joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404cec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ed054], 0
je 0x404d4d
cmp word [0x4ed330], 0xd7b2
jne 0x404d15
cmp dword [0x4ed338], 0
jbe 0x404d15
mov eax, 0x4ed32c
call dword [0x4ed348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404d78
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e402c], 0
jne 0x404d69
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404f18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4e4030], 0
je 0x404f3e
mov edx, esi
mov eax, ebx
call dword [0x4e4030]
jmp 0x404f4d
mov eax, 8
call fcn.00402fe8
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4ed055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404ee0
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x405080
Capabilities:
Get file size
Read file on windows

Disassembly:
test eax, eax
jle 0x4050c7
push eax
add eax, 0xe
jo 0x4050c2
and eax, 0xfffffffe
push edx
push eax
call fcn.00402fe8
pop edx
pop ecx
mov word [edx + eax - 2], 0
add eax, 0xc
pop edx
mov dword [eax - 4], edx
mov dword [eax - 8], 1
test ecx, ecx
jne 0x4050b5
mov ecx, dword [0x4ed8d0]
mov edx, ecx
mov word [eax - 0xc], dx
mov word [eax - 0xa], 1
ret
jmp fcn.00403be0
xor eax, eax
ret

Function at 0x40538c
Capabilities:
Get file size
Read file on windows

Disassembly:
test edx, edx
je 0x405453
mov ecx, dword [eax]
test ecx, ecx
je fcn.00404fe8
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
cmp esi, ecx
je 0x405420
cmp word [ecx - 0xa], 1
je 0x4053c8
xor edx, edx
cmp word [esi - 0xa], 1
jne 0x4053bf
movzx edx, word [esi - 0xc]
call fcn.004051c0
mov edi, eax
mov ecx, eax
push 0
cmp word [esi - 0xa], 1
je 0x4053eb
mov eax, esi
mov dword [esp], esi
call fcn.00405744
mov eax, esp
movzx edx, word [edi - 0xc]
call fcn.004051c0
mov esi, dword [esp]
mov ecx, edi
mov edi, dword [ecx - 4]
mov edx, dword [esi - 4]
add edx, edi
jo 0x40544e
mov eax, ebx
movzx ecx, word [ecx - 0xc]
call fcn.00405838
mov eax, esi
mov ecx, dword [esi - 4]
mov edx, dword [ebx]
add edx, edi
call fcn.004031a0
mov eax, esp
mov edx, dword [eax]
test edx, edx
je 0x40541b
call fcn.00404f94
pop eax
pop edi
pop esi
pop ebx
ret
cmp word [ecx - 0xa], 1
je 0x405434
mov eax, ebx
xor edx, edx
call fcn.004051c0
mov ecx, eax
mov eax, ebx
mov edi, dword [ecx - 4]
mov edx, edi
shl edx, 1
jo 0x40544e
movzx ecx, word [ecx - 0xc]
call fcn.00405838
mov eax, dword [ebx]
mov ecx, edi
push 0
jmp 0x405405
jmp fcn.00403be0
ret
Function at 0x405454
Capabilities:
Get file size
Read file on windows

Disassembly:
test edx, edx
je 0x40552d
test ecx, ecx
je fcn.00404fe8
cmp edx, dword [eax]
je 0x405534
cmp ecx, dword [eax]
je 0x40547e
push eax
push ecx
call fcn.00404fe8
pop edx
pop eax
jmp fcn.0040538c
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
push 0
push 0
cmp word [esi - 0xa], 1
je 0x4054b2
mov dword [esp], esi
mov eax, esi
call fcn.00405744
xor edx, edx
cmp word [ebx - 0xa], 1
jne 0x4054a8
movzx edx, word [ebx - 0xc]
mov eax, esp
call fcn.00405168
mov esi, dword [esp]
cmp word [ebx - 0xa], 1
je 0x4054d5
mov dword [esp + 4], ebx
mov eax, ebx
call fcn.00405744
movzx edx, word [esi - 0xc]
lea eax, [esp + 4]
call fcn.004051c0
mov ebx, dword [esp + 4]
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
jo 0x40553b
movzx edx, word [esi - 0xc]
call fcn.00405080
mov edi, eax
mov edx, edi
mov eax, ebx
mov ecx, dword [ebx - 4]
call fcn.004031a0
mov edx, edi
mov eax, esi
mov ecx, dword [esi - 4]
add edx, dword [ebx - 4]
call fcn.004031a0
mov eax, dword [esp]
or eax, dword [esp + 4]
je 0x405518
mov eax, esp
mov edx, 2
call fcn.00404fb8
pop eax
pop eax
pop eax
mov edx, edi
test edi, edi
je 0x405524
dec dword [edi - 8]
call fcn.00404fe8
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.00404fe8
mov edx, ecx
jmp fcn.0040538c
jmp fcn.00403be0
Function at 0x405544
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
push edx
push eax
mov ebx, edx
xor edi, edi
push 0
mov ecx, dword [ebp + edx*4 + 4]
test ecx, ecx
je 0x40559c
cmp word [ecx - 0xa], 1
je 0x405589
mov esi, eax
mov eax, dword [ebp + edx*4 + 4]
call fcn.00405744
mov edx, ebx
lea eax, [ebp + edx*4 + 4]
mov edx, dword [ebp - 4]
call fcn.004051c0
mov ecx, eax
mov edx, ebx
mov dword [esp], eax
mov eax, esi
jmp 0x405590
movzx esi, word [ecx - 0xc]
mov dword [ebp - 4], esi
cmp dword [eax], ecx
jne 0x4055a0
mov edi, ecx
mov eax, dword [ecx - 4]
dec edx
jmp 0x4055a4
xor eax, eax
jmp 0x4055f8
xor eax, eax
jmp 0x4055a6
push 0
mov ecx, dword [ebp + edx*4 + 4]
test ecx, ecx
je 0x4055f8
cmp word [ecx - 0xa], 1
je 0x4055dc
mov esi, eax
mov dword [ebp - 8], edx
mov eax, dword [ebp + edx*4 + 4]
call fcn.00405744
mov edx, dword [ebp - 8]
lea eax, [ebp + edx*4 + 4]
mov edx, dword [ebp - 4]
call fcn.004051c0
mov edx, dword [ebp - 8]
mov ecx, eax
mov dword [esp], eax
mov eax, esi
add eax, dword [ecx - 4]
jo 0x405678
cmp dword [ebp - 4], 0
jne 0x4055f2
movzx esi, word [ecx - 0xc]
mov dword [ebp - 4], esi
cmp edi, ecx
jne 0x4055f8
xor edi, edi
dec edx
jne 0x4055a4
test edi, edi
je 0x40561a
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [edi - 4]
movzx ecx, word [edi - 0xc]
call fcn.00405838
mov edi, dword [ebp - 0x1c]
push dword [edi]
add esi, dword [edi]
dec ebx
jmp 0x405625
mov edx, dword [ebp - 4]
call fcn.00405080
push eax
mov esi, eax
mov eax, dword [ebp + ebx*4 + 4]
test eax, eax
je 0x40563d
mov edx, esi
test eax, eax
je 0x40563d
mov ecx, dword [eax - 4]
add esi, ecx
call fcn.004031a0
dec ebx
jne 0x405625
mov edx, dword [ebp - 0x18]
mov eax, edx
neg eax
lea eax, [ebp + eax*4 - 0x1c]
call fcn.00404fb8
pop edx
mov eax, dword [ebp - 0x1c]
test edi, edi
jne 0x405664
test edx, edx
je 0x40565f
dec dword [edx - 8]
call fcn.00404fe8
mov edx, dword [ebp - 0x18]
lea esp, [esp + edx*4]
pop eax
pop edx
pop edi
pop esi
pop ebx
pop eax
pop eax
pop ebp
pop eax
lea esp, [esp + edx*4]
jmp eax
jmp fcn.00403be0

Function at 0x405838
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov ebp, ecx
xor edi, edi
test edx, edx
jle 0x4058c1
mov eax, dword [ebx]
test eax, eax
je 0x4058a0
cmp word [eax - 0xa], 1
je 0x405869
push 0
mov eax, esp
mov ecx, ebp
mov edx, dword [ebx]
call fcn.00405e10
pop edi
mov eax, edi
mov edx, esi
xchg dword [ebx], edi
cmp dword [eax - 8], 1
jne 0x4058a0
sub eax, 0xc
add edx, 0xd
jo 0x40589b
push eax
mov eax, esp
call fcn.0040301c
pop eax
add eax, 0xc
mov dword [ebx], eax
mov dword [eax - 4], esi
mov byte [esi + eax], 0
test edi, edi
je 0x4058ca
push edi
mov eax, esp
call fcn.00404f94
pop edi
jmp 0x4058ca
jmp fcn.00403be0
mov eax, edx
mov edx, ebp
call fcn.00405080
mov edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x4058c1
mov edx, edi
mov ecx, dword [eax - 4]
cmp ecx, esi
jl 0x4058bc
mov ecx, esi
call fcn.004031a0
mov eax, ebx
call fcn.00404f94
mov dword [ebx], edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x405f48
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
xor edi, edi
test edx, edx
jle 0x405fd2
mov eax, dword [ebx]
test eax, eax
je 0x405fb1
cmp word [eax - 0xa], 2
je 0x405f74
push 0
mov eax, esp
mov edx, dword [ebx]
call fcn.00405de8
pop edi
mov eax, edi
mov edx, esi
xchg dword [ebx], edi
cmp dword [eax - 8], 1
jne 0x405fb1
sub eax, 0xc
add edx, edx
jo 0x405fac
add edx, 0xe
jo 0x405fac
push eax
mov eax, esp
call fcn.0040301c
pop eax
add eax, 0xc
mov dword [ebx], eax
mov dword [eax - 4], esi
mov word [eax + esi*2], 0
test edi, edi
je 0x405fdb
push edi
mov eax, esp
call fcn.00404f94
pop edi
jmp 0x405fdb
jmp fcn.00403be0
mov eax, edx
call fcn.0040664c
mov edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x405fd2
mov edx, edi
mov ecx, dword [eax - 4]
cmp ecx, esi
jl 0x405fcb
mov ecx, esi
shl ecx, 1
call fcn.004031a0
mov eax, ebx
call fcn.00404f94
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x405fe0
Capabilities:
Get file size
Read file on windows

Disassembly:
test edx, edx
je 0x40609e
mov ecx, dword [eax]
test ecx, ecx
je fcn.00405be4
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
cmp esi, ecx
je 0x406069
cmp word [ecx - 0xa], 2
je 0x40600d
call fcn.00405190
mov edi, eax
mov ecx, eax
push 0
cmp word [esi - 0xa], 2
je 0x40602e
mov edi, ecx
mov eax, esi
mov dword [esp], esi
call fcn.00405bcc
mov eax, esp
call fcn.00405190
mov esi, dword [esp]
mov ecx, edi
mov edi, dword [ecx - 4]
mov edx, dword [esi - 4]
add edx, edi
test edx, 0xc0000000
jne 0x406099
mov eax, ebx
call fcn.00405f48
mov eax, esi
mov ecx, dword [esi - 4]
mov edx, dword [ebx]
shl edi, 1
add edx, edi
shl ecx, 1
call fcn.004031a0
mov eax, esp
mov edx, dword [eax]
test edx, edx
je 0x406064
call fcn.00404f94
pop eax
pop edi
pop esi
pop ebx
ret
cmp word [ecx - 0xa], 2
je 0x40607d
mov eax, ebx
xor edx, edx
call fcn.00405190
mov ecx, eax
mov eax, ebx
mov edi, dword [ecx - 4]
mov edx, edi
shl edx, 1
test edx, 0xc0000000
jne 0x406099
call fcn.00405f48
mov eax, dword [ebx]
mov ecx, edi
push 0
jmp 0x40604a
jmp fcn.00403be0
ret
Function at 0x4060a0
Capabilities:
Get file size
Read file on windows

Disassembly:
test edx, edx
je 0x40616f
test ecx, ecx
je fcn.00405be4
cmp edx, dword [eax]
je 0x406176
cmp ecx, dword [eax]
je 0x4060ca
push eax
push ecx
call fcn.00405be4
pop edx
pop eax
jmp fcn.00405fe0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
push 0
push 0
cmp word [esi - 0xa], 2
je 0x4060f1
mov dword [esp], esi
mov eax, esi
call fcn.00405bcc
mov eax, esp
call fcn.00405190
mov esi, dword [esp]
cmp word [ebx - 0xa], 2
je 0x406110
mov dword [esp + 4], ebx
mov eax, ebx
call fcn.00405bcc
lea eax, [esp + 4]
call fcn.00405190
mov ebx, dword [esp + 4]
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
test eax, 0xc0000000
jne 0x40617d
call fcn.0040664c
mov edi, eax
mov edx, edi
mov eax, ebx
mov ecx, dword [ebx - 4]
shl ecx, 1
call fcn.004031a0
mov eax, esi
mov ecx, dword [esi - 4]
shl ecx, 1
mov edx, dword [ebx - 4]
shl edx, 1
add edx, edi
call fcn.004031a0
mov eax, dword [esp]
or eax, dword [esp + 4]
je 0x40615a
mov edx, 2
mov eax, esp
call fcn.00404fb8
pop eax
pop eax
pop eax
mov edx, edi
test edi, edi
je 0x406166
dec dword [edi - 8]
call fcn.00405be4
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.00405be4
mov edx, ecx
jmp fcn.00405fe0
jmp fcn.00403be0

Function at 0x406184
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
push edx
push eax
mov ebx, edx
xor edi, edi
push 0
mov ecx, dword [ebp + edx*4 + 4]
test ecx, ecx
je 0x4061ce
cmp word [ecx - 0xa], 2
je 0x4061c2
mov esi, eax
mov eax, dword [ebp + edx*4 + 4]
call fcn.00405bcc
mov edx, ebx
lea eax, [ebp + edx*4 + 4]
call fcn.00405190
mov ecx, eax
mov edx, ebx
mov dword [esp], eax
mov eax, esi
cmp dword [eax], ecx
jne 0x4061d2
mov edi, ecx
mov eax, dword [ecx - 4]
dec edx
jmp 0x4061d6
xor eax, eax
jmp 0x40621f
xor eax, eax
jmp 0x4061d8
push 0
mov ecx, dword [ebp + edx*4 + 4]
test ecx, ecx
je 0x40621f
cmp word [ecx - 0xa], 2
je 0x40620b
mov esi, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp + edx*4 + 4]
call fcn.00405bcc
mov edx, dword [ebp - 4]
lea eax, [ebp + edx*4 + 4]
call fcn.00405190
mov edx, dword [ebp - 4]
mov ecx, eax
mov dword [esp], eax
mov eax, esi
add eax, dword [ecx - 4]
test eax, 0xc0000000
jne 0x40629b
cmp edi, ecx
jne 0x40621f
xor edi, edi
dec edx
jne 0x4061d6
test edi, edi
je 0x40623f
mov edx, eax
mov eax, dword [ebp - 0x18]
mov esi, dword [edi - 4]
call fcn.00405f48
mov edi, dword [ebp - 0x18]
push dword [edi]
shl esi, 1
add esi, dword [edi]
dec ebx
jmp 0x406247
call fcn.0040664c
push eax
mov esi, eax
mov eax, dword [ebp + ebx*4 + 4]
test eax, eax
je 0x406261
mov edx, esi
test eax, eax
je 0x406261
mov ecx, dword [eax - 4]
shl ecx, 1
add esi, ecx
call fcn.004031a0
dec ebx
jne 0x406247
mov edx, dword [ebp - 0x14]
mov eax, edx
neg eax
lea eax, [ebp + eax*4 - 0x18]
call fcn.00404fb8
pop edx
mov eax, dword [ebp - 0x18]
test edi, edi
jne 0x406288
test edx, edx
je 0x406283
dec dword [edx - 8]
call fcn.00405be4
mov edx, dword [ebp - 0x14]
lea esp, [esp + edx*4]
pop eax
pop edx
pop edi
pop esi
pop ebx
pop eax
pop ebp
pop eax
lea esp, [esp + edx*4]
jmp eax
jmp fcn.00403be0
Function at 0x40664c
Capabilities:
Get file size
Read file on windows

Disassembly:
test eax, eax
jle 0x40668a
push eax
add eax, eax
jo 0x406685
add eax, 0xe
jo 0x406685
call fcn.00402fe8
add eax, 0xc
pop edx
mov dword [eax - 8], 1
mov dword [eax - 4], edx
mov word [eax + edx*2], 0
mov word [eax - 0xa], 2
movzx edx, word [0x4ed8d4]
mov word [eax - 0xc], dx
ret
jmp fcn.00403be0
xor eax, eax
ret
Function at 0x4e1214
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e130a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx esi, ax
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e1324
mov edx, 0x59
mov eax, esi
call fcn.00412e04
push dword [ebp - 4]
push 0x4e1338
lea eax, [ebp - 8]
push eax
mov ecx, 0x4e1348
mov edx, 0x5a
mov eax, esi
call fcn.00412e04
push dword [ebp - 8]
lea eax, [ebx + 0x18]
mov edx, 3
call fcn.00406184
call fcn.00444ee4
test al, al
je 0x4e1292
lea eax, [ebx + 0x1c]
mov edx, 0x4e135c
call fcn.00405be4
jmp 0x4e12b9
mov eax, dword [0x4ebc34]
mov eax, dword [eax]
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [0x4ec068]
add eax, dword [edx]
lea edx, [ebp - 0xc]
call fcn.0040c334
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x1c]
call fcn.00405be4
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, dword [ebx + 0xc]
call fcn.004ddb74
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
call fcn.00405be4
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebx + 0xc]
call fcn.004ddb74
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x3c]
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1311
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405bdc
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401c66
pop dword [ebp - 0x34]
mov eax, 0xc60fc01e
sub eax, 0xc5cfa3b8
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x2639bb4b
add dword [ebp - 0x44], 0x28188a00
mov dword [ebp - 0x40], 0x1e2f3388
add dword [ebp - 0x40], 0x140418bd
mov dword [ebp - 0x3c], 0x3e8e0a41
add dword [ebp - 0x3c], 0xdbe39ed
mov dword [ebp - 0x38], 0xdc08d9cb
sub dword [ebp - 0x38], 0xdc08d9cb
lea eax, [ebp - 0x44]
push eax
mov eax, 0x3fe89769
add eax, 0xc05798eb
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xdd4fbddf
sub dword [ebp - 0x44], 0x68dd5489
mov dword [ebp - 0x40], 0x7e3b1e1c
sub dword [ebp - 0x40], 0x3ccebca7
mov dword [ebp - 0x3c], 0x5161e6dd
sub dword [ebp - 0x3c], 0xedf27a71
mov dword [ebp - 0x38], 0x327a7e19
sub dword [ebp - 0x38], 0x327a7e19
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x36136
push 0
call eax
mov ecx, 0xde716fde
add ecx, 0x218ed683
xor esi, esi
add esi, eax
mov edi, 0xa60bad00
sub edi, 0xa5cb3d00
add edi, dword [ebp - 0x34]
mov edx, 0x6521d480
sub edx, 0xfa9aea87
add dword [ebp - 4], esi
mov ebx, dword [edi]
sub dword [ebp - 0x28], 0x42d00ede
xor ebx, edx
xor dword [ebp - 0x1c], 0xa674728d
mov dword [esi], ebx
add dword [ebp - 0x14], 0x842a74a5
add esi, 0x7e524d43
sub esi, 0x7e524d3f
add edi, 0xb391bcac
add edi, 0x4c6e4358
loop 0x401d85
add eax, 0xd696d0fb
sub eax, 0xd695c4a4
mov ebx, eax
add eax, 0xfdaa0006
sub eax, 0xfdaa0001
mov ecx, 0x4f8838e2
add ecx, 0xb0b7c71e
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40aaa8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aac9
mov al, byte [esp]
jmp 0x40aacb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x414204
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004139c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00413978
xor dword [ebp - 0x5335a80], ecx
invalid
invalid

Function at 0x414264
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004139c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00413978
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
invalid
invalid
Function at 0x4148d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 8], 0x2f
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004139c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00413978
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004139b3
sub cl, byte ss:[eax + edi*2 + 0x10468]
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x417548
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41754e
ret

Function at 0x419ea0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x419ef1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x419ed8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x419ec8
jmp 0x419ef1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x419ed9
pop ebx
mov esp, ebp
pop ebp
ret