joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d04
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x47e038], 0
je 0x406d2f
mov edx, edi
mov eax, esi
call dword [0x47e038]
mov ebx, eax
jmp 0x406d40
mov eax, 8
call fcn.00404ea8
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x483055], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406ccc
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x406d70
mov eax, ebx
call fcn.00404ec4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40a220
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a387
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406e44
cmp si, word [0x47ea10]
jb 0x40a2b8
cmp si, word [0x47ec10]
ja 0x40a2b8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40a2b8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x47ea10]
jae 0x40a292
mov edi, ebx
dec edi
jmp 0x40a2b3
cmp si, word [ebx*8 + 0x47ea10]
jbe 0x40a2a2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40a2b3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x47ea14]
call fcn.0040a13c
jmp 0x40a2b8
cmp edi, dword [ebp - 8]
jae 0x40a27c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40a367
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x40a367
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004079b8
push dword [ebp - 0x160]
push 0x40a3a4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004079b8
push dword [ebp - 0x164]
push 0x40a3b4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004079b8
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a38e
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406ea4
pop eax
jmp eax
Function at 0x40a53c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a642
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x485c0c
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x485c24]
jne 0x40a588
mov eax, esi
mov edx, 0x485c26
mov ecx, 0x55
call fcn.004079b8
push 0x485c0c
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x40a62a
push 0x485c0c
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.00406e44
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x40a5f7
cmp byte [0x485c08], 0
je 0x40a5bc
mov edx, esi
mov eax, ebx
call fcn.0040a420
jmp 0x40a5f7
mov edx, esi
mov eax, ebx
call fcn.0040a220
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40a5f7
cmp dword [esi], 0
je 0x40a5e0
mov eax, esi
mov edx, 0x40a65c
call fcn.00407aa4
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040a220
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407aa4
push 0x485c0c
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x485c24], bx
mov eax, dword [esi]
call fcn.0040792c
mov ecx, eax
mov eax, 0x485c26
mov edx, 0xaa
call fcn.0040a09c
push 0x485c0c
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a649
lea eax, [ebp - 4]
call fcn.00406e44
pop eax
jmp eax
Function at 0x40a884
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f38
xor eax, eax
push ebp
push 0x40aaac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40a8ca
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x40a8e4
mov eax, dword [ebp - 4]
call fcn.0040792c
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0040a09c
cmp word [ebp - 0x21e], 0
je 0x40aa8f
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40aabc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a9b3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40aabc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a9b3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40aaf8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a9b3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40aaf8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a9b3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ab2c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a9b3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ab60
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40aa8f
xor eax, eax
push ebp
push 0x40aa88
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0040a684
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40aa16
mov eax, dword [ebp - 0x14]
call fcn.00404ea8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040797c
jmp 0x40aa61
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x40aba0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40aa61
mov eax, dword [ebp - 0x14]
call fcn.00404ea8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x40aba0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040797c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aa8f
cmp dword [ebp - 0xc], 0
je 0x40aa7c
mov eax, dword [ebp - 0xc]
call fcn.00404ec4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aab3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ea4
pop eax
jmp eax
Function at 0x40adc0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f38
xor eax, eax
push ebp
push 0x40ae82
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004079b8
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407afc
mov eax, dword [ebx]
call fcn.0040ac68
test al, al
jne 0x40ae5d
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004079b8
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407afc
mov eax, dword [ebx]
call fcn.0040ac68
test al, al
jne 0x40ae5d
mov eax, ebx
call fcn.00406e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ae89
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ea4
lea eax, [ebp - 4]
call fcn.00406e44
pop eax
jmp eax

Function at 0x40c764
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x41c31c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x41c355
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406f90
jmp 0x41c35e
mov eax, ebx
mov edx, esi
