joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45180d
Capabilities:
Check if file exists
Create thread
Delete file
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push 0x51cdac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
cmp dword [0x51cfe0], ebx
je 0x45195a
cmp word [0x51cdd8], bx
je 0x45195a
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, 0x51cdd8
push esi
lea eax, [ebp - 0x210]
push eax
call edi
push 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push esi
call fcn.004292c0
test eax, eax
je 0x4518d5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4518d5
push 0x2e
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, eax
test ebx, ebx
je 0x4518d3
xor eax, eax
mov word [ebx], ax
push esi
lea eax, [ebp - 0x620]
push eax
call edi
add ebx, 2
push ebx
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x620]
push eax
push str._s__u._s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor ebx, ebx
cmp dword [0x51cfe0], ebx
je 0x451925
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4518ee
call fcn.004516c5
cmp dword [0x51cfe8], ebx
je 0x451925
mov al, byte [0x51cdd8]
push ebx
mov esi, str..X:
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
push ebx
push 3
movsw word es:[edi], word [esi]
push ebx
push 3
movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], al
push 0xc0000000
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4a9038], eax
pop edi
pop esi
cmp dword [0x51cd98], ebx
jne 0x45195a
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51cd98], eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x4515f3
push ebx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x51cd94], eax
mov dword [0x51cfec], 1
pop ebx
leave
ret

Function at 0x453395
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push 0x5c
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
jne 0x4533b5
mov esi, dword [ebp + 8]
push str.api_ms_win_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, esi
jne 0x4533ca
xor eax, eax
inc eax
jmp 0x453413
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x453411
test esi, esi
je 0x453411
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push 0x456374
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call fcn.004292c0
test eax, eax
jne 0x4533c5
xor eax, eax
pop esi
leave
ret 4
Function at 0x453418
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x6a8
push esi
push edi
mov esi, str.psapi.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x45346a
push esi
call fcn.0042a347
mov edi, eax
test edi, edi
jne 0x45346a
cmp dword [0x510080], 0x500
jbe 0x453463
push 0x10
push dword [0x4a7ad4]
push str.Error:_psapi.dll_not_loaded
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x45360d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExW
push edi
mov ebx, eax
call esi
xor esi, esi
mov dword [ebp + 0x68], eax
cmp ebx, esi
je 0x4535f8
cmp eax, esi
je 0x4535f8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 0x74], eax
cmp eax, esi
je 0x45360a
push 0x18c
xor edi, edi
lea eax, [ebp - 0x42c]
push esi
inc edi
push eax
mov dword [ebp + 0x6c], edi
mov dword [ebp - 0x430], esi
call fcn.0044b15e
add esp, 0xc
push 0x40
lea eax, [ebp - 0x2a0]
push eax
mov dword [ebp + 0x70], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x40
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x70]
push eax
push 0x190
lea eax, [ebp - 0x430]
push eax
push dword [ebp + 0x74]
call ebx
test eax, eax
je 0x4535ea
mov esi, dword [ebp + 0x70]
shr esi, 2
cmp esi, edi
jle 0x4535ea
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + edi*4 - 0x430]
push dword [ebp + 0x74]
call dword [ebp + 0x68]
test eax, eax
je 0x45357c
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x220]
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x45357c
lea eax, [ebp - 0x18]
push eax
mov eax, ecx
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x45357c
mov eax, ecx
push eax
call fcn.00453395
test eax, eax
jne 0x453583
inc edi
cmp edi, esi
jl 0x453526
jmp 0x4535ea
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4535aa
test al, 6
je 0x4535aa
and eax, 0xfffffff9
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x630]
push str.ERROR:_System_DLL_was_not_loaded_from__S:_r_n_r_n_S_r_n_r_nProbably_it_is_Malware_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push dword [0x4a7ad4]
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
and dword [ebp + 0x6c], 0
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x6c]
jmp 0x45360c
push esi
push 0x486704
push 0x486700
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x4537a7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov ebx, 0x510220
push ebx
lea eax, [ebp - 0x664]
push str.__s.dll
push eax
call esi
and dword [ebp - 0x254], 0
push 0x24c
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.0044b15e
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x45383b
push ebx
lea eax, [ebp - 0x664]
push str._s.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x45383b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
test byte [ebp - 0x254], 0x10
jne 0x453885
lea eax, [ebp - 0x228]
push eax
call fcn.00453395
test eax, eax
je 0x453864
lea eax, [ebp - 0x228]
push eax
call fcn.00453614
test eax, eax
je 0x45389d
cmp word [ebp - 0x20], 0
je 0x453885
lea eax, [ebp - 0x20]
push eax
call fcn.00453395
test eax, eax
je 0x453885
lea eax, [ebp - 0x20]
push eax
call fcn.00453614
test eax, eax
je 0x4538be
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45383b
xor esi, esi
jmp 0x4538ce
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x453834
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x453834

Function at 0x4538de
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0x810
cmp dword [0x510690], eax
je 0x4538f4
inc eax
leave
ret
push esi
push edi
mov edi, 0x206
push edi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push 0
push eax
call fcn.0044b15e
add esp, 0xc
push 0x50fc70
mov esi, 0x510220
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4539cc
lea eax, [ebp - 0x410]
push eax
call fcn.004537a7
test eax, eax
je 0x4539cc
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push str.Suspicious_System_DLL___S__found_in_UsbTreeViews_folder____abort_for_safety
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
push edi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.0044b15e
add esp, 0x18
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, esi
jne 0x4539af
push str._n_nHint:_Starting_applications_from_TEMP_folder_is_risky.
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10
push 0x45aca0
lea eax, [ebp - 0x810]
push eax
push dword [0x51069c]
call fcn.00452b3b
xor eax, eax
jmp 0x4539cf
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x4c6d25
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d1398
cmp edx, dword [eax]
je 0x4c6d47
add eax, 8
inc ecx
cmp eax, 0x4d1428
jl 0x4c6d38
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d1398]
jne 0x4c6e75
mov eax, dword [0x4d6dc0]
cmp eax, 1
je 0x4c6e4f
test eax, eax
jne 0x4c6d78
cmp dword [0x4d12c4], 1
je 0x4c6e4f
cmp edx, 0xfc
je 0x4c6e75
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6daf
lea eax, [ebp - 0x1a4]
push 0x4ccd48
push eax
call fcn.004c7710
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7ba0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6df2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7ba0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ccd44
push edi
call fcn.004c9a70
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4ccd28
push eax
call fcn.004c7710
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7720
lea eax, [ebp - 0xa0]
push 0x4ccd24
push eax
call fcn.004c7720
push dword [esi + 0x4d139c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7720
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cccfc
push eax
call fcn.004c99e4
add esp, 0x2c
pop edi
jmp 0x4c6e75
lea eax, [ebp + 8]
lea esi, [esi + 0x4d139c]
push 0
push eax
push dword [esi]
call fcn.004c7ba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401029
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401a4f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 7
push esi
push str..PhysicalDrive0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x401b45
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea esi, [ebp - 0x41c]
mov dword [ebp - 4], 0x400
mov ebx, dword [ebp - 4]
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push ebx
push esi
lea eax, [ebp - 0x1c]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
je 0x401af3
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], esi
cmp eax, ebx
jbe 0x401ad4
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
jmp 0x401af3
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x401af3
lea edi, [eax + esi]
push edi
call fcn.00402cd0
push eax
push edi
push dword [ebp + 8]
call fcn.004018cc
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x41c]
cmp esi, eax
je 0x401b04
push esi
call fcn.00402cb6
pop ecx
cmp dword [ebp - 8], edi
jne 0x401b3a
cmp dword [ebp - 0xc], edi
jne 0x401b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401b3a
cmp dword [ebp - 4], ebx
ja 0x401b27
or bx, 0xfff
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.00402ca8
mov esi, eax
pop ecx
cmp esi, edi
jne 0x401a98
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x401f27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00402c50
lea eax, [ebp - 0x10]
push eax
call fcn.00401a1d
add esp, 0x10
xor eax, eax
movzx ecx, byte [ebp + eax - 0x10]
lea esi, [ecx + esi*2]
xor esi, dword [ebp - 0x10]
inc eax
cmp eax, 0x10
jb 0x401f4a
mov eax, esi
pop esi
leave
ret
Function at 0x401f64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0xa
push eax
push dword [0x409d7c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401f9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push dword [0x409d7c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
ja 0x401fa6
xor eax, eax
jmp 0x402096
push edi
push dword [0x409d7c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x40
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push esi
push ebx
push edi
mov dword [ebp - 8], edi
call fcn.00402910
sub esi, 0x20
push 0x20
mov dword [ebp - 0xc], esi
lea eax, [edi + esi]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00402910
add esp, 0x18
xor eax, eax
xor ebx, ebx
movzx ecx, byte [ebp + eax - 0x2c]
add ebx, ecx
inc eax
cmp eax, 0x20
jb 0x401fee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, eax
jne 0x402032
test ebx, ebx
je 0x402053
xor edx, edx
xor ecx, ecx
test esi, esi
jbe 0x402053
mov al, dl
and al, 0x23
xor al, byte [edx + edi]
or al, byte [ebp + ecx - 0x2c]
inc ecx
cmp ecx, 0x10
mov byte [edx + edi], al
jne 0x402027
xor ecx, ecx
inc edx
cmp edx, esi
jb 0x402011
test ecx, ecx
jne 0x402009
jmp 0x402053
xor edx, edx
xor ecx, ecx
test esi, esi
jbe 0x402053
mov al, byte [ebp + ecx - 0x2c]
xor al, byte [edx + edi]
xor al, dl
inc ecx
cmp ecx, 0x10
mov byte [edx + edi], al
jne 0x40204e
xor ecx, ecx
inc edx
cmp edx, esi
jb 0x40203a
mov edi, dword [edi]
mov dword [ebp + 8], edi
add edi, 0x100
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 4
push eax
mov eax, dword [ebp - 8]
add eax, 4
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401c26
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4024d3
Capabilities:
Copy file
Create directory
Create service
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x40711c
jmp 0x40258e
lea esp, [esp + 4]
cmovp eax, esi
mov edi, 0x104
shrd ax, si, 0xc0
bsr eax, esi
xor ebx, ebx
mov ah, 4
push edi
jmp loc.0040b55f

Function at 0x40268b
Capabilities:
Accept command line arguments
Create thread
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push 0x40719c
jmp loc.0040b0dc
Function at 0x4026b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402748
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402728
xor eax, eax
push ebp
push 0x402721
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402764
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402728
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402d90
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x405034], 0
je 0x402df1
cmp word [0x405208], 0xd7b2
jne 0x402db9
cmp dword [0x405210], 0
jbe 0x402db9
mov eax, 0x405204
call dword [0x405220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x404054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402e18
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x404018], 0
jne 0x402e0d
push 0
push 0x40404c
push 0x404054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403088
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4030ee
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00402f8c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004025a4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4030d8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030f5
lea eax, [ebp - 0x10]
call fcn.00402f0c
ret
Function at 0x4095c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13ac
call fcn.0045da20
mov eax, dword [0x4e71c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x13a4], ebx
call fcn.00458e19
mov edi, eax
mov esi, edx
mov dword [ebp - 0x139c], edi
mov dword [ebp - 0x13ac], esi
call fcn.00458e02
mov dword [ebp - 0x1398], eax
mov ecx, edx
mov dword [ebp - 0x13a8], ecx
cmp edi, 0x989680
jne 0x409629
test esi, esi
jne 0x409629
push esi
push 0x64
push ecx
push eax
call fcn.0045d440
mov ecx, eax
mov edi, eax
jmp 0x4096ca
cmp edi, 0x16e3600
jne 0x409674
test esi, esi
jne 0x409674
push esi
push edi
push ecx
push eax
call fcn.004b2d50
push esi
push 0x16e3600
mov edi, edx
mov ebx, eax
push edi
push ebx
call fcn.0045d440
mov ecx, dword [ebp - 0x1398]
sub ecx, eax
mov eax, dword [ebp - 0x13a8]
push esi
push 0x3b9aca00
sbb eax, edx
push eax
push ecx
call fcn.0045d440
push esi
push 0x16e3600
jmp 0x40969f
push ebx
push esi
push edi
push ecx
push eax
call fcn.004b3440
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov ebx, eax
mov edi, edx
call fcn.0045d440
push dword [ebp - 0x13ac]
push dword [ebp - 0x139c]
push edx
push eax
call fcn.004b2d50
push 0
push 0x3b9aca00
push edi
push ebx
mov dword [ebp - 0x1398], eax
call fcn.0045d440
mov ecx, dword [ebp - 0x1398]
mov ebx, dword [ebp - 0x13a4]
add ecx, eax
mov edi, ecx
mov dword [ebp - 0x138c], ecx
mov ecx, 1
mov dword [ebp - 0xc], 0xffffffff
nop dword [eax]
mov eax, edi
shr eax, 0x1e
xor eax, edi
imul edi, eax, 0x6c078965
add edi, ecx
mov dword [ebp + ecx*4 - 0x138c], edi
inc ecx
cmp ecx, 0x270
jb 0x4096e0
mov dword [ebp - 0x1390], 0x270
mov esi, 0xc
mov edi, 0xff
lea ecx, [ebp - 0x1390]
call fcn.0041be80
mul edi
cmp eax, 0xff
jae 0x409742
cmp eax, 1
jae 0x409742
nop dword [eax]
lea ecx, [ebp - 0x1390]
call fcn.0041be80
mul edi
cmp eax, 1
jb 0x409730
mov eax, dword [ebx + 4]
inc dl
mov byte [ebp - 0x1391], dl
cmp eax, dword [ebx + 8]
je 0x409759
mov byte [eax], dl
inc dword [ebx + 4]
jmp 0x409768
lea ecx, [ebp - 0x1391]
push ecx
push eax
mov ecx, ebx
call fcn.004161c0
sub esi, 1
jne 0x409713
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045c4df
mov esp, ebp
pop ebp
ret
Function at 0x40c430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x40c462
jl 0x40c455
test ecx, ecx
jne 0x40c462
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40c53f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x40c492
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x40c494
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x40c4e8
jg 0x40c4a5
test esi, esi
je 0x40c4e8
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x40c4b9
jl 0x40c4b3
cmp ecx, esi
jae 0x40c4b9
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00479d20
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x40c50c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x40c528
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x40c477
jl 0x40c528
test ecx, ecx
jne 0x40c477
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x40c583
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x40c583
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00479d20
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x40c5ec
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40c5a9
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x40c5d7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0048fb71
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40c5ec
cmp edi, eax
ja 0x40c5b5
test edi, edi
je 0x40c5ec
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0048fb71
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc