8c18
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40102c
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x402056], eax
xor eax, eax
mov ax, 0x67
push 0
push 0x40102c
push 0
push eax
push dword [0x402056]
call sub.USER32.dll_DialogBoxParamA
call sub.KERNEL32.dll_ExitProcess
enter 0, 0
push ebx
push edi
push esi
xor eax, eax
mov ax, word [ebp + 0xc]
cmp ax, 2
jne 0x401043
jmp 0x401068
cmp ax, 0x10
jne 0x40104d
jmp 0x401068
cmp ax, 0x111
jne 0x401057
jmp 0x40109d
cmp ax, 0x110
jne 0x40105f
jmp 0x4010d4
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x10
call 0x4ac193
call 0x4ac5d4
push dword [0x4020e6]
call sub.KERNEL32.dll_GlobalFree
push 0
push dword [ebp + 8]
call sub.USER32.dll_EndDialog
call sub.KERNEL32.dll_ExitProcess
mov dword [0x402052], 1
pop esi
pop edi
pop ebx
leave
ret 0x10
cmp word [ebp + 0x10], 0xa
je 0x4010b9
cmp dword [ebp + 0x10], 1
jne 0x4010b2
push dword [ebp + 8]
call fcn.0040119e
pop esi
pop edi
pop ebx
leave
ret 0x10
push 0
push 0
push 0
push section.DATA
push 0
push 0
call sub.SHELL32.dll_ShellExecuteA
pop esi
pop edi
pop ebx
leave
ret 0x10
push 0x69
push dword [0x402056]
call sub.USER32.dll_LoadIconA
mov dword [0x40205e], eax
push eax
push 0
push 0x80
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push 0x4020be
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
call sub.USER32.dll_GetDesktopWindow
push 0x4020d6
push eax
call sub.USER32.dll_GetWindowRect
push 0
mov eax, dword [0x4020ca]
sub eax, dword [0x4020c2]
mov dword [0x4020d2], eax
push eax
mov eax, dword [0x4020c6]
sub eax, dword [0x4020be]
mov dword [0x4020ce], eax
push eax
mov eax, dword [0x4020e2]
sub eax, dword [0x4020d2]
shr eax, 1
push eax
mov eax, dword [0x4020de]
sub eax, dword [0x4020ce]
shr eax, 1
push eax
push dword [ebp + 8]
call sub.USER32.dll_MoveWindow
push 0x4020ea
call fcn.0040141f
push eax
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x4020e6], eax
push dword [0x4020e6]
push 0x4020ea
call fcn.004012a1
push dword [0x4020e6]
push dword [ebp + 8]
call 0x4ac4cb
push 0
call 0x4ac127
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x480920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6b000]
push edi
jmp 0x48093a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x480941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480930
mov eax, 1
add ebx, ebx
jne 0x480953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x480948
jne 0x480964
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480948
xor ecx, ecx
sub eax, 3
jb 0x480978
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4809ea
mov ebp, eax
add ebx, ebx
jne 0x480983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x480990
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4809b4
inc ecx
add ebx, ebx
jne 0x4809a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x480995
jne 0x4809b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480995
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4809d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4809c5
jmp 0x480936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4809d4
add edi, ecx
jmp 0x480936
pop esi
mov edi, esi
mov ecx, 0x104c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4809f2
cmp byte [edi], 9
jne 0x4809f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4809f7
lea edi, [esi + 0x7d000]
mov eax, dword [edi]
or eax, eax
je 0x480a6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x80bfc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x80cb0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x480a24
mov ecx, edi
jns 0x480a53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x80cb4]
or eax, eax
je 0x480a69
mov dword [ebx], eax
add ebx, 4
jmp 0x480a41
call dword [esi + 0x80cc4]
mov ebp, dword [esi + 0x80cb8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x480aa3
sub esp, 0xffffff80
jmp 0x40fcc2
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
nop
mov eax, ecx
inc eax
nop
mov eax, ecx
inc eax
mov eax, ecx
inc eax
cmp eax, 0x5404aeec
mov eax, ecx
mov eax, ebx
mov eax, ebx
mov eax, ecx
mov eax, ecx
mov eax, 0x7912b9f3
mov eax, ebx
cmp eax, 0x32566d54
mov eax, ebx
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, ebx
inc eax
mov eax, ecx
cmp eax, 8
cmp eax, 0xffffffc9
inc eax
inc eax
mov eax, 0xe9585d37
cmp eax, 0x74
inc eax
mov eax, ecx
cmp eax, 0xffffffd6
mov eax, 0x96330451
mov eax, 0xe8953016
cmp eax, 0xffffffea
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
cmp eax, 0xa432ad79
cmp eax, 0x76
cmp eax, 0x4a80bd52
cmp eax, 0x91872875
cmp eax, 0x75
nop
nop
cmp eax, 0x7f4785f7
inc eax
mov eax, ecx
cmp eax, 0x32
inc eax
nop
mov eax, 0x564ae35d
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, ecx
cmp eax, 0xc
mov eax, ebx
mov eax, 0xf6098643
cmp eax, 0x2b
cmp eax, 0xfffffff0
nop
mov eax, ecx
cmp eax, 0x61
mov eax, ebx
cmp eax, 0x42
cmp eax, 0x13540d2b
mov eax, ecx
mov eax, ecx
cmp eax, 0x28
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, 0x52548515
cmp eax, 0x96aebc28
mov eax, ecx
cmp eax, 0x4982ed46
mov eax, 0x17b5a4e
mov eax, ebx
mov eax, ebx
cmp eax, 0x74
mov eax, 0xe1a12a0a
cmp eax, 0x34
inc eax
cmp eax, 0xfffffff9
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ebx
mov eax, ecx
cmp eax, 0x2cfa5927
inc eax
mov eax, ebx
mov eax, 0x4b640477
inc eax
mov eax, ebx
inc eax
cmp eax, 0xffffffa9
cmp eax, 0xffffffdc
mov eax, 0x30c046d1
mov eax, ebx
mov eax, ebx
cmp eax, 0xb17896b8
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030a8
xor eax, eax
push ebp
push 0x4030a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47b020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d94
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47d04c], 0
je 0x403df5
cmp word [0x47d220], 0xd7b2
jne 0x403dbd
cmp dword [0x47d228], 0
jbe 0x403dbd
mov eax, 0x47d21c
call dword [0x47d238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47b06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e1c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47b030], 0
jne 0x403e11
push 0
push 0x47b064
push 0x47b06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405d82
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404180
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bf4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405d6c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d89
lea eax, [ebp - 0x10]
call fcn.00403f10
ret

Function at 0x40afbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aff5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404000
jmp 0x40affe
mov eax, ebx
mov edx, esi
call fcn.00403f64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b008
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b029
mov al, byte [esp]
jmp 0x40b02b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b6b0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b528
mov eax, dword [0x47cb8c]
cmp byte [eax], 0
je 0x40b72c
mov eax, dword [0x47c970]
call fcn.00402a60
call fcn.004028ac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004087fc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b774
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b762
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x47c91c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x47d668]
call fcn.00405230
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c01c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c0f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403fa8
lea eax, [ebp - 8]
call fcn.00404420
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c0dc
mov eax, ebx
call fcn.00402744
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c0d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c0bf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c104
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c0bf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0dc
mov eax, dword [ebp - 0x10]
call fcn.00402764
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0f9
lea eax, [ebp - 8]
call fcn.00403f10
ret

Function at 0x40c5fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c660
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404180
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408324
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c667
lea eax, [ebp - 0xc]
call fcn.00403f10
ret

Function at 0x41dda4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x47d888
cmp dword [edi], 0
jne 0x41de20
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x47d884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47b3fc
mov ecx, 2
call fcn.00402940
mov edx, 0x41dd7c
lea eax, [esi + 5]
call fcn.0041dd9c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041dd9c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ddf5
mov dword [0x47d884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f45c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f462
ret
Function at 0x4218f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x421949
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x421930
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x421920
jmp 0x421949
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x421931
pop ebx
mov esp, ebp
pop ebp
ret