call fcn.004071e8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41c368
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x41c38c
movzx eax, word [esp]
jmp 0x41c38e
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41d7bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41d8e3
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041d5c4
mov esi, eax
mov eax, dword [0x4823d0]
cmp byte [eax], 0
je 0x41d889
mov eax, dword [0x482244]
call fcn.004052c8
call fcn.00404ffc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41d78c]
call fcn.004099a8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41d8fc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x41d8c5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x482214]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48662c]
call fcn.00409d40
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d8ea
lea eax, [ebp - 4]
mov edx, dword [0x41d78c]
call fcn.00409acc
pop eax
jmp eax
Function at 0x41e578
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x41e5bb
mov eax, dword [ebp - 0x10c]
mov dword [0x4868c8], eax
mov eax, 0x4868cc
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.004079b8
mov eax, 0x4868d0
call fcn.00406e44
xor eax, eax
mov dword [0x4868d4], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x48678c], 0xa
jl 0x41e711
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x41e71c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x41e711
xor eax, eax
push ebp
push 0x41e70a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x41e778
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x41e66a
cmp dword [ebp - 8], 2
jle 0x41e66a
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x41e63d
adc edx, 0
mov eax, 0x4868d0
call fcn.00407a24
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4868d0]
call fcn.0040792c
push eax
push 0
push 0
push 0x41e778
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x41e6c4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x41e798
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x41e6c4
cmp dword [ebp - 8], 2
jle 0x41e6c4
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x41e699
adc edx, 0
mov eax, 0x4868d0
call fcn.00407a24
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4868d0]
call fcn.0040792c
push eax
push 0
push 0
push 0x41e798
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x4868d4
push 0
push 0
push 0x41e7ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x41e6f1
xor eax, eax
mov dword [0x4868d4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e711
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x47f560], 1
mov esp, ebp
pop ebp
ret
Function at 0x41f08c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407314
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c744
mov edi, eax
cmp edi, 0x104
jbe 0x41f037
mov eax, edi
add eax, eax
call fcn.00404ea8
mov esi, eax
jmp 0x41f039
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c744
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41f072
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41f05c
mov eax, esp
cmp esi, eax
je 0x41f07f
mov eax, esi
call fcn.00404ec4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41f0b8
cmp bl, 0
je 0x41f0b4
cmp bl, 0x41
jl 0x41f0af
cmp bl, 0x5a
jg 0x41f0af
or bl, 0x20
xor al, bl
inc esi
jmp 0x41f093
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41eff8

Function at 0x41fb50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41fb70
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x41fb8a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41fb85
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41fb8f
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x41fbfd
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x41fc46
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41fbbb
inc dword [ebp - 0xc]
jmp 0x41fbd3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x41fbd3
cmp dword [ebp - 0xc], 0
jle 0x41fbd3
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x41fbf5
xor eax, eax
jmp 0x41fbf1
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41fbf0
mov eax, esi
jmp 0x41fc49
inc eax
cmp eax, ecx
jle 0x41fbdd
inc esi
cmp esi, dword [ebp - 8]
jl 0x41fba7
jmp 0x41fc46
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x41fc46
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41fc1e
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x41fc40
xor eax, eax
jmp 0x41fc3c
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41fc3b
mov eax, esi
jmp 0x41fc49
inc eax
cmp eax, ecx
jle 0x41fc28
inc esi
cmp esi, dword [ebp - 8]
jl 0x41fc06
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41fdb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x41fdd7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41fde7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x41ff09
test ebx, ebx
jl 0x41ff09
test esi, esi
jle 0x41ff09
mov eax, dword [ebp - 8]
call fcn.0040792c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040792c
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x41fea6
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x41ff09
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x41fe8b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x41fe5a
inc dword [ebp - 0x14]
jmp 0x41fe6a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x41fe6a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x41fe75
or eax, 0xffffffff
jmp 0x41fe8b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x41fe88
inc eax
jmp 0x41fe8b
or eax, 0xffffffff
test eax, eax
jl 0x41fe93
cmp esi, eax
jg 0x41fe48
cmp esi, eax
jg 0x41fe9e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x41ff0c
inc edx
dec dword [ebp - 0x1c]
jne 0x41fe44
jmp 0x41ff09
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x41ff09
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x41fef0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x41fecf
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x41feda
or eax, 0xffffffff
jmp 0x41fef0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x41feed
inc eax
jmp 0x41fef0
or eax, 0xffffffff
test eax, eax
jl 0x41fef8
cmp esi, eax
jg 0x41feb8
cmp esi, eax
jg 0x41ff03
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x41ff0c
inc edx
dec dword [ebp - 0x1c]
jne 0x41feb4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42d8e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x42d8e8
push ebx
push esi
mov ebx, edx
mov byte [ebp - 0xd], al
xor eax, eax
push ebp
push 0x42db06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004313b0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00432790
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004328a0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00432d80
test eax, eax
jne 0x42d960
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004173d0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
lea eax, [ebp - 0xc]
call fcn.00407afc
jmp 0x42da3a
cmp dword [0x47f780], 0
jne 0x42d9f1
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00432790
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.004313b0
xor ebx, ebx
inc ebx
push dword [ebp - 0xc]
push 0x42db24
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004173d0
push dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407b84
mov eax, dword [ebp - 8]
call fcn.00432b40
test al, al
jne 0x42d988
mov eax, dword [ebp - 8]
call fcn.00432cc0
test al, al
jne 0x42d988
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.00431360
mov edx, dword [ebp - 0x28]
mov eax, 0x47f780
call fcn.004071e8
mov dl, 1
mov eax, dword [0x47f780]
call fcn.0042d8a0
mov eax, dword [0x47f780]
call fcn.00431760
mov eax, dword [0x47f780]
call fcn.00432cc0
test al, al
je 0x42da2a
push dword [0x47f780]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004173d0
push dword [ebp - 0x2c]
push 0x42db3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407b84
jmp 0x42da3a
lea eax, [ebp - 0xc]
mov ecx, 0x42db50
mov edx, dword [ebp - 4]
call fcn.00407afc
xor ebx, ebx
inc ebx
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.004173d0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00407afc
mov eax, dword [ebp - 8]
call fcn.00432b40
test al, al
jne 0x42da3c
mov eax, dword [ebp - 8]
call fcn.00432cc0
test al, al
jne 0x42da3c
push 1
mov eax, dword [ebp - 8]
call fcn.0040792c
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040792c
mov esi, eax
push esi
call sub.KERNEL32.DLL_MoveFileExW
test eax, eax
je 0x42daac
push 4
push 0
push ebx
call sub.KERNEL32.DLL_MoveFileExW
test eax, eax
jne 0x42daa8
movzx edx, byte [ebp - 0xd]
mov eax, dword [ebp - 8]
call fcn.0042d8a0
mov bl, 1
jmp 0x42dabc
push 4
push 0
push esi
call sub.KERNEL32.DLL_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42db0d
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00406ea4
lea eax, [ebp - 0x20]
call fcn.00406e44
lea eax, [ebp - 0x1c]
call fcn.00406e44
lea eax, [ebp - 0x18]
call fcn.00406e44
lea eax, [ebp - 0x14]
call fcn.00406e44
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406ea4
pop eax
jmp eax
Function at 0x42ef20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
add esp, 0xffffffe8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
mov edi, dword [esp + 4]
test edi, edi
jle 0x42f028
movzx eax, word [esi]
mov word [esp + 8], ax
movzx eax, word [esp + 8]
add eax, 0xffffffc6
sub ax, 7
jae 0x42ef54
mov al, 1
jmp 0x42ef6b
movzx eax, word [esi]
mov word [esp + 0xa], ax
movzx eax, word [esp + 0xa]
add eax, 0xffffffb9
sub ax, 0x1a
setb al
test al, al
je 0x42ef73
mov dl, 1
jmp 0x42efb2
movzx eax, word [esi + 2]
mov word [esp + 0xc], ax
movzx eax, word [esp + 0xc]
add eax, 0xffffffc6
sub ax, 7
jae 0x42ef91
mov byte [esp + 0x10], 1
jmp 0x42efad
movzx eax, word [esi + 2]
mov word [esp + 0xe], ax
movzx eax, word [esp + 0xe]
add eax, 0xffffffb9
sub ax, 0x1a
setb al
mov byte [esp + 0x10], al
movzx edx, byte [esp + 0x10]
test dl, dl
jne 0x42f028
movzx eax, word [esi]
mov word [esp + 0x12], ax
movzx eax, word [esp + 0x12]
add eax, 0xffffffd0
sub ax, 0x37
jb 0x42efd3
mov byte [esp + 0x16], 1
jmp 0x42eff1
movzx eax, word [esi + 2]
mov word [esp + 0x14], ax
movzx eax, word [esp + 0x14]
add eax, 0xffffffd0
sub ax, 0x37
setb al
xor al, 1
mov byte [esp + 0x16], al
cmp byte [esp + 0x16], 0
jne 0x42f028
movzx eax, byte [esi]
movzx eax, word [eax*2 + 0x47f798]
shl eax, 4
movzx edx, byte [esi + 2]
movzx edx, word [edx*2 + 0x47f798]
add al, dl
mov edx, dword [esp]
mov byte [edx], al
inc dword [esp]
add esi, 4
dec edi
test edi, edi
jg 0x42ef3a
mov eax, dword [esp + 4]
sub eax, edi
add esp, 0x18
pop edi
pop esi
ret
Function at 0x4319b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x431a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x431a6b
xor eax, eax
push ebp
push 0x431a64
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00431240
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x431a47
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, esi
call fcn.004352d0
mov eax, dword [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00407c6c
mov eax, dword [ebp - 0xc]
mov edx, 0x431aa8
call fcn.00407c34
jne 0x431a41
mov edx, ebx
mov eax, esi
call fcn.004357f0
dec ebx
cmp ebx, 0xffffffff
jne 0x431a07
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431a6b
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsW
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431a8f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406ea4
pop eax
jmp eax