joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103a90a2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi], edx
mov dword [esp + 0x10], 0x6e3d5d33
jmp 0x1033cb3e
xor ebp, esi
xchg esi, ebx
add esi, dword [esp + esi*2 + 0x20]
add ebx, ebx
xchg ebp, ebx
movsx eax, bx
lea esi, [esi + ebx - 0x2e9b3579]
btc eax, ebp
push ebx
bswap esi
sal ebp, 0x76
btc ax, 0x1a
neg esi
bts ebp, ebx
not esi
sal dword [esp + ebp*4 - 0x10], 0xa1
push ebp
bswap esi
shl al, 0xe1
sal dword [esp + ebp], 0xc
not word [esp + ebp - 2]
lea esi, [ebp + esi + 0x75218888]
btc ebp, eax
jae 0x103f946a
xor bl, dl
sub esi, 4
push 0xbba41111
push 0xbeb9a71e
jmp 0x102b6e42
lea esp, [esp + 0x18]
jmp fcn.102fff0a
je 0x10352eb3
add byte [ebp + 0x824648d], bl
call fcn.10308766
lea esi, [ecx + ecx*8 + 0x1f8e259b]
movzx ebp, cx
mov ecx, 0
add esi, 0x4ab0ea15
sbb si, si
push ebx
movzx ebx, si
push eax
push ecx
jp 0x10335c55
clc
outsb dx, byte [esi]
out dx, eax
push ebx
xor ebx, dword [edi + 0x17]
push ebp
int 0xf8
cmp dword [ebp - 0x1cfcceb7], eax
out 0xef, eax
and edi, dword [ebx]
and al, 0x2d
sbb dword [ecx - 0x6c], ebx
or eax, 0x43eba960
push edi
popal
sahf
out dx, eax
rol byte ss:[ebx], 1
inc ebx
jae 0x10352f1a
jg 0x10352f23
xor dword [ecx + ebp*4], ebx
popfd
cld
inc esp
jbe 0x10352f3e
pop edx
mov eax, dword [0xfc9da910]
arpl word [eax + 0x70], bx
sub al, 0x4a
je 0x10352e8d
mov ebp, 0xd8986dcf
push 0x3100b9c6
jmp 0x10352f62
invalid
aaa
mov byte [0x4342fad9], al
das
adc dh, byte [esi + 0x6d8923be]
push edi
jbe 0x10352fad
and ecx, dword [ecx + 0x7a76576d]
cmc
add eax, 0x2e105a69
inc esi
cwde
mov eax, dword [0x64a8d898]
test al, 0x64
xchg esi, eax
aas
push eax
rol dword [ebx - 0x4095d082], 0x82
adc dl, byte [ebx]
outsd dx, dword [esi]
push 0x2f47c58
cmp dh, ch
cmc
or byte [edx], al
jg 0x10352f2d
inc ebp
mov bl, 0xf0
xor dl, al
sbb eax, 0x2ec56d
in al, 0xde
fld dword [ecx + ebp*2]
add ah, ah
fcompp
add al, 0x69
dec esp
invalid
jnp 0x10352fb2
mov al, byte [0x2557679e]
ret
push edi
and eax, 0xe05010c3
cld
sahf
scasd eax, dword es:[edi]
invalid
mov dword [esp + 4], ecx
mov dword [esp], esi
mov ecx, 0x2252b0d
push ebp
bswap ecx
pushfd
jmp 0x10352e9a
adc esi, ecx
bswap ebp
inc dword [esp + ebp - 0x43ffffff]
mov dword [esp + eax*2 - 0x41e8], edi
call fcn.1030a2ba

Function at 0x103aa688
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [esp + 0xb4]
call fcn.103f597b

Function at 0x103aa8b7
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x24]
jmp fcn.102fff0a
jmp 0x1034d705

Function at 0x103ddd42
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.103d20c0

Function at 0x103e0829
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x20]
jmp fcn.1041e7ec
Function at 0x103ef953
Capabilities:
Encode data using base64

Disassembly:
sal dword [esp], 0xea
adc edi, 2
not word [esp]
jmp 0x10371ea6
push 0xba84cc34
mov word [edi], cx
jmp 0x10375538
mov dword [esp + 2], 0x9c0a2c03
jmp 0x104cfac2
rol cl, 1
add cl, 0x1e
call fcn.1039941c
dec al
xor bl, al
sar word [esp + ebp - 0x592cfffd], 7
neg ebp
lea eax, [esp + eax + 4]
add byte [esp + 1], 0xb7
call fcn.103e9b42
mov ecx, 0x7039d40c
mov dword [esp + ecx - 0x7039d40c], 0x6d09f5b0
mov cx, word [edx + ecx - 0x7039d40c]
jmp 0x103674a4
call fcn.10450034
shl cx, 0x4d
lea esi, [esi + ecx - 0x5095dffc]
sbb ecx, ecx
neg cx
inc ecx
sbb edi, ecx
or cx, cx
rol cl, 0x64
sal cl, 0x24
or cl, byte [ecx + edi]
xor cl, bl
ror cl, 1
push 0x1c876308
dec cl
sal dword [esp], 0xa1
sal byte [esp + 2], 1
jns 0x103a166d
dec eax
lea esp, [esp + 0x18]
jmp fcn.1040d023
lea esp, [esp + 8]
jmp fcn.1045547f

Function at 0x1042366e
Capabilities:
Encode data using base64

Disassembly:
sal byte [esp + 7], 0x25
not dx
jne 0x102cd71e
dec eax
lea esp, [esp + 0x18]
jmp fcn.1040d023

Function at 0x1043b259
Capabilities:
Encode data using base64

Disassembly:
push 0x1382c492
dec eax
lea esp, [esp + 0x20]
jmp fcn.1041e7ec

Function at 0x1043bbc2
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10441923
push 0x27a58db9
lea esp, [esp + 0x20]
jmp fcn.103d20c0

Function at 0x1045496b
Capabilities:
Encode data using base64

Disassembly:
inc bp
mov dword [ecx], eax
dec eax
lea esp, [esp + 8]
jmp fcn.1041e7ec

Function at 0x10457115
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.102fff0a

Function at 0x10463e5b
Capabilities:
Encode data using base64

Disassembly:
push 0x7700eb16
dec eax
lea esp, [esp + 0x30]
jmp fcn.1041e7ec

Function at 0x1047fd92
Capabilities:
Encode data using base64

Disassembly:
push 0xaeb3d78d
dec eax
lea esp, [esp + 0x20]
jmp fcn.1040d023
inc cx
mov dword [ecx], esi
push 0x1ab9522c
jmp 0x1042e4e7

Function at 0x10487b75
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jmp fcn.102fff0a

Function at 0x1048a863
Capabilities:
Encode data using base64

Disassembly:
dec eax
not dword [esp]
rep movsb byte es:[edi], byte [esi]
dec eax
shr dword [esp + 8], 0x9a
mov edi, 0x69810d8c
push dword [esp + 0x10]
popfd
dec eax
mov edi, dword [esp + edi - 0x69810d74]
dec eax
lea esp, [esp + 0x20]
jmp fcn.1041e7ec
lea ecx, [esi + 0xb9]
dec esi
lea edx, [esi + ecx - 0xaf]
dec eax
shl esi, 0x43
dec eax
shl dword [esp + esi*2 - 0x2e8], 0xa6
dec ecx
and edx, 0xfffffff0
dec eax
mov dword [esp + esi - 0x178], esi
inc word [esp + esi - 0x173]
dec esp
sub edx, ecx
dec ecx
mov esp, edx
push edi
movzx edi, si
pushfd
inc eax
sub bh, dh
jae 0x104cd74f
mov edx, 0xb09d8e85
shr dl, 0xe2
je 0x104d41e1
movzx edx, byte [esi]
call fcn.10460114
lea esp, [esp + 0xc]
jmp fcn.102fff0a
inc eax
adc bh, dh
dec ecx
mov esi, ebp
not edi
inc eax
not bh
dec ecx
mov edi, edx
push 0x5a27ef3c
cld
push 0x6583c203
jmp 0x10358d13

Function at 0x104a46c3
Capabilities:
Encode data using base64

Disassembly:
mov dword [esi + 4], ecx
pop ebx
mov dword [esi], edx
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
jmp fcn.102fff0a
Function at 0x104bc7d1
Capabilities:
Encode data using base64

Disassembly:
push 0xa636b008
mov eax, dword [esp + 0x10]
mov word [esi + 4], dx
jmp 0x10422a24

Function at 0x104bc7ec
Capabilities:
Encode data using base64

Disassembly:
push 0x3cabda3b
push 0xe3ff1a7
dec eax
lea esp, [esp + 0x30]
jmp fcn.1041e7ec

Function at 0x104c17f8
Capabilities:
Encode data using base64

Disassembly:
push 0x7c24f9bb
mov ebx, dword [esp + 8]
lea esp, [esp + 0xc]
jmp fcn.102fff0a

Function at 0x104d3929
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.102fff0a
Function at 0x10b4980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x10db01c]
push edi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x370463
nop
push eax
nop
call 0x77aee026
mov ebx, eax
push 0x10e4fb0
mov dword [ebp - 4], ebx
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
mov byte [ebx + edi], 0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x10b4a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x75bb43d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x10e4fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x10b4a26
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
push 0x10e4fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x370468
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10b6e30
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x10b6ed1
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x75ba9910
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x10b6f00
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x10b6f00
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x10b6ed1
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x75ba9910
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0x10b6f00
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x10b6f00
movzx eax, word [esi + 0x46]
test ax, ax
je 0x10b6f00
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.012e90f4]
push eax
call dword [fcn.012e9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x10b6ed7
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.010b74d0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x15b9010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0x10dd014], al
je 0x15b902d
inc eax
cmp byte [eax + 0x10dd014], 0
jne 0x15b9023
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.01597a40
mov dword [esi], eax
test eax, eax
je 0x15b904b
push 0x10dd014
push eax
call dword [fcn.012e9134]
mov esi, dword [0x12e8aa4]
xor eax, eax
cmp byte [esi], al
je 0x15b905e
inc eax
cmp byte [esi + eax], 0
jne 0x15b9057
inc eax
call fcn.01597a40
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x15b9075
push esi
push ebx
call dword [fcn.012e9134]
lea eax, [ebp - 0x24]
push eax
call dword [0x12e9044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0x12e8ec0], si
cmp dword [ebp + 0xc], edi
jle 0x15b90e9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0x12e8ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0x15b90a0
mov word [0x12e8ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0x15b9161
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0x15b9131
cmp dword [ecx], 0
je 0x15b9131
cmp dword [0x12e91c4], ecx
jne 0x15b911b
mov dword [0x12e91c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x15b9131
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x15b9161
cmp dword [ecx], 0
je 0x15b9161
cmp dword [0x12e91c4], eax
jne 0x15b914b
mov dword [0x12e91c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0x15b9161
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x15bb520
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x12e90e0]
test esi, esi
jne 0x15bb538
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x15bb531
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x15bb531
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x15bb59a
jmp 0x15bb580
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x12e8bf0]
add eax, esi
call fcn.015b8fb0
test eax, eax
je 0x15bb5a3
inc edi
cmp edi, dword [ebp - 4]
jb 0x15bb580
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404874
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406b14
test esi, esi
jne 0x4048aa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406c9c
jmp 0x4048c8
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004047b8
mov edi, eax
test esi, esi
je 0x4048c8
cmp dword [ebx], 0
je 0x4048c8
dec esi
jmp 0x4048b1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4058a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405c8c
mov byte [esp], al
cmp byte [esp], 0
jne 0x405a2c
test edi, edi
je 0x405a2c
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405963
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x40593e
cmp edi, 0xffffffff
je 0x4058ff
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4058ff
mov byte [esp], 0
jmp 0x405a2c
mov ebx, dword [esi]
cmp ebx, 1
jg 0x40593e
test ebx, ebx
jne 0x405934
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402784
test eax, eax
jne 0x405934
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405a2c
call 0x405db0
dec ebp
test ebp, ebp
jg 0x4058e4
cmp edi, 0xffffffff
je 0x405963
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405961
mov byte [esp], 0
jmp 0x405a2c
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4058ae
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x405963
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405a9c
mov edx, eax
mov ebx, dword [0x5478f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4059ca
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4059c8
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4059ca
xor edi, edi
cmp byte [esp], 0
je 0x4059f3
mov ebx, dword [esi]
test bl, 1
jne 0x405a0c
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x4059d0
mov byte [esp + 1], 1
jmp 0x405a0c
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x4059f3
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40597d
cmp byte [esp], 0
je 0x405a2c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4067ac
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x547058], 0
je 0x406813
cmp word [0x547340], 0xd7b2
jne 0x4067d5
cmp dword [0x547348], 0
jbe 0x4067d5
mov eax, 0x54733c
call dword [0x547358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x406840
call fcn.00407350
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x542032], 0
jne 0x40682f
push 0
push 0x5429c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4069d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x542034], 0
je 0x4069fb
mov edx, edi
mov eax, esi
call dword [0x542034]
mov ebx, eax
jmp 0x406a0c
mov eax, 8
call fcn.004044f4
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x547059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406998
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406a41
mov edx, 8
mov eax, ebx
call fcn.00404510
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x408edc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409041
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406b14
cmp si, word [0x542a00]
jb 0x408f74
cmp si, word [0x542c00]
ja 0x408f74
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408f74
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x542a00]
jae 0x408f4e
mov edi, ebx
dec edi
jmp 0x408f6f
cmp si, word [ebx*8 + 0x542a00]
jbe 0x408f5e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408f6f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x542a04]
call fcn.00408dec
jmp 0x408f74
cmp edi, dword [ebp - 8]
jae 0x408f38
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x409023
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409023
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004076c4
push dword [ebp - 0x160]
push 0x40905c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004076c4
push dword [ebp - 0x164]
push 0x40906c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004076c4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004078fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409048
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406b74
ret
Function at 0x4091f4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4092f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x549b80
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x549b98]
jne 0x409240
mov eax, esi
mov edx, 0x549b9a
mov ecx, 0x55
call fcn.004076c4
push 0x549b80
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4092e1
push 0x549b80
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406b14
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4092af
cmp byte [0x549b7c], 0
je 0x409274
mov edx, esi
mov eax, ebx
call fcn.004090d8
jmp 0x4092af
mov edx, esi
mov eax, ebx
call fcn.00408edc
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4092af
cmp dword [esi], 0
je 0x409298
mov eax, esi
mov edx, 0x409310
call fcn.0040781c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408edc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040781c
push 0x549b80
call sub.kernel32.dll_EnterCriticalSection
mov word [0x549b98], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407630
push eax
push 0x549b9a
call sub.kernel32.dll_lstrcpynW
push 0x549b80
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4092fe
lea eax, [ebp - 4]
call fcn.00406b14
ret
Function at 0x409a38
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406bf8
xor eax, eax
push ebp
push 0x409af8
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004076c4
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407874
mov eax, dword [ebx]
call fcn.00409900
test al, al
jne 0x409ad5
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004076c4
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407874
mov eax, dword [ebx]
call fcn.00409900
test al, al
jne 0x409ad5
mov eax, ebx
call fcn.00406b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409aff
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406b74
lea eax, [ebp - 4]
call fcn.00406b14
ret

Function at 0x40a4bc
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x41d978
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41d9d1
test eax, edx
je 0x41d9d4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41d98f
movzx eax, word [eax]
sub eax, ecx
jmp 0x41d9b6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41d9b7
add ecx, 4
js 0x41d9a7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41d9b4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41d9b6
xor eax, eax
ret
test eax, eax
je 0x41d9e0
test edx, edx
jne 0x41d980
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4228bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4228f5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406c9c
jmp 0x4228fe
mov eax, ebx
mov edx, esi
call fcn.00406ef4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422908
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x42292a
movzx eax, word [esp]
jmp 0x42292c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret