joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f2d0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
push esi
test edx, edx
push edi
je 0x48f36b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x48f36b
push 0x4cd75c
push edx
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
je 0x48f36b
push ebx
push ebp
push 2
push 0
push esi
mov bl, 1
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
mov ebp, dword [esp + 0x24]
mov edi, eax
push 0
push edi
push ebp
call fcn.0048f140
add esp, 0x1c
test al, al
je 0x48f359
push esi
call sub.MSVCRT.dll_rewind
mov eax, dword [ebp]
push esi
push edi
push 1
push eax
call sub.MSVCRT.dll_fread
add esp, 0x14
cmp eax, edi
je 0x48f346
xor bl, bl
push esi
mov dword [ebp + 4], eax
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
ret
push esi
xor bl, bl
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x48f370
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
push ebp
test edx, edx
push edi
je 0x48f3e3
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x48f3e3
push 0x4cd760
push edx
call sub.MSVCRT.dll_fopen
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x48f3e3
mov edi, dword [esp + 0xc]
push ebx
push esi
push edi
mov bl, 1
call fcn.0048f650
mov esi, eax
add esp, 4
test esi, esi
jle 0x48f3d3
push ebp
push esi
push 1
push 0
push 0
push edi
call fcn.0048f290
add esp, 0xc
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp eax, esi
je 0x48f3d3
xor bl, bl
push ebp
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, bl
pop esi
pop ebx
pop edi
pop ebp
ret
pop edi
xor al, al
pop ebp
ret
Function at 0x10020b8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10020b99
pop dword [ebp - 0x30]
mov eax, 0x4312861b
add eax, 0xccef857e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x835955d1
add dword [ebp - 0x40], 0xcaf8ef7a
mov dword [ebp - 0x3c], 0x7db96224
sub dword [ebp - 0x3c], 0x4b8615df
mov dword [ebp - 0x38], 0x5a4e10fc
sub dword [ebp - 0x38], 0xe01ccce
mov dword [ebp - 0x34], 0x59c7e0b4
sub dword [ebp - 0x34], 0x59c7e0b4
lea eax, [ebp - 0x40]
push eax
mov eax, 0x45ccf985
sub eax, 0x35ca87f9
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5a127788
add dword [ebp - 0x40], 0x1a5ff1ce
mov dword [ebp - 0x3c], 0x3b8b04c4
sub dword [ebp - 0x3c], 0xfa1ea34f
mov dword [ebp - 0x38], 0xbfb1f091
sub dword [ebp - 0x38], 0x5c428425
mov dword [ebp - 0x34], 0x95323f4a
sub dword [ebp - 0x34], 0x95323f4a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xff0b2891
sub eax, 0xef08b711
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3f456
push 0
call eax
mov ecx, 0x42aa
xor edi, edi
add edi, eax
mov esi, 0xbb4479c4
sub esi, 0xab40e1c4
add esi, dword [ebp - 0x30]
mov ebx, 0xb3fb4a5a
sub ebx, 0x56fb0296
xor dword [ebp - 0x24], 0x659cdd51
mov edx, dword [esi]
sub dword [ebp - 0x20], edx
xor edx, ebx
sub dword [ebp - 0x10], ecx
mov dword [edi], edx
sub dword [ebp - 0xc], edi
add edi, 0x4d880821
sub edi, 0x4d88081d
add esi, 4
loop 0x10020cb7
add eax, 0xfd7b
xor ebx, ebx
add ebx, eax
add eax, 0xf681d486
add eax, 0x97e2b7f
mov ecx, 0x8a6a0907
sub ecx, 0x7a6a0907
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x10021388
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100327bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100331a8], 0
jne 0x10021493
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jbe 0x1002147d
cmp dword [ebp - 0x94], 5
je 0x1002143c
cmp dword [ebp - 0x94], 6
jne 0x10021489
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021430
dec eax
je 0x10021424
dec eax
je 0x10021418
dec eax
jne 0x10021489
mov dword [0x100331a8], 0x6b
jmp 0x10021493
mov dword [0x100331a8], 0x6a
jmp 0x10021493
mov dword [0x100331a8], 0x69
jmp 0x10021493
mov dword [0x100331a8], 0x68
jmp 0x10021493
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x10021471
dec eax
je 0x10021465
dec eax
je 0x10021459
mov dword [0x100331a8], 0x67
jmp 0x10021493
mov dword [0x100331a8], 0x66
jmp 0x10021493
mov dword [0x100331a8], 0x65
jmp 0x10021493
mov dword [0x100331a8], 0x64
jmp 0x10021493
mov dword [0x100331a8], 1
jmp 0x10021493
mov dword [0x100331a8], 0x6c
mov ecx, dword [ebp - 4]
mov eax, dword [0x100331a8]
xor ecx, ebp
call fcn.1002336a
leave
ret

Function at 0x1002336a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100327bc]
jne 0x10023374
repz ret
jmp fcn.10023b89
Function at 0x401256
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
jmp 0x40127f
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
and dword [ebp - 4], 0
mov byte [ebp - 0x2c], 0x52
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x67
mov byte [ebp - 0x29], 0x51
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x79
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
jmp 0x401316
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
jmp 0x40133d
test eax, eax
je 0x401377
jmp 0x401350
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x401377
jmp 0x401386
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x4017a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x4017c1
movzx eax, word [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
jmp 0x4017e3
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp + 0x14], eax
jmp 0x401816
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x40188d
jmp 0x401837
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, ebx
je 0x40188d
jmp 0x401864
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40188a
push 1
pop ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194
Function at 0x401dbc
Capabilities:
Encode data using xor

Disassembly:
push 0x401fe8
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
dec eax
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or eax, dword [ebp + 0x16c312e2]
popal
dec ebp
xchg byte [ecx - 0x57], ch
ror dword [ebp + 0xb84265], 0
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x68636952
push ebx
je 0x401e60
jb 0x401e75
add byte [esi + esi], dh
jge 0x401e29
xor ch, byte [esi]
add byte [ebx], ah
add byte cs:[ebx], ah
xor byte [ebx], ah
inc ebx
cmp bl, byte [edi + edx*2]
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edi - 0x3e], bh
ja 0x401e07
add eax, ecx
pop ecx
inc edx
mov gs, word [ebx]
add byte [edx], ch
push 0x63
enter 0x4259, 0xffffffffffffff8e
sub eax, dword [eax]
sub ch, byte [edx + 0x63]
fisub word [esi + 1]
add byte [eax], al
add byte [eax - 0x50000000], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ebp + 0x41], al
inc edx
xor al, byte [ecx]
and byte [ebx + 0x30], al
sub eax, 0x31000033
sub eax, 0x46433131
sub eax, 0x63695041
je 0x401ed2
jb 0x401ec4
inc edx
jne 0x401ed6
je 0x401ed3
outsb dx, byte [esi]
add byte [eax], dh
inc edx
xor ebx, 0x9545e8a6
fimul word [eax - 0x6b]
insd dword es:[edi], dx
xchg ebp, eax
in eax, 0xf3
ljmp 0xaefb
ljmp 0xaefb:0xab0ae7b0
xor byte [eax], bh
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
invalid
inc dword [eax]
add byte [eax], al
add byte [ecx + edi + 0x40], dh
add byte [eax], al
je 0x401f13
inc eax
add ah, bl
mov eax, dword [0x4e]
add byte [eax], al
clc
sbb dword [eax], esp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, bh
push ds
inc eax
add byte [ecx], al
add byte [edi], al
add byte [eax], dh
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + 0x10004e], bh
add byte [eax], al
xor byte [edi], bl
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dh
pop ds
inc eax
add byte [edx], bl
add byte [edx], bl
add byte [eax - 0x73], dh
sbb byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
cmc
add dword [eax], eax
add byte [edx + eax], dl
add byte [eax], al
or al, byte [eax]
or al, byte [eax]
mov word [ebp + 0x220018], cs
and al, byte [eax]
cwde
lea ebx, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
call 0x11401f70
add al, byte [eax]
add byte [ecx], al
add byte [esi], al
add byte [eax], dh
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x11398058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.113981a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1139807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1139806a
add dl, dl
jne 0x11398089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113980dc
xor eax, eax
add dl, dl
jne 0x11398096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1139817d
add dl, dl
jne 0x113980a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113980b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113980bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113980c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x113980d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11398075
mov eax, 1
add dl, dl
jne 0x113980ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113980f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113980e1
sub eax, ebx
mov ebx, 1
jne 0x11398128
mov ecx, 1
add dl, dl
jne 0x1139810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11398119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11398105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11398075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1139813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1139814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11398136
cmp eax, 0x7d00
jae 0x1139816d
cmp eax, 0x500
jb 0x11398168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11398075
cmp eax, 0x7f
ja 0x11398170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11398075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1139819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11398075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x409bd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x558b60
push 0xa
push 0x409c68
mov eax, dword [0x558b50]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x409bf8
call fcn.00412340
push ebx
mov eax, dword [0x558b50]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x409c0f
call fcn.00412340
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x409c21
call fcn.00412340
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x558b64], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x558b68], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x558b6c], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x558b70], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x558b74], ecx
add edx, dword [eax + 0x14]
mov dword [0x558b78], edx
pop esi
pop ebx
ret

Function at 0x40b548
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40b5f1
test eax, edx
je 0x40b5f4
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40b571
push edx
mov edx, eax
mov eax, esp
call fcn.00405a90
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40b587
push eax
lea eax, [esp + 8]
call fcn.00405a90
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40b596
movzx eax, word [eax]
sub eax, ecx
jmp 0x40b5bd
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40b5d7
add ecx, 4
js 0x40b5ae
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40b5d4
push eax
mov eax, ecx
mov edx, 2
call fcn.00404f88
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40b5bb
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40b5bd
xor eax, eax
ret
test eax, eax
je 0x40b604
test edx, edx
jne 0x40b558
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40c490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405900
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40c4ae
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x40c4cf
cmp ebx, 3
je 0x40c4cf
cmp ebx, 0x7b
je 0x40c4cf
mov eax, esi
call fcn.0040c450
test al, al
jne 0x40c4d3
xor eax, eax
jmp 0x40c4d5
mov al, 1
pop esi
pop ebx
ret

Function at 0x40c4d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405900
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40c4f1
test al, 0x10
jne 0x40c4f5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x40fbb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40fbed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004059b0
jmp 0x40fbf6
mov eax, ebx
mov edx, esi
call fcn.00405874
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40fc00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40fc22
movzx eax, word [esp]
jmp 0x40fc24
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4103ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4104d1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004101c0
mov esi, eax
mov eax, dword [0x555cbc]
cmp byte [eax], 0
je 0x410479
mov eax, dword [0x555950]
call fcn.00403554
call fcn.00403168
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x410388]
call fcn.00407280
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4104ec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4104b5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x5558d4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x558b50]
call fcn.00407374
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4104d8
lea eax, [ebp - 4]
mov edx, dword [0x410388]
call fcn.0040728c
ret
Function at 0x47bbec
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x47bbfe
add esp, 0xfffffff0
call fcn.004041b8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004275f0
mov eax, dword [0x5558dc]
mov dword [eax + 4], ebx
mov dword [eax], 0x47c000
mov eax, dword [0x5558e8]
mov dword [eax + 4], ebx
mov dword [eax], 0x47c00c
mov eax, ebx
call fcn.0047c018
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41d004]
call fcn.00403d38
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41d004]
call fcn.00403d38
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41d004]
call fcn.00403d38
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41d004]
call fcn.00403d38
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41d004]
call fcn.00403d38
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x476f4c
push eax
push 0
push 0
mov eax, dword [0x555b0c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42deb4]
call fcn.0042fd00
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x42deb4]
call fcn.0042fd00
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x42deb4]
call fcn.0042fd00
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x42deb4]
call fcn.0042fd00
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.0047c5ac
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47c434
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47c434
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47c434
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x47c434
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47bd51
call fcn.00404210
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret