joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49183b
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x4c6581
call fcn.00493b23
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x491860
xor eax, eax
jmp 0x4919d5
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x49188c
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x49188c
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4919d5
cmp dword [esi + 0x4c], 0
je 0x4919d2
mov ecx, esi
call fcn.00491461
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4918bf
push dword [esi + 0x4c]
push edi
call fcn.00490ddb
pop ecx
pop ecx
test al, al
je 0x4919d2
movzx ebx, di
jmp 0x4919d2
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.00482e80
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4918f7
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.00493ac3
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4919ca
cmp eax, 1
jg 0x4919a5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x491940
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x49196d
cmp eax, 0x10
jae 0x49194f
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.0049cb80
add esp, 0x10
cmp edi, eax
jne 0x4919a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x491970
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x49199a
test edi, edi
jne 0x4918eb
cmp dword [ebp - 0x18], 0x20
jae 0x4919c4
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.0047ed00
jmp 0x4918e5
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4919c4
cmp eax, 3
jne 0x4919ca
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.00490ddb
pop ecx
pop ecx
test al, al
je 0x4919c4
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
lea ecx, [ebp - 0x28]
call fcn.00482890
mov ax, bx
call fcn.00493ade
ret 4

Function at 0x497a90
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4cb9b8
push 0x4cb9b0
push str.FlsAlloc
push 0
call fcn.00497a10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x497ac2
push dword [ebp + 8]
mov ecx, esi
call fcn.00493ac3
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x497b04
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4cb9c8
push 0x4cb9c0
push str.FlsGetValue
push 2
call fcn.00497a10
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x497b35
mov ecx, esi
call fcn.00493ac3
call esi
jmp 0x497b3b
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x497b3e
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4cb9d0
push 0x4cb9c8
push str.FlsSetValue
push 3
call fcn.00497a10
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x497b72
mov ecx, esi
call fcn.00493ac3
call esi
jmp 0x497b78
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x4a9ab4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a9773

Function at 0x4a9abf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a98f6

Function at 0x4ae592
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ae234
Function at 0x4b29f0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x507d50]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b2a31
cmp byte [edx], 0xa
jne 0x4b2a31
or byte [eax + edi + 0x28], 4
jmp 0x4b2a36
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4b2b27
mov al, byte [ebx]
cmp al, 0x1a
je 0x4b2b08
cmp al, 0xd
je 0x4b2a5f
mov byte [esi], al
inc esi
inc ebx
jmp 0x4b2afd
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4b2a7f
cmp byte [eax], 0xa
jne 0x4b2a74
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4b2a7a
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4b2afd
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b2af6
cmp dword [ebp - 0x14], 0
je 0x4b2af6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x507d50]
test byte [eax + edi + 0x28], 0x48
je 0x4b2acd
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4b2abd
mov byte [esi], dl
jmp 0x4b2af9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x507d50]
mov byte [eax + edi + 0x2a], dl
jmp 0x4b2af9
cmp byte [ebp - 1], 0xa
jne 0x4b2adf
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4b2adf
mov byte [esi], 0xa
jmp 0x4b2a7c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004aac53
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b2afa
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4b2a48
jmp 0x4b2b27
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x507d50]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4b2b22
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4b2b27
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2b32
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x507d50]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4b2b76
cmp word [edx], bx
jne 0x4b2b76
or byte [edi + eax + 0x28], 4
jmp 0x4b2b7b
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4b2ccf
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4b2caf
cmp ax, word [ebp - 0x10]
je 0x4b2bb4
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4b2ca4
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4b2bda
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4b2bca
push ecx
pop eax
push 4
jmp 0x4b2bcf
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4b2c9e
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b2c95
cmp dword [ebp - 0x18], 0
je 0x4b2c95
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x507d50]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4b2c61
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4b2c25
mov word [esi], ax
jmp 0x4b2c59
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x507d50]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x507d50]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x507d50]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4b2ca4
cmp word [ebp - 4], ax
jne 0x4b2c76
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4b2c76
mov word [esi], ax
add esi, 2
jmp 0x4b2ca4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004aac53
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4b2ca1
jmp 0x4b2c98
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4b2b94
jmp 0x4b2ccf
mov ecx, dword [ecx*4 + 0x507d50]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4b2cc6
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4b2ccf
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048b0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406b40
test esi, esi
jne 0x4048e6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406cc8
jmp 0x404904
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404794
mov edi, eax
test esi, esi
je 0x404904
cmp dword [ebx], 0
je 0x404904
dec esi
jmp 0x4048ed
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405800
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405bf8
mov byte [esp], al
cmp byte [esp], 0
jne 0x40598c
test edi, edi
je 0x40598c
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4058c3
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x40589e
cmp edi, 0xffffffff
je 0x40585f
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40585f
mov byte [esp], 0
jmp 0x40598c
mov ebx, dword [esi]
cmp ebx, 1
jg 0x40589e
test ebx, ebx
jne 0x405894
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402774
test eax, eax
jne 0x405894
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40598c
call 0x405d1c
dec ebp
test ebp, ebp
jg 0x405844
cmp edi, 0xffffffff
je 0x4058c3
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4058c1
mov byte [esp], 0
jmp 0x40598c
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40580e
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402774
cmp ebx, eax
jne 0x4058c3
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004059fc
mov edx, eax
mov ebx, dword [0x4bb8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40592a
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405928
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40592a
xor edi, edi
cmp byte [esp], 0
je 0x405953
mov ebx, dword [esi]
test bl, 1
jne 0x40596c
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402774
cmp ebx, eax
jne 0x405930
mov byte [esp + 1], 1
jmp 0x40596c
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402774
cmp ebx, eax
jne 0x405953
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4058dd
cmp byte [esp], 0
je 0x40598c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406520
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x4bdb18
cmp dword [ebp + 0xc], 2
jl 0x406534
mov ebx, 0x4bdb48
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x40656c
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x402818
mov dword [0x4bb018], eax
mov eax, 0x402820
mov dword [0x4bb01c], eax
mov eax, ebx
call fcn.00406404
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x4065a1
cmp al, 3
jge 0x4065a1
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4065b2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x4065bd
call dword [ecx + eax*4]
cmp dword [0x4bb03c], 0
jne 0x4065d3
mov byte [0x4bb044], 1
fnstcw word [0x4b7028]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00406834
call fcn.004064b4
ret 4

Function at 0x40679c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bb058], 0
je 0x406803
cmp word [0x4bb344], 0xd7b2
jne 0x4067c5
cmp dword [0x4bb34c], 0
jbe 0x4067c5
mov eax, 0x4bb340
call dword [0x4bb35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x406830
call fcn.00407540
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b7032], 0
jne 0x40681f
push 0
push 0x4b79c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4069fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4b7034], 0
je 0x406a27
mov edx, edi
mov eax, esi
call dword [0x4b7034]
mov ebx, eax
jmp 0x406a38
mov eax, 8
call fcn.004044f0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4bb059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x4069c4
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406a6d
mov edx, 8
mov eax, ebx
call fcn.0040450c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x409228
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40938d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406b40
cmp si, word [0x4b7a00]
jb 0x4092c0
cmp si, word [0x4b7c00]
ja 0x4092c0
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x4092c0
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4b7a00]
jae 0x40929a
mov edi, ebx
dec edi
jmp 0x4092bb
cmp si, word [ebx*8 + 0x4b7a00]
jbe 0x4092aa
inc ebx
mov dword [ebp - 8], ebx
jmp 0x4092bb
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4b7a04]
call fcn.00409138
jmp 0x4092c0
cmp edi, dword [ebp - 8]
jae 0x409284
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40936f
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40936f
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407a30
push dword [ebp - 0x160]
push 0x4093a8
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00407a30
push dword [ebp - 0x164]
push 0x4093b8
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407a30
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409394
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406ba0
ret
Function at 0x409540
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409643
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4bdb88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4bdba0]
jne 0x40958c
mov eax, esi
mov edx, 0x4bdba2
mov ecx, 0x55
call fcn.00407a30
push 0x4bdb88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40962d
push 0x4bdb88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406b40
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4095fb
cmp byte [0x4bdb84], 0
je 0x4095c0
mov edx, esi
mov eax, ebx
call fcn.00409424
jmp 0x4095fb
mov edx, esi
mov eax, ebx
call fcn.00409228
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4095fb
cmp dword [esi], 0
je 0x4095e4
mov eax, esi
mov edx, 0x40965c
call fcn.00407b88
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00409228
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407b88
push 0x4bdb88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4bdba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407984
push eax
push 0x4bdba2
call sub.kernel32.dll_lstrcpynW
push 0x4bdb88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40964a
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x41bd38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov byte [esp], 0
mov eax, ebp
test eax, eax
je 0x41bd50
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x41bd58
mov al, 1
jmp 0x41bd75
movzx esi, word [ebp]
mov eax, esi
call fcn.0040d6e8
test al, al
jne 0x41bd71
cmp si, 0x5f
je 0x41bd71
xor eax, eax
jmp 0x41bd73
mov al, 1
xor al, 1
test al, al
jne 0x41be05
test bl, bl
je 0x41bdc5
mov eax, ebp
test eax, eax
je 0x41bd8c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x41be01
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0040d774
test al, al
jne 0x41bdb9
cmp di, 0x5f
je 0x41bdb9
cmp di, 0x2e
je 0x41bdb9
xor eax, eax
jmp 0x41bdbb
mov al, 1
test al, al
je 0x41be05
inc esi
dec ebx
jne 0x41bd99
jmp 0x41be01
mov eax, ebp
test eax, eax
je 0x41bdd0
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x41be01
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0040d774
test al, al
jne 0x41bdf7
cmp di, 0x5f
je 0x41bdf7
xor eax, eax
jmp 0x41bdf9
mov al, 1
test al, al
je 0x41be05
inc esi
dec ebx
jne 0x41bddd
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41c778
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41c8ac
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ebx, byte [0x41c8bc]
mov dl, 1
mov eax, esi
call fcn.0041cc10
test al, al
jne 0x41c7c9
mov dl, 1
mov eax, esi
call fcn.0041cb78
test al, al
je 0x41c85f
lea edx, [ebp - 0x424]
mov eax, esi
call fcn.0041d33c
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 4]
call fcn.00423210
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 4]
call fcn.00407984
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x41c85a
test byte [ebp - 0xc], 1
je 0x41c825
or bl, 1
test byte [ebp - 0xc], 2
je 0x41c82e
or bl, 2
test byte [ebp - 0xc], 0x80
je 0x41c837
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x41c84b
dec eax
je 0x41c850
dec eax
je 0x41c855
dec eax
jne 0x41c886
or bl, 0x10
jmp 0x41c886
or bl, 4
jmp 0x41c886
or bl, 8
jmp 0x41c886
call fcn.00423bb4
lea edx, [ebp - 0x428]
mov eax, dword [0x4ba780]
call fcn.0040a810
mov ecx, dword [ebp - 0x428]
mov dl, 1
mov eax, dword [0x417b40]
call fcn.004220f0
call fcn.004061b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c8b3
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x421fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4220c5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00421da8
mov esi, eax
mov eax, dword [0x4ba6fc]
cmp byte [eax], 0
je 0x42206d
mov eax, dword [0x4ba4ac]
call fcn.00404a00
call fcn.00404644
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x421f70]
call fcn.00408ca8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4220e0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4220a9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4ba45c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4bdc50]
call fcn.00408d6c
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4220cc
lea eax, [ebp - 4]
mov edx, dword [0x421f70]
call fcn.00408cb4
ret

Function at 0x423a58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407044
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a8a4
mov edi, eax
cmp edi, 0x104
jbe 0x4239ff
mov eax, edi
add eax, eax
call fcn.004044f0
mov esi, eax
jmp 0x423a01
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a8a4
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x423a3c
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x423a26
mov eax, esp
cmp esi, eax
je 0x423a49
mov eax, esi
call fcn.0040450c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x423a84
cmp bl, 0
je 0x423a80
cmp bl, 0x41
jl 0x423a7b
cmp bl, 0x5a
jg 0x423a7b
or bl, 0x20
xor al, bl
inc esi
jmp 0x423a5f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4239c0

Function at 0x424284
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407a30
add esp, 0x800
pop ebx
ret