joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000714f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10018ef8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10007195
cmp word [ebx], dx
jne 0x10007195
or byte [eax + edi + 0x28], 4
jmp 0x1000719a
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x100072fd
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100072dd
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100071db
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10007211
cmp eax, edx
jae 0x1000721f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100071b6
jmp 0x100072fd
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100072d8
cmp dword [ebp - 0x18], 0
je 0x100072d8
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10018ef8]
test byte [eax + edi + 0x28], 0x48
je 0x100072ae
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10007272
mov word [esi], cx
jmp 0x100072a9
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10018ef8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10018ef8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10018ef8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x100072fd
pop eax
cmp word [ebp - 4], ax
jne 0x100072be
cmp esi, ebx
jne 0x100072be
mov word [esi], ax
jmp 0x100072fa
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100068af
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100072fd
push 0xd
pop eax
jmp 0x100072b9
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10018ef8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x100072f7
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x100072fd
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10009e56
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10009ef3
push ebx
push esi
call fcn.10009e1f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10009db3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10009ea0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009ef2
push edi
push eax
call fcn.100088bf
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10009ec0
call fcn.10008157
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009ef1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10009db3
add esp, 0x20
test eax, eax
jne 0x10009edf
push edi
call fcn.10008157
jmp 0x10009ee7
push ebx
call fcn.10008157
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000a163
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012a30
push 0x10012a28
push str.FlsAlloc
push 0x1f
call fcn.1000a07f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a197
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011124]
call esi
jmp 0x1000a19d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000a1e1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012a40
push 0x10012a38
push str.FlsGetValue
push 0x21
call fcn.1000a07f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a218
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000a220
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012a48
push 0x10012a40
push str.FlsSetValue
push 0x22
call fcn.1000a07f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a25a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10011124]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000db11
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1000da8d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1000dc80
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1000dc80
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1000dc35
jg 0x1000db6d
test eax, eax
je 0x1000dc2b
push 1
push 0x1000
call fcn.10008959
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1000db90
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1000dc22
push 0x8000
push ebx
call fcn.1000d9be
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1000dbb9
jg 0x1000dbb4
cmp ecx, 0x1000
jb 0x1000dbb9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1000cb25
add esp, 0x10
cmp eax, 0xffffffff
je 0x1000dbfe
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1000dbb4
jl 0x1000dbe5
test ecx, ecx
jne 0x1000dba6
push dword [ebp - 0xc]
push ebx
call fcn.1000d9be
push esi
call fcn.10008157
add esp, 0xc
xor ebx, ebx
jmp 0x1000dc8e
cmp byte [edi + 0x24], 0
je 0x1000dc15
cmp dword [edi + 0x20], 5
jne 0x1000dc15
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1000dc20
mov ebx, dword [edi + 0x18]
jmp 0x1000dc22
xor ebx, ebx
push esi
call fcn.10008157
pop ecx
jmp 0x1000dc8e
test ecx, ecx
jg 0x1000dbf7
jl 0x1000dc35
test eax, eax
jae 0x1000dbf7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100068af
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1000dc55
cmp byte [edi + 0x1c], 0
je 0x1000dbf7
jmp 0x1000dc86
push ebx
call fcn.1000ae08
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1000dbf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1000dc8e
cmp byte [edi + 0x1c], 0
je 0x1000dc8b
mov ebx, dword [edi + 0x18]
jmp 0x1000dc8e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100068af
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000fd60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000fd8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000fd8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d85cf2a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d85cf2a
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d85cf2a
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d85cf2a
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d817e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x2d817f7f
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x2d817f7f
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x2d817e9f
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x2d817f8e
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x2d817ebc
mov dl, bl
xor edi, edi
jmp 0x2d817eec
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x2d817e8e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x2d817e91
mov edx, ebx
cmp ebx, 0x800
jae 0x2d817ed1
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x2d817eec
cmp ebx, 0x10000
jae 0x2d817ee3
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x2d817eeb
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x2d817f7f
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x2d817f23
cmp edi, 3
jae 0x2d817f2e
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x2d817f31
mov eax, dword [ebp - 8]
test eax, eax
je 0x2d817f56
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x2d817f38
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x2d817e49
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x2d817f87
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d85cf2a
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d85cf2a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d85cf2a
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d85cf2a
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d85cf2a
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d85cf2a
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920
Function at 0x2d85cf2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2d85cf39
pop dword [ebp - 0x48]
mov eax, 0x2d85cf39
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xb8156d7a
sub dword [ebp - 0x58], 0x69c3282f
mov dword [ebp - 0x54], 0xf1b205b1
sub dword [ebp - 0x54], 0xbf7eb96c
mov dword [ebp - 0x50], 0xf27841df
sub dword [ebp - 0x50], 0xa62bfdb1
mov dword [ebp - 0x4c], 0x9143501
sub dword [ebp - 0x4c], 0x9143501
lea eax, [ebp - 0x58]
push eax
mov eax, 0xacfedb3d
add eax, 0x8090d54b
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x8e27568b
sub dword [ebp - 0x58], 0x19b4ed35
mov dword [ebp - 0x54], 0x560f973a
sub dword [ebp - 0x54], 0x14a335c5
mov dword [ebp - 0x50], 0xf059c351
sub dword [ebp - 0x50], 0x8cea56e5
mov dword [ebp - 0x4c], 0x3e5c39a4
add dword [ebp - 0x4c], 0xc1a3c65c
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x6a66b
push 0
call eax
mov ecx, 0x750ee870
sub ecx, 0x750ea34f
mov edi, eax
mov ebx, 0xf6bca00c
sub ebx, 0xc921c00c
add ebx, dword [ebp - 0x48]
mov esi, 0x6b8471b8
add esi, 0x95fc618a
add dword [ebp - 0xc], 0x8b1bbfa0
mov edx, dword [ebx]
add edx, esi
sub dword [ebp - 0x2c], 0x3d671dd8
mov dword [edi], edx
xor dword [ebp - 0x18], 0xd7035078
add edi, 4
add ebx, 0x43e9980
add ebx, 0xfbc16684
loop 0x2d85d051
add eax, 0x10757
mov ebx, eax
add eax, 0x5074c306
add eax, 0xaf8b3cff
mov ecx, 0x2d800000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4090ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x48eb2c
push 0xa
push 0x409140
mov eax, dword [0x48eb1c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x4090d0
call fcn.00410e40
push ebx
mov eax, dword [0x48eb1c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4090e7
call fcn.00410e40
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4090f9
call fcn.00410e40
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x48eb30], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x48eb34], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x48eb38], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x48eb3c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x48eb40], ecx
add edx, dword [eax + 0x14]
mov dword [0x48eb44], edx
pop esi
pop ebx
ret

Function at 0x40a770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40a819
test eax, edx
je 0x40a81c
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40a799
push edx
mov edx, eax
mov eax, esp
call fcn.00405814
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40a7af
push eax
lea eax, [esp + 8]
call fcn.00405814
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40a7be
movzx eax, word [eax]
sub eax, ecx
jmp 0x40a7e5
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40a7ff
add ecx, 4
js 0x40a7d6
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40a7fc
push eax
mov eax, ecx
mov edx, 2
call fcn.00404e00
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40a7e3
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40a7e5
xor eax, eax
ret
test eax, eax
je 0x40a82c
test edx, edx
jne 0x40a780
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40e8bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e8f5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040577c
jmp 0x40e8fe
mov eax, ebx
mov edx, esi
call fcn.00405640
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e908
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e92a
movzx eax, word [esp]
jmp 0x40e92c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40f090
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffff004
push eax
add esp, 0xffffff7c
push 0x800
lea ecx, [esp + 0x88]
call fcn.0040eec8
mov eax, dword [0x48af14]
cmp byte [eax], 0
je 0x40f122
mov eax, dword [0x48acdc]
call fcn.004033d0
call fcn.00403114
lea eax, [esp + 0x884]
push eax
lea eax, [esp + 0x88]
push eax
call sub.user32.dll_CharToOemW
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x88c]
call fcn.0040b6dc
push eax
lea eax, [esp + 0x890]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40f170
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40f15b
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x48ac78]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48eb1c]
call fcn.00406ac0
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x8c]
push eax
push 0
call sub.user32.dll_MessageBoxW
add esp, 0x1084
ret

Function at 0x40fd38
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40fe0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405694
lea eax, [ebp - 4]
call fcn.00405f10
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004056cc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x40fdf8
mov eax, ebx
call fcn.00402fac
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40fdf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004056cc
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x40fddb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40fe20
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x40fddb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fdf8
mov eax, dword [ebp - 0x10]
call fcn.00402fc8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fe15
lea eax, [ebp - 4]
call fcn.00405630
ret
Function at 0x410c6f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004050bc
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x410c92
mov eax, edi
add eax, eax
call fcn.00402fac
mov esi, eax
jmp 0x410c94
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x410ccd
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x410cb7
mov eax, esp
cmp esi, eax
je 0x410cda
mov eax, esi
call fcn.00402fc8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x410d14
cmp bl, 0
je 0x410d10
cmp bl, 0x41
jl 0x410d0b
cmp bl, 0x5a
jg 0x410d0b
or bl, 0x20
xor al, bl
inc esi
jmp 0x410cef
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x410c54

Function at 0x42902c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00428d30
dec esi
jne 0x42904e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x42a1f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x490e60
cmp dword [edi], 0
jne 0x42a274
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x490e5c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x489d24
mov ecx, 2
call fcn.00403164
mov edx, 0x42a1d0
lea eax, [esi + 5]
call fcn.0042a1f0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042a1f0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42a249
mov dword [0x490e5c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8