joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426fa0
Capabilities:
Create pipe
Create thread

Disassembly:
push 0
push 0
push 0x486b48
push 0x486b44
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x427004
push 0x486b3c
push 0
push 0
push 0x426f44
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x486b40], eax
cmp dword [0x486b40], 0
je 0x427004
push 0
push 0
push 0
mov ecx, 0x427010
mov edx, dword [0x486b40]
mov eax, dword [0x486b3c]
call fcn.0041df14
push 2
mov eax, dword [0x486b40]
push eax
call sub.kernel32.dll_SetThreadPriority
ret

Function at 0x427014
Capabilities:
Resume thread
Terminate thread
Write file on windows

Disassembly:
add esp, 0xffffffd4
cmp dword [0x486b3c], 0xffffffff
je 0x4270cf
mov eax, dword [0x486b40]
push eax
call sub.kernel32.dll_ResumeThread
call fcn.0041e594
test al, al
jne 0x42707c
lea eax, [esp + 4]
mov edx, 0x28
call fcn.00407394
push 0
lea eax, [esp + 4]
push eax
push 0x28
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x486b48]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x486b48]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x1f4
mov eax, dword [0x486b40]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x427087
mov eax, dword [0x486b48]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
mov eax, dword [0x486b40]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x4270a5
push 0
mov eax, dword [0x486b40]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x486b40]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x486b44]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x486b3c]
call fcn.0041df14
add esp, 0x2c
ret
Function at 0x4270e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
xor eax, eax
push ebp
push 0x427320
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
cmp eax, dword [0x486b3c]
jne 0x427123
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42732a
cmp byte [0x486a30], 0
je 0x427148
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x488444]
cmp eax, dword [edx]
jne 0x427148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42732a
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004239b8
cmp dword [ebp - 8], 0
je 0x427188
mov edx, 0x42733c
mov eax, dword [ebp - 8]
call fcn.00423750
test al, al
je 0x427188
test bl, bl
jne 0x42717b
call fcn.00420dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42732a
test edi, edi
jne 0x427193
call fcn.0042b020
mov edi, eax
test esi, esi
jne 0x42719e
call fcn.0042b028
mov esi, eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x38], eax
mov al, byte [ebp - 1]
mov byte [ebp - 0x34], al
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.0041e594
test al, al
je 0x4271dd
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x4271ed
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0x3c], eax
mov al, 1
call fcn.0041f988
xor eax, eax
push ebp
push 0x4272b7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x3c], 0
je 0x42729a
push 0
lea eax, [ebp - 0x10]
push eax
push 0x28
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [0x486b48]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x42728f
cmp dword [ebp - 0x10], 0x28
jne 0x42728f
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x488444]
cmp eax, dword [edx]
jne 0x427284
jmp 0x427270
push 0
push 0
push 0
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
je 0x427265
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x427270
mov eax, dword [ebp - 0x50]
push eax
call sub.user32.dll_PostQuitMessage
jmp 0x42728f
push 0
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x42723e
jmp 0x42728f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4272a2
lea eax, [ebp - 0x3c]
call fcn.0042693c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4272be
xor eax, eax
call fcn.0041f988
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42737c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4274a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 0x5c
je 0x42748a
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x4273ef
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00404748
lea eax, [ebp - 0x2c]
mov edx, 0x4274bc
call fcn.00404828
mov eax, dword [ebp - 0x2c]
call fcn.00404a20
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call eax
jmp 0x42744b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.00404748
lea eax, [ebp - 0x30]
mov edx, 0x4274bc
call fcn.00404828
mov eax, dword [ebp - 0x30]
call fcn.00404a20
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x42744b
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.0040535c
call fcn.0040535c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x4274c8
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.00404748
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00407cf0
push dword [ebp - 0x34]
push 0x4274d4
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.00408db8
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4274ac
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00404584
ret
Function at 0x42861c
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId_1
cmp esi, eax
je 0x428646
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x428646
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4295e8
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x42961e
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047d0
jmp 0x429625
mov eax, ebx
call fcn.00404560
add esp, 0x108
pop ebx
ret

Function at 0x4298d8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4299d2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4299e0
push 0x4299f8
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x42991f
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x429945
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.00405380
push edx
push eax
lea ecx, [ebp - 0x64]
mov dl, 0x30
mov eax, 1
call fcn.004087a0
push dword [ebp - 0x64]
push 0x429a10
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.00405380
push edx
push eax
lea ecx, [ebp - 0x68]
mov dl, 0x30
mov eax, 1
call fcn.004087a0
push dword [ebp - 0x68]
push 0x429a1c
mov eax, ebx
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4299d9
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00404584
ret
Function at 0x42ad7c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42aeb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
call fcn.00404560
xor eax, eax
push ebp
push 0x42ae92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, esi
call fcn.00404650
mov edx, edi
lea eax, [ebp - 0xc]
mov ecx, ebx
call fcn.00404650
mov eax, dword [ebp - 8]
call fcn.00404820
cmp ebx, eax
jne 0x42ae88
mov eax, dword [ebp - 0xc]
call fcn.00404820
cmp ebx, eax
jne 0x42ae88
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040496c
je 0x42ae88
lea eax, [ebp - 0x10]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x42ae88
mov edx, esi
mov eax, edi
mov ecx, ebx
call fcn.0040290c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0x48a840]
call fcn.00405498
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, 0x48a840
mov ecx, 1
mov edx, dword [0x42ad58]
call fcn.00405654
add esp, 4
lea edi, [ebx + ebx*2]
mov eax, dword [0x48a840]
mov dword [eax + edi*4], esi
mov eax, dword [0x48a840]
lea eax, [eax + edi*4 + 4]
mov edx, dword [ebp - 8]
call fcn.004045b4
mov eax, dword [0x48a840]
lea eax, [eax + edi*4 + 8]
mov edx, dword [ebp - 0xc]
call fcn.004045b4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42ae9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42aebe
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404584
ret
Function at 0x42aec8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42afcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48a840]
call fcn.004054a0
test eax, eax
jl 0x42afa7
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x48a840]
lea ebx, [edx + eax*4]
xor eax, eax
push ebp
push 0x42af91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
call fcn.00404820
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.00404650
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.0040496c
jne 0x42af87
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call fcn.00404820
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x42af87
mov eax, dword [ebx + 4]
call fcn.00404820
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call fcn.0040290c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.00404820
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42af9b
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x42af01
mov eax, 0x48a840
mov edx, dword [0x42ad58]
call fcn.00405774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42afd4
lea eax, [ebp - 8]
call fcn.00404560
ret
Function at 0x42bf30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404a10
mov eax, dword [ebp - 8]
call fcn.00404a10
xor eax, eax
push ebp
push 0x42c04e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
jne 0x42c021
mov eax, dword [ebp - 4]
call fcn.00404a20
push eax
call sub.kernel32.dll_GetModuleHandleA_2
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0040a848
mov dword [esi], eax
cmp word [edi], 0x25ff
jne 0x42bf9c
mov eax, edi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x42bf9e
xor ebx, ebx
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x489664]
jne 0x42bfc6
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0041db4c
mov eax, dword [ebp - 0x14]
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
call fcn.0041de7c
jmp 0x42bfd5
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
mov eax, dword [0x489664]
call fcn.0041dde4
test ebx, ebx
je 0x42bfe4
mov eax, edi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x42bfe8
xor eax, eax
jmp 0x42bfea
mov al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42c025
add edi, 2
mov ebx, dword [edi]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x42c025
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x42c025
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c055
lea eax, [ebp - 0x14]
mov edx, dword [0x41db20]
call fcn.00405774
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404584
ret

Function at 0x42c064
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x42c12e
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x42c112
cmp word [edi], 0x25ff
jne 0x42c0a1
mov eax, edi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x42c0a3
xor ebx, ebx
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x489664]
jne 0x42c0cb
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.0041db4c
mov eax, dword [ebp - 0xc]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.0041de7c
jmp 0x42c0da
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, dword [0x489664]
call fcn.0041dde4
test ebx, ebx
je 0x42c112
mov eax, edi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x42c112
add edi, 2
mov ebx, dword [edi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x42c112
mov dword [ebx], esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c135
lea eax, [ebp - 0xc]
mov edx, dword [0x41db20]
call fcn.00405774
ret
Function at 0x42ca3c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x42cb0a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.004087e4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x42cb20
call fcn.0040486c
mov eax, dword [ebp - 4]
call fcn.00404a20
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x42caef
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x42cae9
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x42cad1
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x486a5c
lea eax, [esi + 8]
mov ecx, 0x50
call fcn.0040290c
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cb11
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404584
ret
Function at 0x431d70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x431da9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404650
jmp 0x431db2
mov eax, ebx
mov edx, esi
call fcn.004045b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x431dbc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x431ddd
mov al, byte [esp]
jmp 0x431ddf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x432464
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4322dc
mov eax, dword [0x4882e0]
cmp byte [eax], 0
je 0x4324e0
mov eax, dword [0x48805c]
call fcn.00402ddc
call fcn.00402878
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0042f5e4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x432528
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x432516
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x487ff4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x489664]
call fcn.0040585c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x432d7c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x432e52
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004045f8
lea eax, [ebp - 8]
call fcn.00404a70
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a20
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x432e3c
mov eax, ebx
call fcn.00402704
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x432e35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a20
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x432e1f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x432e64
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x432e1f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432e3c
mov eax, dword [ebp - 0x10]
call fcn.00402724
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432e59
lea eax, [ebp - 8]
call fcn.00404560
ret

Function at 0x433344
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4333a8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004047d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0042f174
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4333af
lea eax, [ebp - 0xc]
call fcn.00404560
ret

Function at 0x4414d8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48aa4c
cmp dword [edi], 0
jne 0x441554
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48aa48]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x486eac
mov ecx, 2
call fcn.0040290c
mov edx, 0x4414b0
lea eax, [esi + 5]
call fcn.004414d0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004414d0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x441529
mov dword [0x48aa48], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x442778
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44277e
ret
Function at 0x444cfc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x444d4d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x444d34
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x444d24
jmp 0x444d4d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x444d35
pop ebx
mov esp, ebp
pop ebp
ret