joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028c19
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028caa
lea eax, [esp + 0x14]
mov word [esp + 0x17], 0x7470
push eax
push esi
mov dword [esp + 0x2b], 0x74786574
mov dword [esp + 0x25], 0x43657269
mov dword [esp + 0x21], 0x75716341
mov word [esp + 0x29], 0x6e6f
mov word [esp + 0x1c], 0x7243
mov byte [esp + 0x1e], 0x79
mov word [esp + 0x2f], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028ca3
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x18]
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x20
ret

Function at 0x10028cbf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028d25
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0x6d617261
push eax
push esi
mov dword [ebp - 0x14], 0x74655374
mov dword [ebp - 0x18], 0x70797243
mov dword [ebp - 0x10], 0x5079654b
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028d1e
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10028d36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x34]
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028dba
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x5079654b
push eax
push esi
mov word [esp + 0x1c], 0x4774
mov dword [esp + 0x25], 0x6d6172
mov word [esp + 0x19], 0x7972
mov byte [esp + 0x1b], 0x70
mov word [esp + 0x1e], 0x7465
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x24], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028db3
push dword [esp + 0x3c]
push ebp
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret
Function at 0x10028dcf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028e3f
lea eax, [ebp - 0x14]
mov word [ebp - 9], 0x4b79
push eax
push esi
mov word [ebp - 0x14], 0x7243
mov word [ebp - 0xe], 0x7365
mov word [ebp - 0x11], 0x7470
mov word [ebp - 0xc], 0x7274
mov word [ebp - 6], 0x79
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 7], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028e38
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x10028e4f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.100278f9
mov esi, eax
test esi, esi
je 0x10028ed2
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x416f66
push eax
push esi
mov dword [esp + 0x1e], 0x72655665
mov word [esp + 0x22], 0x6973
mov dword [esp + 0x18], 0x46746547
mov word [esp + 0x25], 0x496e
mov word [esp + 0x1c], 0x6c69
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x27], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028ecb
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x10028ee7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x10028f5f
lea eax, [esp + 0x10]
mov dword [esp + 0x16], 0x726f706d
push eax
push esi
mov dword [esp + 0x23], 0x79654b
mov dword [esp + 0x1a], 0x49747079
mov word [esp + 0x18], 0x7243
mov byte [esp + 0x22], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10028f58
push ebp
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push dword [esp + 0x3c]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x14
ret
Function at 0x100290a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1012e750]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], eax
inc edi
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x1002912a
lea eax, [esp + 0x14]
mov dword [esp + 0x1e], 0x417845
push eax
push esi
mov word [esp + 0x20], 0x6570
mov word [esp + 0x1d], 0x6765
mov byte [esp + 0x1c], 0x52
mov dword [esp + 0x22], 0x79654b6e
mov byte [esp + 0x1f], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10029123
push dword [esp + 0x10]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebp
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002ca58
add esp, 0x18
ret

Function at 0x100291d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
inc edi
call fcn.1002782c
mov esi, eax
test esi, esi
je 0x1002922d
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x654b6573
push eax
push esi
mov word [ebp - 6], 0x79
mov dword [ebp - 0xf], 0x6c436765
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10029226
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret

Function at 0x1002923e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xe], 0x6163
mov word [ebp - 0xb], 0x7246
mov word [ebp - 0x10], 0x6f4c
mov byte [ebp - 0xc], 0x6c
mov word [ebp - 8], 0x65
mov byte [ebp - 9], 0x65
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002928b
push esi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002ca58
leave
ret

Function at 0x1002929a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012e750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x14], 0x64616f4c
push eax
mov dword [ebp - 0xc], 0x41797261
mov dword [ebp - 0x10], 0x7262694c
mov byte [ebp - 8], bl
call fcn.100277aa
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100292e2
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ca58
leave
ret
Function at 0x10046e60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x10
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
nop dword [eax + eax]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x10046e70
mov bl, byte [esp + 0x28]
xor edx, edx
movzx ecx, bl
xor al, al
mov esi, 0xff
mov dword [esp + 0x18], ecx
nop
mov edi, 1
mov dword [esp + 0x10], 0
cmp esi, edi
jbe 0x10046eb4
lea edi, [edi*2 + 1]
cmp edi, esi
jb 0x10046ea1
jmp 0x10046eb4
mov edx, dword [esp + 0x14]
movzx eax, al
mov cl, byte [eax + ebp]
mov eax, dword [esp + 0x24]
add cl, byte [edx + eax]
inc edx
cmp edx, dword [esp + 0x18]
lea eax, [ebx + ecx]
movzx ebx, al
movzx eax, cl
cmovb ebx, eax
sbb eax, eax
and eax, edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
movzx edx, bl
inc eax
and edx, edi
mov dword [esp + 0x10], eax
cmp eax, 0xb
jbe 0x10046ef7
mov eax, edx
xor edx, edx
div esi
mov al, bl
mov bl, byte [esp + 0x28]
cmp edx, esi
ja 0x10046eb0
mov bl, byte [esi + ebp]
movzx ecx, dl
mov edx, dword [esp + 0x14]
mov al, byte [ecx + ebp]
mov byte [esi + ebp], al
mov byte [ecx + ebp], bl
mov ecx, dword [esp + 0x1c]
mov al, cl
mov bl, byte [esp + 0x28]
sub esi, 1
jne 0x10046e90
movzx eax, byte [ebp + 1]
mov byte [ebp + 0x100], al
movzx eax, byte [ebp + 3]
mov byte [ebp + 0x101], al
movzx eax, byte [ebp + 5]
mov byte [ebp + 0x102], al
movzx eax, byte [ebp + 7]
mov byte [ebp + 0x103], al
movzx eax, cl
pop edi
pop esi
movzx eax, byte [eax + ebp]
mov byte [ebp + 0x104], al
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x40ab42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40ab51
pop dword [ebp - 8]
mov eax, 0x380cfa70
sub eax, 0x37cc4f1f
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x39d5d
push 0
mov eax, 0x393e1de7
sub eax, 0x38fd2d57
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x4dba
xor edi, edi
add edi, eax
mov ebx, 0x62635d8e
add ebx, 0x9dde4c72
add ebx, dword [ebp - 8]
mov esi, 0xfde36ee4
sub dword [ebp - 4], 0x35af1231
mov edx, dword [ebx]
add dword [ebp - 4], ebx
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 4], eax
add edi, 0x295b0187
sub edi, 0x295b0183
add ebx, 0xb2a03c37
sub ebx, 0xb2a03c33
loop 0x40aba6
add eax, 0xa7613b2a
add eax, 0x589fee91
xor ebx, ebx
add ebx, eax
add eax, 0xec45d040
add eax, 0x13ba2fc5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x404ff0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e678
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5b5be8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, 7
mov eax, str.Global_
lea esi, [ebp - 0x2c]
mov ebx, ecx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00409b10
mov ecx, esi
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x1d0]
push ecx
lea ecx, [ebp - 0x64]
call fcn.0040b2f0
push eax
mov eax, str._LAUNCHER
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.0040b2f0
add esp, 8
mov edi, eax
mov esi, 0x5b75b4
mov byte [ebp - 4], 2
call fcn.00409930
mov edi, 0x10
cmp dword [ebp - 0x34], edi
jb 0x405094
mov edx, dword [ebp - 0x48]
push edx
call fcn.004310e1
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
cmp dword [ebp - 0x50], edi
jb 0x4050b8
mov eax, dword [ebp - 0x64]
push eax
call fcn.004310e1
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x64], 0
cmp dword [ebp - 0x18], edi
jb 0x4050de
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004310e1
add esp, 4
mov eax, dword [0x5b75b4]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [0x5b75c8], edi
jae 0x4050fe
mov eax, 0x5b75b4
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebx + 0x15c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4051c4
cmp eax, 5
je 0x4051c4
push str.Rappelz_Launcher
mov ecx, ebx
call fcn.0043eef5
mov ecx, ebx
call fcn.004380a0
mov edx, dword [ebx + 0x154]
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 1
push 0x80
push eax
call esi
mov ecx, dword [ebx + 0x154]
mov edx, dword [ebx + 0x20]
push ecx
push 0
push 0x80
push edx
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
call esi
push 0x11
mov edi, eax
call esi
mov ecx, dword [0x5b75b0]
mov esi, dword [0x5b75ac]
sub eax, ecx
cdq
push 1
sub eax, edx
push ecx
sar eax, 1
push esi
push eax
mov eax, edi
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
mov ecx, ebx
call fcn.0043ef80
push str.download.continue
call fcn.00424920
xor ebx, ebx
mov ecx, eax
call fcn.004247d0
test eax, eax
setne al
mov byte [0x5be780], al
lea eax, [ebx + 1]
jmp 0x4051ce
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005320a3
mov esp, ebp
pop ebp
ret
Function at 0x402f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402e20
mov esi, eax
cmp dword [0x407e7c], 0xffffffff
je 0x402fe1
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407e78]
jne 0x402fe1
lea eax, [ebp - 0x1c]
push eax
push dword [0x407e78]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407e84], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407e88], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4030f8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x4089d8
call fcn.0040625c
mov esi, dword [eax]
push 0x4089d8
call fcn.0040625c
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405ac4
call fcn.00405940
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.004059cc
call fcn.00404584
test eax, eax
jne 0x403239
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405aa4
call fcn.00404584
test eax, eax
jne 0x4031af
cmp word [ebp - 0x190], 0x5a4d
jne 0x4031af
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004059e8
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405aa4
jmp 0x4031b9
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004059e8
call fcn.00404584
test eax, eax
jne 0x40321d
cmp word [ebp - 0x190], 0x4550
jne 0x40321d
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405aa4
call fcn.00404584
test eax, eax
jne 0x40321d
cmp dword [ebp - 0x288], 0x4550
jne 0x40321d
cmp word [ebp - 0x22c], 3
jne 0x40321d
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00405a18
push 0x4089d0
call fcn.0040625c
mov dword [eax], 0
push 0x4089d8
call fcn.0040625c
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402e20
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x403334
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407f1c], 0
je 0x403356
mov eax, dword [0x407f1c]
mov dword [ebp - 4], eax
jmp 0x4033eb
push 0x104
call fcn.00404658
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.00404120
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x40339b
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.004032cc
mov esi, eax
inc esi
push esi
call fcn.00404120
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.004046b8
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x4033cc
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x4033d9
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404e98
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407f1c], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4034c8
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404e0c
xor eax, eax
mov bl, 0
cmp dword [0x407ec0], 0
jne 0x403516
push 0x407c10
push 1
call fcn.00402d2c
mov dword [0x407ec0], eax
cmp dword [0x407ec0], 0
jne 0x40352f
push 0x8000
call fcn.00404658
mov esi, eax
mov bl, 1
jmp 0x403569
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407ec0]
test eax, eax
jne 0x403559
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x403592
push esi
push 0x8000
push 0xff
call fcn.00404ef4
push esi
push 0x24
push 0
call fcn.00404ef4
mov eax, esi
add eax, 0xc
push eax
call fcn.00404740
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403940
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.004038cc
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x403978
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x40395e
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407e78]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403d20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403d40
mov al, byte [ebp - 4]
jmp 0x403d43
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc