joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d8fd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x434b20]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d943
cmp word [ebx], dx
jne 0x41d943
or byte [eax + edi + 0x28], 4
jmp 0x41d948
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41daab
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41da8b
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41d989
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d9bf
cmp eax, edx
jae 0x41d9cd
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41d964
jmp 0x41daab
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41da86
cmp dword [ebp - 0x18], 0
je 0x41da86
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x434b20]
test byte [eax + edi + 0x28], 0x48
je 0x41da5c
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41da20
mov word [esi], cx
jmp 0x41da57
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x434b20]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x434b20]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x434b20]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41daab
pop eax
cmp word [ebp - 4], ax
jne 0x41da6c
cmp esi, ebx
jne 0x41da6c
mov word [esi], ax
jmp 0x41daa8
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041e1ff
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41daab
push 0xd
pop eax
jmp 0x41da67
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x434b20]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41daa5
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41daab
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41eb0a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c550
push 0x42c548
push str.FlsAlloc
push 0x1f
call fcn.0041e9a6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41eb3e
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281d0]
call esi
jmp 0x41eb44
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41eb88
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c560
push 0x42c558
push str.FlsGetValue
push 0x21
call fcn.0041e9a6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ebbf
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41ebc7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c568
push 0x42c560
push str.FlsSetValue
push 0x22
call fcn.0041e9a6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ec01
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4281d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41fea0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ff3d
push ebx
push esi
call fcn.0041fe69
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e7ed
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41feea
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ff3c
push edi
push eax
call fcn.0041aba0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41ff0a
call fcn.0041ab66
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ff3b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e7ed
add esp, 0x20
test eax, eax
jne 0x41ff29
push edi
call fcn.0041ab66
jmp 0x41ff31
push ebx
call fcn.0041ab66
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x424d65
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00424ce1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x424ed4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x424ed4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x424e89
jg 0x424dc1
test eax, eax
je 0x424e7f
push 1
push 0x1000
call fcn.0041eec2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x424de4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x424e76
push 0x8000
push ebx
call fcn.004185d8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x424e0d
jg 0x424e08
cmp ecx, 0x1000
jb 0x424e0d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041d594
add esp, 0x10
cmp eax, 0xffffffff
je 0x424e52
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x424e08
jl 0x424e39
test ecx, ecx
jne 0x424dfa
push dword [ebp - 0xc]
push ebx
call fcn.004185d8
push esi
call fcn.0041ab66
add esp, 0xc
xor ebx, ebx
jmp 0x424ee2
cmp byte [edi + 0x24], 0
je 0x424e69
cmp dword [edi + 0x20], 5
jne 0x424e69
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x424e74
mov ebx, dword [edi + 0x18]
jmp 0x424e76
xor ebx, ebx
push esi
call fcn.0041ab66
pop ecx
jmp 0x424ee2
test ecx, ecx
jg 0x424e4b
jl 0x424e89
test eax, eax
jae 0x424e4b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041e1ff
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x424ea9
cmp byte [edi + 0x1c], 0
je 0x424e4b
jmp 0x424eda
push ebx
call fcn.00420331
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x424e4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x424ee2
cmp byte [edi + 0x1c], 0
je 0x424edf
mov ebx, dword [edi + 0x18]
jmp 0x424ee2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041e1ff
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40645d
pop dword [ebp - 0x18]
mov eax, 0xc6a26eae
add eax, 0x399df5af
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb332dd57
add dword [ebp - 0x28], 0x9b1f67f4
mov dword [ebp - 0x24], 0x5542c716
add dword [ebp - 0x24], 0xdcf0852f
mov dword [ebp - 0x20], 0x73fbf7c3
add dword [ebp - 0x20], 0xd8504c6b
mov dword [ebp - 0x1c], 0x64329e3f
sub dword [ebp - 0x1c], 0x64329e3f
lea eax, [ebp - 0x28]
push eax
mov eax, 0x76b24a19
add eax, 0x898e365f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x9e4f06d6
sub dword [ebp - 0x28], 0x29dc9d80
mov dword [ebp - 0x24], 0xfeceabee
add dword [ebp - 0x24], 0x429db587
mov dword [ebp - 0x20], 0x13d2b4e0
add dword [ebp - 0x20], 0x4f9cb78c
mov dword [ebp - 0x1c], 0xce8aeba7
sub dword [ebp - 0x1c], 0xce8aeba7
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x356f7
push 0
call eax
mov ecx, 0x812dab93
sub ecx, 0x812d6a0b
xor edx, edx
add edx, eax
mov ebx, 0x451400
add ebx, dword [ebp - 0x18]
mov edi, 0xc18e9af8
mov esi, dword [ebx]
xor esi, edi
xor dword [ebp - 8], ebx
mov dword [edx], esi
sub dword [ebp - 4], edi
add edx, 4
add ebx, 0x71f3ec4c
sub ebx, 0x71f3ec48
loop 0x406570
add eax, 0x6ba565e
add eax, 0xf946a295
mov ebx, eax
add eax, 0x7f11dbaa
add eax, 0x80ee245b
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x3484eeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3484ef09
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DW0200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3484ef09
mov al, 1
jmp 0x3484ef0b
xor al, al
leave
ret 8

Function at 0x3484ef60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x3484ef6f
pop dword [ebp - 0x14]
mov eax, 0x3484ef6f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xda875705
sub dword [ebp - 0x24], 0x8c3511ba
mov dword [ebp - 0x20], 0xf6263c00
add dword [ebp - 0x20], 0x3c0d1045
mov dword [ebp - 0x1c], 0x2b372246
add dword [ebp - 0x1c], 0x211521e8
mov dword [ebp - 0x18], 0x2d763fbb
add dword [ebp - 0x18], 0xd289c045
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xbf60c712
add dword [ebp - 0x24], 0xb511a244
mov dword [ebp - 0x20], 0xd4d3f3d6
sub dword [ebp - 0x20], 0x93679261
mov dword [ebp - 0x1c], 0x5f880eea
sub dword [ebp - 0x1c], 0xfc18a27e
mov dword [ebp - 0x18], 0xdd673a87
sub dword [ebp - 0x18], 0xdd673a87
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xe5813c3f
add eax, 0x4f03e4e9
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39a52
push 0
call eax
mov ecx, 0xf1574ff
add ecx, 0xf0eade99
xor edi, edi
add edi, eax
mov esi, 0x636587ff
add esi, 0xd1214801
add esi, dword [ebp - 0x14]
mov ebx, 0x9ceb15c9
add ebx, 0xfab14923
add dword [ebp - 4], edx
mov edx, dword [esi]
add dword [ebp - 8], edx
add edx, ebx
xor dword [ebp - 0x10], eax
mov dword [edi], edx
mov dword [ebp - 0x10], 0xd1922cab
add edi, 0x640a5e60
sub edi, 0x640a5e5c
add esi, 4
loop 0x3484f089
add eax, 0x457707d8
sub eax, 0x4575c6a5
mov ebx, eax
add eax, 5
mov ecx, 0x34810000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x405d34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405d9a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402fa8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405d84
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405da1
lea eax, [ebp - 0x10]
call fcn.00404274
ret

Function at 0x4078ac
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404734
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x4078ce
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40a0f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a129
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404364
jmp 0x40a132
mov eax, ebx
mov edx, esi
call fcn.004042c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a13c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a15d
mov al, byte [esp]
jmp 0x40a15f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a7f4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a65c
mov eax, dword [0x41b5e0]
cmp byte [eax], 0
je 0x40a870
mov eax, dword [0x41b4e4]
call fcn.00402e98
call fcn.00402b08
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407a30
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a8b8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a8a6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41b4c0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41c660]
call fcn.004051dc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b5b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b61c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004075a4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b623
lea eax, [ebp - 0xc]
call fcn.00404274
ret

Function at 0x417530
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push edi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, 0
mov edi, dword [0x41d908]
shl edi, 2
xor edx, dword [esi + 0x41c880]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x41c908]
mov bl, dl
add ecx, dword [ebx*4 + 0x41cd08]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x41d108]
mov bl, dl
add ecx, dword [ebx*4 + 0x41d508]
xor eax, ecx
xchg edx, eax
add esi, 4
cmp esi, edi
jne 0x41754d
xchg edx, eax
xor eax, dword [esi + 0x41c880]
xor edx, dword [esi + 0x41c884]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x4175a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, dword [0x41d908]
inc esi
shl esi, 2
xor edx, dword [esi + 0x41c880]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x41c908]
mov bl, dl
add ecx, dword [ebx*4 + 0x41cd08]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x41d108]
mov bl, dl
add ecx, dword [ebx*4 + 0x41d508]
xor eax, ecx
xchg edx, eax
sub esi, 4
cmp esi, 4
jne 0x4175c0
xchg edx, eax
xor eax, dword [0x41c884]
xor edx, dword [0x41c880]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop esi
pop ecx
pop ebx
ret
Function at 0x4178a0
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov dword [0x41d908], 0x10
mov esi, 0x41a3cc
mov edi, 0x41c880
mov ecx, 0x422
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x418a48
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x418a8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004189ac
mov eax, dword [ebp - 4]
call fcn.00404734
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418a95
lea eax, [ebp - 4]
call fcn.00404274
ret

Function at 0x418b00
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407b44
add esp, 0x104
pop ebx
ret

Function at 0x418db4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x101
call fcn.004044e4
add esp, 0x104
pop ebx
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x3e6c7be1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x31bb0fd3
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403894
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x495020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40392c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40390c
xor eax, eax
push ebp
push 0x403905
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403964
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40390c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x495020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x495020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404a14
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x497050], 0
je 0x404a75
cmp word [0x49732c], 0xd7b2
jne 0x404a3d
cmp dword [0x497334], 0
jbe 0x404a3d
mov eax, 0x497328
call dword [0x497344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404aa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49502c], 0
jne 0x404a91
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404bf4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x495030], 0
je 0x404c1a
mov edx, esi
mov eax, ebx
call dword [0x495030]
jmp 0x404c29
mov eax, 8
call fcn.00402f9c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x497051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404bbc
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4071c0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x408988
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x499b2c
push 0xa
push 0x408a1c
mov eax, dword [0x499b1c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x4089ac
call fcn.004103dc
push ebx
mov eax, dword [0x499b1c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4089c3
call fcn.004103dc
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4089d5
call fcn.004103dc
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x499b30], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x499b34], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x499b38], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x499b3c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x499b40], ecx
add edx, dword [eax + 0x14]
mov dword [0x499b44], edx
pop esi
pop ebx
ret

Function at 0x40a03c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40a0e5
test eax, edx
je 0x40a0e8
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40a065
push edx
mov edx, eax
mov eax, esp
call fcn.004055d4
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40a07b
push eax
lea eax, [esp + 8]
call fcn.004055d4
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40a08a
movzx eax, word [eax]
sub eax, ecx
jmp 0x40a0b1
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40a0cb
add ecx, 4
js 0x40a0a2
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40a0c8
push eax
mov eax, ecx
mov edx, 2
call fcn.00404c94
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40a0af
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40a0b1
xor eax, eax
ret
test eax, eax
je 0x40a0f8
test edx, edx
jne 0x40a04c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40e000
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e039
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040553c
jmp 0x40e042
mov eax, ebx
mov edx, esi
call fcn.00405400
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4