joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4716e8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x40df4c]
call fcn.004045c0
xor eax, eax
push ebp
push 0x47182f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4850d4], 0
jne 0x47173b
mov ecx, dword [0x485944]
mov dl, 1
mov eax, dword [0x407f60]
call fcn.0040bd74
call fcn.004036b8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402c38
mov eax, ebx
call fcn.00404414
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x471840
lea edi, [ebp - 0x30]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040615c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404424
test eax, eax
jle 0x4717d6
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4717cf
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00403eec
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00403ed4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d24
test eax, eax
jne 0x4717cf
mov ebx, 0x15
jmp 0x4717db
mov ebx, 0x10
jmp 0x4717db
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4850d4]
call fcn.00471640
mov eax, dword [ebp - 8]
call fcn.00471640
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471836
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403cc8
lea eax, [ebp - 0x10]
mov edx, dword [0x40df4c]
call fcn.0040468c
ret

Function at 0x4745ac
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x474631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403ca4
push 0x474648
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408f38
push dword [ebp - 0xc]
push 0x4746a0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403fe4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404404
mov eax, dword [ebp - 4]
mov ecx, ebx
mov edx, 0x4746a8
call fcn.004740d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474638
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403cc8
lea eax, [ebp - 4]
call fcn.004042fc
ret
Function at 0x4746c4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x474749
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403ca4
push 0x474760
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408f38
push dword [ebp - 0xc]
push 0x4747b0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403fe4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404404
mov eax, dword [ebp - 4]
mov ecx, ebx
mov edx, 0x4747b8
call fcn.004740d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474750
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403cc8
lea eax, [ebp - 4]
call fcn.004042fc
ret

Function at 0x4785e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4786bc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0047e5a4
lea ecx, [ebp - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
movzx edx, byte [edx + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 3
jne 0x478678
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047895c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0xf
jne 0x478678
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00478ad0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 4
ja 0x47867c
xor ebx, ebx
jmp 0x47867e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4786c3
lea eax, [ebp - 0x18]
call fcn.0040615c
lea eax, [ebp - 0x14]
call fcn.0040615c
lea eax, [ebp - 0x10]
call fcn.0040615c
lea eax, [ebp - 0xc]
call fcn.0040615c
lea eax, [ebp - 8]
call fcn.0040615c
lea eax, [ebp - 4]
call fcn.0040615c
ret

Function at 0x478e2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x478e43
add esp, 0xfffffff0
call fcn.00403260
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x478ebf
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00402ef0
mov byte [esi + 0xc], bl
mov al, byte [ebp + 8]
mov byte [esi + 0xd], al
call fcn.0047e5a4
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, byte [esi + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov byte [esi + 0xe], al
xor eax, eax
mov dword [esi + 0x210], eax
mov eax, esi
call fcn.00478f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478ec6
lea eax, [ebp - 0xc]
call fcn.0040615c
lea eax, [ebp - 8]
call fcn.0040615c
ret
Function at 0x47a5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47a6af
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0047e5a4
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 9
je 0x47a646
mov ebx, 0x80000002
mov edi, 0x80000004
jmp 0x47a650
mov ebx, 0x80860003
mov edi, 0x80860006
mov eax, esi
call fcn.00403ca4
sub edi, ebx
jb 0x47a689
inc edi
xchg edi, ebx
push edi
push 1
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0xc]
mov dl, 1
mov eax, dword [0x474d6c]
call fcn.00477c64
lea edx, [ebp - 0x10]
call fcn.00477b74
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00403f2c
inc edi
dec ebx
jne 0x47a65e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a6b6
lea eax, [ebp - 0x10]
call fcn.00403ca4
lea eax, [ebp - 0xc]
call fcn.0040615c
lea eax, [ebp - 8]
call fcn.0040615c
ret
Function at 0x47c798
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47c7a1
xchg dword [ebp - 4], ecx
push ebx
push esi
test dl, dl
je 0x47c7b9
add esp, 0xfffffff0
call fcn.00403260
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47c8f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00402ef0
mov byte [esi + 0xc], bl
call fcn.0047e5a4
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, byte [esi + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 9
sete bl
mov byte [esi + 0xe], bl
test bl, bl
jne 0x47c853
call fcn.0047e5a4
lea ecx, [ebp - 0x1c]
xor edx, edx
mov dl, byte [esi + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0x80000004
setb al
mov byte [esi + 0xd], al
jmp 0x47c899
call fcn.0047e5a4
lea ecx, [ebp - 0x2c]
xor edx, edx
mov dl, byte [esi + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0x80860006
setb al
mov byte [esi + 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c8fe
lea eax, [ebp - 0x2c]
call fcn.0040615c
lea eax, [ebp - 0x28]
call fcn.0040615c
lea eax, [ebp - 0x24]
call fcn.0040615c
lea eax, [ebp - 0x20]
call fcn.0040615c
lea eax, [ebp - 0x1c]
call fcn.0040615c
lea eax, [ebp - 0x18]
call fcn.0040615c
lea eax, [ebp - 0x14]
call fcn.0040615c
lea eax, [ebp - 0x10]
call fcn.0040615c
lea eax, [ebp - 0xc]
call fcn.0040615c
lea eax, [ebp - 8]
call fcn.0040615c
ret
Function at 0x47caf4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x47cafc
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x47cc9c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0047e5a4
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, byte [esi + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 2
jne 0x47cb98
push 2
push 2
push 1
mov bl, byte [esi + 0xc]
mov ecx, ebx
mov dl, 1
mov eax, dword [0x474d6c]
call fcn.00477c64
lea edx, [ebp - 0x14]
call fcn.00477d90
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
and eax, 0xff
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x474d6c]
call fcn.00477c64
mov edx, eax
test edx, edx
je 0x47cb8e
sub edx, 0xffffffd8
lea eax, [ebp - 4]
call fcn.00406174
jmp 0x47cbf3
mov al, byte [esi + 0xd]
sub al, 3
jb 0x47cba3
sub al, 2
jne 0x47cbcc
push 0x80000005
push 1
mov cl, byte [esi + 0xc]
mov dl, 1
mov eax, dword [0x474d6c]
call fcn.00477c64
mov edx, eax
test edx, edx
je 0x47cbc2
sub edx, 0xffffffd8
lea eax, [ebp - 4]
call fcn.00406174
jmp 0x47cbf3
push 0x80000006
push 1
mov cl, byte [esi + 0xc]
mov dl, 1
mov eax, dword [0x474d6c]
call fcn.00477c64
mov edx, eax
test edx, edx
je 0x47cbeb
sub edx, 0xffffffd8
lea eax, [ebp - 4]
call fcn.00406174
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, 1
mov eax, esi
call fcn.0047c9cc
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, 2
mov eax, esi
call fcn.0047c9cc
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x20]
mov ecx, 3
mov eax, esi
call fcn.0047c9cc
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 0x24]
mov ecx, 4
mov eax, esi
call fcn.0047c9cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cca3
lea eax, [ebp - 0x24]
mov edx, dword [0x474a6c]
mov ecx, 5
call fcn.004046b8
lea eax, [ebp - 0x10]
call fcn.0040615c
lea eax, [ebp - 0xc]
call fcn.0040615c
lea eax, [ebp - 8]
call fcn.0040615c
lea eax, [ebp - 4]
call fcn.0040615c
ret
Function at 0x47d978
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x47d98f
add esp, 0xfffffff0
call fcn.00403260
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47d9fb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00402ef0
mov byte [esi + 0xc], bl
call fcn.0047e5a4
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, byte [esi + 0xc]
call fcn.0047e4d8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
cmp al, 1
sete al
mov byte [esi + 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47da02
lea eax, [ebp - 0xc]
call fcn.0040615c
lea eax, [ebp - 8]
call fcn.0040615c
ret

Function at 0x47dbe0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
add esp, 0xffffffc0
mov esi, eax
mov eax, esi
call fcn.0047dc98
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0xc8
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 5
jb 0x47dc11
mov eax, esi
call fcn.0047dc98
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
fild qword [esp + 0x30]
fild qword [esp + 0x28]
fdivp st(1)
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
fild qword [esp + 0x38]
fdivrp st(1)
fdiv dword [0x47dc94]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x40
pop esi
pop ebx
ret

Function at 0x47df9c
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, edx
push esp
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [esp + 0x14]
mov dl, 1
mov eax, dword [0x474b70]
call fcn.00477404
mov edx, eax
test edx, edx
je 0x47dfc1
sub edx, 0xfffffff0
mov eax, ebx
call fcn.00406174
add esp, 0x24
pop ebx
ret
Function at 0x47f7a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x20]
mov edx, dword [0x47f4c8]
call fcn.004045c0
xor eax, eax
push ebp
push 0x47f906
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x20
call fcn.00402c38
mov eax, ebx
sub al, 0x40
call fcn.00409498
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fstp qword [ebp - 0x18]
wait
mov eax, ebx
sub al, 0x40
call fcn.004094cc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fstp qword [ebp - 8]
wait
fld qword [ebp - 8]
fsub qword [ebp - 0x18]
fstp qword [ebp - 0x10]
wait
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00403e4c
lea eax, [ebp - 0x2c]
mov edx, 0x47f91c
call fcn.00403f2c
mov eax, dword [ebp - 0x2c]
call fcn.004040e8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x47f848
jmp dword [eax*4 + 0x47f84f]
lea eax, [ebp - 0x1c]
mov edx, 0x47f928
call fcn.00403d3c
jmp case.default.0x47f848
lea eax, [ebp - 0x1c]
mov edx, 0x47f944
call fcn.00403d3c
jmp case.default.0x47f848
lea eax, [ebp - 0x1c]
mov edx, 0x47f960
call fcn.00403d3c
jmp case.default.0x47f848
lea eax, [ebp - 0x1c]
mov edx, 0x47f974
call fcn.00403d3c
jmp case.default.0x47f848
lea eax, [ebp - 0x1c]
mov edx, 0x47f988
call fcn.00403d3c
jmp case.default.0x47f848
lea eax, [ebp - 0x1c]
mov edx, 0x47f9a8
call fcn.00403d3c
jmp case.default.0x47f848
lea eax, [ebp - 0x1c]
mov edx, 0x47f9bc
call fcn.00403d3c
mov eax, esi
lea edx, [ebp - 0x20]
mov ecx, dword [0x47f4c8]
call fcn.004047ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f90d
lea eax, [ebp - 0x2c]
call fcn.00403ca4
lea eax, [ebp - 0x20]
mov edx, dword [0x47f4c8]
call fcn.0040468c
ret
Function at 0x480200
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x24], edx
mov esi, eax
lea eax, [ebp - 0x20]
mov edx, dword [0x47f4c8]
call fcn.004045c0
xor eax, eax
push ebp
push 0x480343
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x31c]
mov eax, dword [eax + 0x20c]
call fcn.00469990
mov bl, 0x41
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00403e4c
lea eax, [ebp - 0x24]
mov edx, 0x480358
call fcn.00403f2c
mov eax, dword [ebp - 0x24]
call fcn.004040e8
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jb 0x480308
sub eax, 2
je 0x480308
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0047f7a8
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0045677c
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
fld qword [ebp - 8]
fdiv dword [0x48035c]
fdiv dword [0x48035c]
fdiv dword [0x48035c]
fstp xword [ebp - 0x48]
wait
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 3
fld qword [ebp - 0x18]
fdiv qword [ebp - 8]
fmul dword [0x480360]
fstp xword [ebp - 0x54]
wait
lea eax, [ebp - 0x54]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 3
lea edx, [ebp - 0x3c]
mov ecx, 1
mov eax, 0x48036c
call fcn.00409c74
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00403e4c
mov edx, dword [ebp - 0x58]
mov eax, dword [esi + 0x31c]
mov ecx, dword [ebp - 0x1c]
call fcn.0047f9cc
inc ebx
cmp bl, 0x5b
jne 0x480247
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48034a
lea eax, [ebp - 0x58]
call fcn.00403ca4
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00403cc8
lea eax, [ebp - 0x20]
mov edx, dword [0x47f4c8]
call fcn.0040468c
ret
Function at 0x430000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x402dec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404408
test esi, esi
jne 0x402e23
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004044f8
jmp 0x402e44
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c88
mov dword [esp], eax
test esi, esi
je 0x402e44
cmp dword [ebx], 0
je 0x402e44
dec esi
jmp 0x402e2b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403508
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x456020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403580
xor eax, eax
push ebp
push 0x403579
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403580
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x456020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x456020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404284
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x459048], 0
je 0x4042e5
cmp word [0x45921c], 0xd7b2
jne 0x4042ad
cmp dword [0x459224], 0
jbe 0x4042ad
mov eax, 0x459218
call dword [0x459234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45606c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40430c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x456030], 0
jne 0x404301
push 0
push 0x456064
push 0x45606c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406090
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4060f6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404678
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030cc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4060e0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060fd
lea eax, [ebp - 0x10]
call fcn.00404408
ret

Function at 0x40b230
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b269
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044f8
jmp 0x40b272
mov eax, ebx
mov edx, esi
call fcn.0040445c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b27c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b29d
mov al, byte [esp]
jmp 0x40b29f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b934
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b79c
mov eax, dword [0x45802c]
cmp byte [eax], 0
je 0x40b9b0
mov eax, dword [0x457e1c]
call fcn.00402efc
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408960
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b9f8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b9e6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x457dcc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x459664]
call fcn.00405498
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret