joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c7650
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100c7683
push esi
call fcn.100d5a00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x100c767c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x100c7709
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x100c76f2
mov eax, dword [esi + 8]
test eax, eax
je 0x100c76a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x100c76ee
cmp eax, 2
je 0x100c76f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100c769a
cmp eax, 3
je 0x100c76cd
cmp eax, 1
jne 0x100c769a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100c769a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100c769a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.100c7730
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x100c7718
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.100c7730
add esp, 4
pop esi
ret

Function at 0x100c7fa0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100c7fc1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x100c7fc1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x100c7fc1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100c8410
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x100c841b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x100c851e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x102cf440]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x102cf440]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x102cf440]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x102cf440]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x102cf440]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x102cf440]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x102cf440]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x102cf440]
xor eax, edx
inc ecx
dec edi
jne 0x100c8436
pop edi
test esi, esi
je 0x100c8540
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x102cf440]
xor eax, edx
inc ecx
dec esi
jne 0x100c8522
pop esi
pop ebx
not eax
ret
Function at 0x100e96a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d1ed8
push 0x100edca4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.100eba50
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e9850
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x100e9891
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x100e98fe
cmp dword [esp + 0x1c], 2
jne 0x100e98fe
cmp dword [esp + 0x10], 5
jne 0x100e98fe
cmp dword [esp + 0x14], 1
jne 0x100e98fe
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100e98e8
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100e98d9
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x100e98e1
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x100e98fe
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret

Function at 0x100fd828
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100fd860
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100fb8b2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100fb88a
jmp 0x100fd86c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100fef1b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100fef5d
call fcn.101049ee
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100fef5d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100fef54
xor eax, eax
jmp 0x100fef65
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100fef6b
pop edi
pop esi
pop ebx
ret 4
Function at 0x10015f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10015fe
ret
jmp 0x1001603
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..data]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x100306c]
test eax, eax
je 0x1001627
call eax
cmp dword [0x1003070], 0
je 0x100166e
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1003070]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010015f5
add ebp, 0x2a8
leave
ret
Function at 0x10018da
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1001908
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x100190f
cmp ebx, dword [eax + 4]
jae 0x100190f
xor eax, eax
jmp 0x1001aff
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x1001920
xor eax, eax
inc eax
jmp 0x1001afe
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1001936
cmp ecx, edx
jae 0x1001a7b
cmp dword [eax + 4], 0
je 0x100193f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x1001927
cmp dword [ebp + 8], 0
je 0x1001961
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x1001a7b
cmp eax, esi
jae 0x1001a7b
mov eax, dword [0x1003018]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x1001986
cmp dword [esi*4 + 0x1003020], edi
je 0x1001a7f
inc esi
cmp esi, eax
jl 0x1001974
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1001afb
cmp dword [ebp - 8], 0x1000000
jne 0x1001afb
test byte [ebp - 0xc], 0xcc
je 0x1001a04
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x1001afb
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1001afb
cmp word [eax + 0x18], 0x10b
jne 0x1001afb
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x1001afb
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x1001a04
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x1001a04
test byte [ecx + 0x27], 0x80
jne 0x1001a7b
push 1
push 0x1003060
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x1001918
mov ecx, dword [0x1003018]
test ecx, ecx
mov edx, ecx
jle 0x1001a38
lea eax, [ecx*4 + 0x100301c]
cmp dword [eax], edi
je 0x1001a38
dec edx
sub eax, 4
test edx, edx
jg 0x1001a2c
test edx, edx
jne 0x1001a69
push 0xf
pop ebx
cmp ecx, ebx
jg 0x1001a45
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x1001a5d
lea eax, [edx*4 + 0x1003020]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x1001a4b
cmp ecx, 0x10
jge 0x1001a69
inc ecx
mov dword [0x1003018], ecx
push 0
push 0x1003060
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x1001918
xor eax, eax
jmp 0x1001afe
test esi, esi
jle 0x1001918
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x1003060
call ebx
test eax, eax
jne 0x1001918
cmp dword [esi*4 + 0x1003020], edi
je 0x1001ad5
mov eax, dword [0x1003018]
lea esi, [eax - 1]
test esi, esi
jl 0x1001ac3
cmp dword [esi*4 + 0x1003020], edi
je 0x1001abf
dec esi
jns 0x1001ab3
test esi, esi
jge 0x1001ad3
cmp eax, 0x10
jge 0x1001ace
inc eax
mov dword [0x1003018], eax
lea esi, [eax - 1]
jmp 0x1001ad5
je 0x1001aed
xor ecx, ecx
test esi, esi
jl 0x1001aed
lea eax, [ecx*4 + 0x1003020]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x1001adb
push 0
push 0x1003060
call ebx
jmp 0x1001918
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403298
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404f5c
test esi, esi
jne 0x4032ce
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040504c
jmp 0x4032ec
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040319c
mov edi, eax
test esi, esi
je 0x4032ec
cmp dword [ebx], 0
je 0x4032ec
dec esi
jmp 0x4032d5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403874
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x40388a
sub ecx, 2
jne 0x4038ac
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x4038b3
cmp edx, dword [ebx + 8]
je 0x4038bd
mov eax, 0x64
jmp 0x4038b8
mov eax, 0x67
jmp 0x4038b8
call sub.kernel32.dll_GetLastError
call fcn.0040301c
pop ebx
ret

Function at 0x403ac4
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403af7
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x403afe
cmp edx, dword [ebx + 8]
je 0x403b08
mov eax, 0x65
jmp 0x403b03
mov eax, 5
jmp 0x403b03
call sub.kernel32.dll_GetLastError
call fcn.0040301c
mov eax, ebx
pop ebx
ret

Function at 0x403e74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403f0c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403eec
xor eax, eax
push ebp
push 0x403ee5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403f28
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403eec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x46b020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404d28
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46e048], 0
je 0x404d89
cmp word [0x46e21c], 0xd7b2
jne 0x404d51
cmp dword [0x46e224], 0
jbe 0x404d51
mov eax, 0x46e218
call dword [0x46e234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404db0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46b02c], 0
jne 0x404da5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x46b034], 0
je 0x404f06
mov edx, esi
mov eax, ebx
call dword [0x46b034]
jmp 0x404f15
mov eax, 8
call fcn.00402ea0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x46e049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404ea8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40631c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40654c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40639f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40654c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40639f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406568
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406428
xor eax, eax
push ebp
push 0x406421
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406158
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406406
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406588
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406406
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406428
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406542
cmp byte [ebp - 0xd], 0
jne 0x40646f
cmp byte [ebp - 0x12], 0
je 0x406542
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406488
dec ebx
cmp byte [ebx], 0x2e
je 0x406497
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406487
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406542
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4064d4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406542
cmp byte [ebp - 0xd], 0
je 0x406542
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406542
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408b8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408bde
test eax, edx
je 0x408be1
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408ba1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408bc7
add ecx, 4
js 0x408bb7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408bc4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408bed
test edx, edx
jne 0x408b94
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40c630
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c669
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040504c
jmp 0x40c672
mov eax, ebx
mov edx, esi
call fcn.00404fb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c67c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c69e
movzx eax, byte [esp]
jmp 0x40c6a0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cd30
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cba8
mov eax, dword [0x46d8ac]
cmp byte [eax], 0
je 0x40cdac
mov eax, dword [0x46d620]
call fcn.00403664
call fcn.00402ffc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409640
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cdf4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40cde2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46d5b8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4707f4]
call fcn.00406100
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d658
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d72e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404ff4
lea eax, [ebp - 4]
call fcn.00405444
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d718
mov eax, ebx
call fcn.00402ea0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d711
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004053ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d6fb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d740
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d6fb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d718
mov eax, dword [ebp - 0x10]
call fcn.00402ebc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d735
lea eax, [ebp - 4]
call fcn.00404f5c
ret

Function at 0x41baa4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041b7e0
dec esi
jne 0x41bac6
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x41cc38
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4729ec
cmp dword [edi], 0
jne 0x41ccb4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4729e8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46bb00
mov ecx, 2
call fcn.0040309c
mov edx, 0x41cc10
lea eax, [esi + 5]
call fcn.0041cc30
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041cc30
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41cc89
mov dword [0x4729e8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41f310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004053ec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41f368
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46da20]
mov dl, 1
mov eax, dword [0x41ee1c]
call fcn.0040cef0
call fcn.004048f0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041ef24
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4204f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4204fe
ret