joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be46cd4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x4be46d44
cmp dword [ebx + 4], 0xffffffff
jne 0x4be46d44
mov dword [esi + 8], 8
mov eax, dword [ebx + 0xc]
push eax
call fcn.4be46c58
pop ecx
mov edi, eax
test edi, edi
je 0x4be46d3a
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x4be46e04
call fcn.4be472b4
jmp 0x4be46e04
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x4be46d51
cmp eax, 0xfffffffe
jne 0x4be46d78
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x4be46d88
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4be46d93
call fcn.4be472b4
jmp 0x4be46e04
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x4be46da7
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x4be46d44
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be47408
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4be47424
call fcn.4be472d4
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4be47440
test bl, 1
je 0x4be47440
call fcn.4be49b80
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4be476c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.4be46ea8
test byte [ebp + 0xd], 0xc0
jne 0x4be476e4
mov eax, dword [0x4be5dfc8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4be476f1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4be4771e
je 0x4be47730
sub ecx, 0x100
je 0x4be4773e
sub ecx, 0x100
je 0x4be47745
sub ecx, 0x100
je 0x4be47737
jmp 0x4be4774c
sub ecx, 0x600
je 0x4be47745
sub ecx, 0x100
je 0x4be47730
jmp 0x4be4774c
mov edi, 1
jmp 0x4be47751
mov edi, 2
jmp 0x4be47751
mov edi, 4
jmp 0x4be47751
mov edi, 5
jmp 0x4be47751
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4be47778
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4be5e598]
test al, 0x80
je 0x4be47771
mov ebx, 0x80
jmp 0x4be4778a
mov ebx, 1
jmp 0x4be4778a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4be4778a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4be4779c
je 0x4be477a5
dec eax
je 0x4be477ae
jmp 0x4be477b7
mov dword [ebp - 4], 0x80000000
jmp 0x4be477c6
mov dword [ebp - 4], 0x40000000
jmp 0x4be477c6
mov dword [ebp - 4], 0xc0000000
jmp 0x4be477c6
push 1
call fcn.4be47268
pop ecx
mov ebx, eax
jmp 0x4be478b2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4be477e2
sub eax, 0x10
je 0x4be477e9
sub eax, 0x10
je 0x4be477f2
sub eax, 0x10
je 0x4be477fb
jmp 0x4be477fb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4be47802
mov dword [ebp - 8], 1
jmp 0x4be47802
mov dword [ebp - 8], 2
jmp 0x4be47802
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4be4786b
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4be47860
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4be47860
add ebx, 0xffffffb2
push ebx
call fcn.4be47268
pop ecx
mov ebx, eax
jmp 0x4be478b2
mov edi, esi
push edi
call fcn.4be47624
pop ecx
test eax, eax
je 0x4be4787f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4be4788b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.4be46fa8
add esp, 8
mov ebx, eax
inc eax
jne 0x4be478b2
push 4
call fcn.4be47268
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.4be46edc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be496a4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4be49be8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x4be5eae4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4be49ca0
cmp byte [0x4be4d059], 0
je 0x4be49c5a
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.4be41ee4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4be49c43
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.4be41ee4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4be49c43
lea ebx, [ebp - 0x54]
jmp 0x4be49c44
inc ebx
call fcn.4be49ba0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4be49cc1
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4be5eae8
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.4be41d2c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4be5eaeb
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4be49cc1
cmp dword [0x4be5eae4], 0xffffffff
je 0x4be49cc1
mov eax, dword [0x4be5eae4]
test eax, eax
je 0x4be49cc1
cmp byte [eax], 0
je 0x4be49cc1
push esi
push eax
call fcn.4be49d50
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be4a748
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
cmp esi, 1
jne 0x4be4a7ea
mov eax, dword [0x4be63288]
inc dword [0x4be63288]
test eax, eax
jne 0x4be4a85d
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x4be63260], eax
mov edx, dword [ebp + 0x10]
mov dword [0x4be4d062], edx
cmp dword [0x4be5eb6c], 0
je 0x4be4a7ba
call fcn.4be4a470
mov ebx, eax
test eax, eax
je 0x4be4a7ba
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x4be4a7ba
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], edi
jmp 0x4be4a85d
xor eax, eax
mov dword [0x4be5eb6c], eax
jmp 0x4be4a7c5
call ebx
push 0
lea edx, [ebp - 8]
push edx
call fcn.4be4a478
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4be4a7c3
mov edx, dword [ebp + 0x18]
push edx
push esi
mov ecx, dword [ebp + 0x10]
push ecx
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4be4a85d
test esi, esi
jne 0x4be4a84e
dec dword [0x4be63288]
jne 0x4be4a826
mov eax, dword [ebp + 0x18]
push eax
push esi
mov edx, dword [ebp + 0x10]
push edx
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
cmp dword [0x4be5eb6c], 0
jne 0x4be4a826
jmp 0x4be4a812
call ebx
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.4be4a478
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4be4a810
cmp dword [0x4be63288], 0
jne 0x4be4a85d
cmp dword [0x4be63260], 0
je 0x4be4a85d
mov edx, dword [0x4be63260]
push edx
call sub.KERNEL32.dll_FreeEnvironmentStringsA
xor ecx, ecx
mov dword [0x4be63260], ecx
jmp 0x4be4a85d
mov eax, dword [ebp + 0x18]
push eax
push esi
mov edx, dword [ebp + 0x10]
push edx
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406860
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040699c
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405df0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b4050], 0
je 0x405e51
cmp word [0x4b432c], 0xd7b2
jne 0x405e19
cmp dword [0x4b4334], 0
jbe 0x405e19
mov eax, 0x4b4328
call dword [0x4b4344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e7c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b1030], 0
jne 0x405e6d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405fdc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4b1034], 0
je 0x406002
mov edx, esi
mov eax, ebx
call dword [0x4b1034]
jmp 0x406011
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4b4051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405fa4
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4085fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408763
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406860
cmp si, word [0x4b17d0]
jb 0x408696
cmp si, word [0x4b19d0]
ja 0x408696
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408696
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4b17d0]
jae 0x408670
mov edi, ebx
dec edi
jmp 0x408691
cmp si, word [ebx*8 + 0x4b17d0]
jbe 0x408680
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408691
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4b17d4]
call fcn.0040850c
jmp 0x408696
cmp edi, dword [ebp - 0xc]
jae 0x40865a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408745
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408745
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a48
push dword [ebp - 0x164]
push 0x408780
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a48
push dword [ebp - 0x168]
push 0x408790
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a48
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40876a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406858
ret
Function at 0x408794
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 6], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x40897a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b6b58
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [0x4b6b70]
cmp ax, word [ebp - 2]
jne 0x4087ec
mov eax, dword [ebp - 6]
mov edx, 0x4b6b74
mov ecx, 0x55
call fcn.00406a48
push 0x4b6b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408964
push 0x4b6b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [ebp - 6]
xor edx, edx
call fcn.00406860
push 2
movzx eax, word [ebp - 2]
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40892c
cmp byte [0x4b6b54], 0
je 0x4088e2
call dword [0x4b6b4c]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 2]
push eax
call dword [0x4b6b50]
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x4088db
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x4b6b48]
test al, al
je 0x4088b4
mov eax, dword [ebp - 0xc]
add eax, eax
call fcn.004041d4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x4b6b48]
mov edx, dword [ebp - 0xc]
sub edx, 2
test edx, edx
jb 0x4088a9
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
jne 0x4088a5
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2], 0x2c
inc eax
dec edx
jne 0x408892
mov eax, dword [ebp - 6]
mov edx, dword [ebp - 0x10]
call fcn.00406a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40892c
movzx eax, word [ebp - 0x16]
push eax
call dword [0x4b6b50]
cmp dword [ebp - 0x10], 0
je 0x4088da
mov eax, dword [ebp - 0x10]
call fcn.004041f0
ret
mov edx, dword [ebp - 6]
movzx eax, word [ebp - 2]
call fcn.004085fc
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp ax, word [ebp - 2]
je 0x40892c
mov eax, dword [ebp - 6]
cmp dword [eax], 0
je 0x408911
mov eax, dword [ebp - 6]
mov edx, 0x408994
call fcn.00406c5c
mov eax, dword [ebp - 6]
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x1c]
call fcn.004085fc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 6]
call fcn.00406c5c
mov eax, dword [ebp - 6]
push 0x4b6b58
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [ebp - 2]
mov word [0x4b6b70], ax
push 0xaa
mov eax, dword [ebp - 6]
mov eax, dword [eax]
call fcn.004068ec
push eax
push 0x4b6b74
call sub.kernel32.dll_lstrcpynW
push 0x4b6b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408981
lea eax, [ebp - 0x1c]
call fcn.00406850
ret
Function at 0x409068
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00406848
mov eax, dword [ebp - 0x21c]
call fcn.00406848
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x409207
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406860
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.004068ec
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409108
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x40911a
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409105
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x4091d3
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x409143
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408bb8
cmp dword [ebp - 0x220], 0
je 0x40917b
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00408f5c
pop ecx
mov ebx, eax
jmp 0x4091d3
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.00408794
mov eax, dword [ebp - 0x224]
call fcn.00408f5c
pop ecx
mov ebx, eax
test bl, bl
jne 0x4091c6
cmp byte [0x4b6b54], 0
jne 0x4091c6
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.00408794
mov eax, dword [ebp - 0x228]
call fcn.00408f5c
pop ecx
mov ebx, eax
test bl, bl
jne 0x4091d3
push ebp
call fcn.0040900c
pop ecx
mov ebx, eax
test bl, bl
je 0x4091e9
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40920e
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00406858
ret

Function at 0x409980
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x40c8c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x4b6c4c
push 0xa
push 0x40c954
mov eax, dword [0x4b6c3c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40c8e4
call fcn.004178a0
push ebx
mov eax, dword [0x4b6c3c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40c8fb
call fcn.004178a0
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40c90d
call fcn.004178a0
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x4b6c50], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x4b6c54], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x4b6c58], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x4b6c5c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x4b6c60], ecx
add edx, dword [eax + 0x14]
mov dword [0x4b6c64], edx
pop esi
pop ebx
ret

Function at 0x410204
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4102ad
test eax, edx
je 0x4102b0
push 0
push 0
cmp word [eax - 0xa], 2
je 0x41022d
push edx
mov edx, eax
mov eax, esp
call fcn.00406a64
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x410243
push eax
lea eax, [esp + 8]
call fcn.00406a64
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x410252
movzx eax, word [eax]
sub eax, ecx
jmp 0x410279
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x410293
add ecx, 4
js 0x41026a
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x410290
push eax
mov eax, ecx
mov edx, 2
call fcn.0040607c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x410277
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x410279
xor eax, eax
ret
test eax, eax
je 0x4102c0
test edx, edx
jne 0x410214
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4114f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004068ec
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x411512
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x411533
cmp ebx, 3
je 0x411533
cmp ebx, 0x7b
je 0x411533
mov eax, esi
call fcn.004114b4
test al, al
jne 0x411537
xor eax, eax
jmp 0x411539
mov al, 1
pop esi
pop ebx
ret

Function at 0x41153c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004068ec
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x411555
test al, 0x10
jne 0x411559
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x414b50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x414b89
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040699c
jmp 0x414b92
mov eax, ebx
mov edx, esi
call fcn.00406860
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x414b9c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x414bbe
movzx eax, word [esp]
jmp 0x414bc0
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x415350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x415475
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00415160
mov esi, eax
mov eax, dword [0x4b323c]
cmp byte [eax], 0
je 0x41541d
mov eax, dword [0x4b3000]
call fcn.0040467c
call fcn.0040433c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x415328]
call fcn.00408024
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x415490
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x415459
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4b2f9c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b6c3c]
call fcn.00408118
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41547c
lea eax, [ebp - 4]
mov edx, dword [0x415328]
call fcn.00408030
ret