joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fad40
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x555958
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4fad5f
mov esi, 1
mov edx, 0x555a60
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4fadd8
dec ebx
je 0x4fadfa
dec ebx
je 0x4fae1c
dec ebx
je 0x4fae3d
jmp 0x4fae57
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4fae57
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4fae57
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4fae57
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4fadc8
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4fad7b
mov esi, 0x20
mov eax, 0x555988
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4fae7c
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4faeb8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x555a0f]
test bl, bl
jbe 0x4faee9
lea eax, [esi + 0x3e0]
call fcn.004fae94
lea eax, [esi + 0x3fc]
call fcn.004fae94
dec bl
jne 0x4faecf
mov cl, 0x30
mov edi, 0x5559e0
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x4faf0a
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4faf17
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4faef3
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4faf24
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004facd8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4faf40
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004facd8
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004facd8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4faf5c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004faeb8
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4faf86
mov bl, 1
mov eax, 0x5558d8
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4fafbf
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4fafcc
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4fafab
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4faff6
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004fad40
jmp 0x4fb01d
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004fad40
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4fb025
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4fafde
mov bl, 0x40
mov esi, 0x555918
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x4fb08b
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4fb098
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4fb074
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004fad00
inc ebx
inc esi
cmp bl, 0x41
jne 0x4fb0a6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fbc04
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4fbcb5
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x4fbcb0
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.004061e0
push 1
mov eax, edi
call fcn.004060b8
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004faf24
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5002a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x5002c1
inc edi
mov eax, esi
call fcn.00405d18
cmp edi, eax
jg 0x5002d3
cmp byte [esi + edi - 1], 0x20
je 0x5002c0
mov eax, esi
test eax, eax
je 0x5002de
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x5003a0
cmp byte [esi + edi - 1], 0x2e
je 0x5003c4
jmp 0x5003a0
cmp byte [esi + edi - 1], 0x2e
jne 0x500348
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x5003c4
cmp dword [esp + 8], 0xff
jg 0x5003c4
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x50032c
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x500334
mov bl, 1
jmp 0x500342
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x5003c4
jmp 0x50039f
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x50036d
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x50039f
inc edi
mov eax, esi
call fcn.00405d18
cmp edi, eax
jg 0x50037f
cmp byte [esi + edi - 1], 0x20
je 0x50036c
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x500397
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x5003c4
jmp 0x5003af
inc edi
mov eax, esi
call fcn.00405d18
cmp edi, eax
jle 0x5002f6
cmp dword [esp + 4], 3
jne 0x5003c4
cmp dword [esp + 8], 0xff
jg 0x5003c4
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51c1f8
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00406278
cmp byte [ebp - 1], 0
jne 0x51c258
mov eax, esi
call fcn.004060b8
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x51c272
sub al, 2
jb 0x51c279
jmp 0x51c27e
mov ebx, 2
jmp 0x51c27e
mov ebx, 1
mov eax, esi
call fcn.004060b8
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x51c362
test edi, edi
jle 0x51c2da
mov eax, esi
call fcn.004060b8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004060b8
mov byte [eax + ebx - 1], 0
jmp 0x51c356
test edi, edi
jge 0x51c320
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004060b8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x51c356
mov eax, esi
call fcn.004060b8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.004060b8
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x51c296
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x51c373
sub al, 2
jb 0x51c3ad
jmp 0x51c3f5
cmp edi, 2
jne 0x51c379
dec ebx
mov eax, ebx
sub eax, 2
jl 0x51c3f5
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004060b8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x555c6c]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x51c389
jmp 0x51c3f5
cmp edi, 2
jne 0x51c3b3
dec ebx
test ebx, ebx
jle 0x51c3f0
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004060b8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x555c70]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x51c3bf
jmp 0x51c3f0
inc ebx
mov eax, esi
call fcn.004060b8
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x51c3e3
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.004061e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53ff00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 4], edx
mov edx, 0x40
call fcn.0046fbe4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x53ff64
xor edx, edx
push ebp
push 0x53ff5d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, 0xffffffff
jne 0x53ff43
call fcn.00405280
jmp 0x53ff64
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ff64
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x540044
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54017c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x18
call fcn.004039d0
lea eax, [ebp - 0x40]
push eax
call sub.winhttp.dll_WinHttpGetIEProxyConfigForCurrentUser
test eax, eax
je 0x5400d3
cmp dword [ebp - 0x40], 0
je 0x54009f
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 3
mov bl, 1
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x5400b5
cmp word [esi], 0
je 0x5400b5
or dword [ebp - 0x30], 2
mov dword [ebp - 0x28], esi
mov bl, 1
test bl, bl
jne 0x5400e3
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x38]
call fcn.00406884
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0053ff70
jmp 0x5400e3
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 3
mov bl, 1
test bl, bl
je 0x540161
push 0
push 0
push 0
push 0
push 0
call sub.winhttp.dll_WinHttpOpen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x540161
xor eax, eax
push ebp
push 0x54015a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.winhttp.dll_WinHttpGetProxyForUrl
test eax, eax
je 0x540143
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x14]
call fcn.00406884
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0053ff70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540161
mov eax, dword [ebp - 0xc]
push eax
call sub.winhttp.dll_WinHttpCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540183
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004066d0
ret
Function at 0x548388
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x545af8
call fcn.00408efc
xor eax, eax
push ebp
push 0x548448
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x548460
call fcn.00478200
test al, al
je 0x5483cf
mov ecx, 0x548488
mov dl, 1
mov eax, dword [0x46d2f0]
call fcn.00475dbc
call fcn.0040518c
lea eax, [ebp - 0x14]
call fcn.004df4d4
cmp dword [ebp - 0x14], 0
je 0x548432
xor edx, edx
mov eax, 0x5484b4
call fcn.004d2cd4
mov eax, dword [0x5571e8]
mov eax, dword [eax]
call fcn.004ae7ac
mov eax, dword [0x5571e8]
mov eax, dword [eax]
xor edx, edx
call fcn.004b0304
mov eax, dword [0x5571e8]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov ecx, dword [0x557048]
mov eax, dword [0x5571e8]
mov eax, dword [eax]
mov edx, dword [0x5435b8]
call fcn.004ae7c4
mov eax, dword [0x5571e8]
mov eax, dword [eax]
call fcn.004ae914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54844f
lea eax, [ebp - 0x14]
call fcn.004066c8
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x811004]
jne 0x401010
repz ret
jmp fcn.00401562

Function at 0x409246
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405eb4
and dword [ebp - 4], 0
cmp dword [0x813ac0], 0
mov ebx, eax
jne 0x4092f7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093a8
push eax
call fcn.00405e42
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x813ac0], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x813ac4], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x813ac8], eax
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x813ad0], eax
test eax, eax
je 0x4092f7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x813acc], eax
mov eax, dword [0x813acc]
cmp eax, ebx
je 0x40934f
cmp dword [0x813ad0], ebx
je 0x40934f
push eax
call fcn.00405ebd
push dword [0x813ad0]
mov esi, eax
call fcn.00405ebd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40934f
test edi, edi
je 0x40934f
call esi
test eax, eax
je 0x409346
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409346
test byte [ebp - 0xc], 1
jne 0x40934f
or dword [ebp + 0x10], 0x200000
jmp 0x409388
mov eax, dword [0x813ac4]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409388
mov eax, dword [0x813ac8]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x813ac0]
call fcn.00405ebd
pop ecx
test eax, eax
je 0x4093a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b8e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
push esi
cmp ebx, 0x19f
jne 0x40b8f6
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor esi, esi
cmp ebx, ebp
jle 0x40b931
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
call fcn.0040b8d0
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0x64
mov dword [esp + 8], eax
sub dword [esp + 8], 0x64
mov cl, byte [esp + 8]
xor byte [esi + edi], cl
inc esi
cmp esi, ebx
jl 0x40b900
pop esi
pop ebp
cmp ebx, 0x2d
jne 0x40b94c
mov dword [0x2ecc508], 0xa62e7790
mov dword [0x2ecc50c], 0xffffffff
add esp, 8
ret
Function at 0x406960
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4069c6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404a08
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040328c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4069b0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069cd
lea eax, [ebp - 0x10]
call fcn.00404798
ret

Function at 0x409920
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c58
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 1
setne al
pop ebx
ret

Function at 0x40caf8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cb31
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404888
jmp 0x40cb3a
mov eax, ebx
mov edx, esi
call fcn.004047ec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cb44
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cb65
mov al, byte [esp]
jmp 0x40cb67
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d1fc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d064
mov eax, dword [0x4ea2ec]
cmp byte [eax], 0
je 0x40d278
mov eax, dword [0x4e9f94]
call fcn.00403078
call fcn.00402c80
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409b30
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d2c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d2ae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4e9f04]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4eb668]
call fcn.00405dcc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40db88
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40dc5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404830
lea eax, [ebp - 8]
call fcn.00404ca8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404c58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40dc48
mov eax, ebx
call fcn.00402af4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40dc41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404c58
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40dc2b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40dc70
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40dc2b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dc48
mov eax, dword [ebp - 0x10]
call fcn.00402b24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dc65
lea eax, [ebp - 8]
call fcn.00404798
ret

Function at 0x40e240
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e2a4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404a08
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040954c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e2ab
lea eax, [ebp - 0xc]
call fcn.00404798
ret

Function at 0x4265d8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4eb888
cmp dword [edi], 0
jne 0x426654
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4eb884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4e45c4
mov ecx, 2
call fcn.00402d14
mov edx, 0x4265b0
lea eax, [esi + 5]
call fcn.004265d0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004265d0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x426629
mov dword [0x4eb884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427bf0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x427bf6
ret