joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa54c78
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ecx
push edx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov ecx, dword [eax]
cmp ecx, eax
je 0xa54ca6
mov edx, ecx
mov ecx, dword [ecx]
cmp dword [edx + 8], 0
je 0xa54ca6
push dword [edx + 0x18]
call fcn.00a54afc
jmp 0xa54c8e
pop edi
pop esi
pop edx
pop ecx
ret

Function at 0xa65651
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0xa6566e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6565f
add dl, dl
jne 0xa65679
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa656c5
xor eax, eax
add dl, dl
jne 0xa65686
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa65762
add dl, dl
jne 0xa65695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa656a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa656ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa656b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa656c0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0xa65665
mov eax, 1
add dl, dl
jne 0xa656d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa656de
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa656ca
sub eax, 2
jne 0xa6570d
mov ecx, 1
add dl, dl
jne 0xa656f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa656fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa656ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa65665
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa65724
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6572f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6571b
cmp eax, 0x7d00
jae 0xa65752
cmp eax, 0x500
jb 0xa6574d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa65665
cmp eax, 0x7f
ja 0xa65755
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa65665
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa6577e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa65665
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x40686c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0x409368], eax
xor eax, eax
mov dword [0x40936c], eax
push 1
xor ecx, ecx
mov dl, 0x29
mov eax, dword [ebp - 4]
call fcn.004031c0
mov eax, 0x409364
mov edx, 0x1000
call fcn.004014b4
cmp dword [0x409364], 0
je 0x4068e0
push 0
push 0x406774
call sub.user32.dll_EnumWindows
cmp dword [0x40936c], 0
je 0x4068d6
mov eax, dword [0x40936c]
add eax, eax
inc eax
push eax
mov ecx, dword [0x409364]
mov dl, 0x2a
mov eax, dword [ebp - 4]
call fcn.004031c0
mov eax, dword [0x409364]
call fcn.00401438
push 1
xor ecx, ecx
mov dl, 0x2b
mov eax, dword [ebp - 4]
call fcn.004031c0
pop ecx
pop ebp
ret

Function at 0x406ff8
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, dword [0x40806c]
mov esi, dword [0x4080c4]
mov edi, dword [0x4080e8]
mov ebp, dword [0x4080dc]
mov eax, dword [0x4080ec]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov byte [ebp], 0
mov eax, dword [ebx]
mov eax, dword [edi + eax*4]
mov edx, dword [0x4080a4]
mov edx, dword [edx]
call fcn.00403140
mov dword [esi], eax
cmp dword [esi], 0xffffffff
je 0x40704c
mov byte [ebp], 1
mov eax, dword [esi]
call fcn.00406f58
mov byte [ebp], 0
inc dword [ebx]
mov eax, dword [ebx]
cmp dword [edi + eax*4], 0
jne 0x40705e
xor eax, eax
mov dword [ebx], eax
mov eax, dword [esi]
call fcn.00403064
push 0x4e20
call sub.kernel32.dll_Sleep
jmp 0x407028

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6bf453d7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x32a77f3f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40e630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5a4410], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x5a440c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x5a4410], eax
cmp ecx, 0x26f
jl 0x40e640
mov dword [0x53ffd0], 0x270
ret

Function at 0x40e680
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x5a3010]
cmp eax, dword [0x53f720]
je 0x40e698
mov dword [0x53ffd0], 0x271
cmp dword [0x53ffd0], 0x270
jl 0x40e7b7
cmp dword [0x53ffd0], 0x271
jne 0x40e6cf
mov eax, dword [0x5a3010]
call fcn.0040e630
mov eax, dword [0x5a3010]
not eax
mov dword [0x5a3010], eax
mov dword [0x53f720], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x5a4414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x5a4410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x5a4a44]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x53ffe0]
xor edx, eax
mov dword [ebx*4 + 0x5a4410], edx
cmp ebx, 0xe2
jl 0x40e6d8
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x5a4414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x5a4410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x5a4084]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x53ffe0]
xor edx, eax
mov dword [ebx*4 + 0x5a4410], edx
cmp ebx, 0x26e
jl 0x40e72c
mov eax, dword [0x5a4dcc]
and eax, 0x80000000
mov edx, dword [0x5a4410]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x5a4a40]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x53ffe0]
xor eax, edx
mov dword [0x5a4dcc], eax
mov dword [0x53ffd0], 0
mov eax, dword [0x53ffd0]
mov eax, dword [eax*4 + 0x5a4410]
add dword [0x53ffd0], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x410250
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x53f450]
cmp ax, 0xcb
je 0x41034c
cmp ax, 0xcc
je 0x41034c
mov edx, dword [0x5a5020]
test edx, edx
je 0x410282
mov eax, dword [0x5a4ec0]
call edx
mov ebx, eax
jmp 0x410287
mov ebx, 0x5a4ec4
cmp word [0x5a4eb0], 0
jle 0x4102aa
mov eax, 0x5a4e90
call fcn.004104c0
mov eax, ebx
call fcn.0040fe30
mov eax, ebx
call fcn.0040fea0
mov edi, dword [ebx]
jmp 0x4102ca
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4102c5
mov edx, edi
mov eax, ebx
call fcn.0040f300
jmp 0x4102c8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4102b0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5a4eb0], 0
jle 0x41034c
mov edx, 0x5a4dd0
mov eax, ebx
call fcn.0040f430
mov edi, eax
test edi, edi
je 0x41031f
mov eax, dword [0x5a4e64]
mov dword [edi + 0xc], eax
cmp dword [0x5a4e64], 0
je 0x410314
mov eax, dword [0x5a4e64]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5a4e64], eax
sub word [0x5a4eb0], 1
cmp word [0x5a4eb0], 0
sete bl
mov eax, 0x5a4e90
call fcn.004104d0
test bl, bl
je 0x41034c
mov eax, 0x5a4e90
call fcn.004104b0
pop edi
pop esi
pop ebx
ret
Function at 0x412330
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x5a4250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.00412510
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5a4250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004033d0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x53f4d0], eax
mov esi, dword [0x53f4d0]
jmp 0x4124d0
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x4123c0
cmp byte [esi], 0
je 0x4124d9
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x412435
mov al, byte [esi]
cmp al, 1
jb 0x41242b
sub al, 0x20
jbe 0x4123fc
sub al, 2
je 0x41240f
jmp 0x41242b
mov al, byte [ebp - 0x10c]
test al, al
je 0x41243a
add dword [ebp - 0x110], 1
jmp 0x412432
cmp byte [esi + 1], 0x22
je 0x412426
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x412432
add esi, 1
jmp 0x412432
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x4123ec
test dword [ebp - 0x114], 0xffffffff
je 0x4124c9
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.00412510
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x5a4250]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x4124c1
mov al, byte [esi]
cmp al, 1
jb 0x4124b7
sub al, 0x20
jbe 0x412488
sub al, 2
je 0x41249b
jmp 0x4124b7
mov al, byte [ebp - 0x10c]
test al, al
je 0x4124c6
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x4124be
cmp byte [esi + 1], 0x22
je 0x4124b2
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x4124be
add esi, 1
jmp 0x4124be
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x412478
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x4123c3
mov ebx, dword [ebp - 0x114]
mov dword [0x5a4240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5a4250
call fcn.004100b0
mov eax, dword [0x5a4250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423280
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x423425
lea ecx, [ebp - 4]
mov edx, str.https:__pastebin.com_raw_NripnE3J
test edx, edx
jne 0x4232d4
mov edx, 0x5a42e0
mov eax, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:59.0__Gecko_20100101_Firefox_59.0
test eax, eax
jne 0x4232e2
mov eax, 0x5a42e0
call fcn.0053e9a0
cmp dword [ebp - 4], 0
jne 0x423301
mov eax, str.Make_sure_you_have_an_active_internet_connection_
call fcn.00423260
mov eax, 0
call fcn.0040ec30
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0053e1d0
mov eax, dword [ebp - 8]
test eax, eax
je 0x423319
mov eax, dword [eax - 4]
add eax, 1
mov dword [0x5a5620], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
mov edx, 0x5a2c38
mov eax, 0x5a55e0
mov ecx, 1
call fcn.0040c4f0
mov eax, dword [0x5a5620]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
mov edx, 0x5a2c38
mov eax, 0x5a55f0
mov ecx, 1
call fcn.0040c4f0
mov eax, dword [0x5a5620]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
mov edx, 0x5a2c38
mov eax, 0x5a5600
mov ecx, 1
call fcn.0040c4f0
mov eax, dword [0x5a5620]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
mov edx, 0x5a2c14
mov eax, 0x5a5610
mov ecx, 1
call fcn.0040c4f0
mov eax, dword [0x5a5620]
sub eax, 1
mov ebx, eax
mov esi, 0
cmp ebx, esi
jb 0x423425
sub esi, 1
nop
add esi, 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + esi*4]
lea ecx, [ebp - 0xc]
mov edx, str._::
call fcn.0053e5e0
mov eax, dword [0x5a5600]
lea eax, [eax + esi*4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call fcn.00408a00
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dl, 0xa
call fcn.0053e3a0
mov edx, dword [0x5a5610]
mov dword [edx + esi*4], eax
mov eax, dword [0x5a55e0]
lea eax, [eax + esi*4]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 8]
call fcn.00408a00
mov eax, dword [0x5a5600]
mov eax, dword [eax + esi*4]
lea edx, [ebp - 0x3c]
call fcn.0053e880
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x5a55f0]
lea eax, [eax + esi*4]
call fcn.00408a00
cmp ebx, esi
ja 0x4233b0
call fcn.0040d760
lea eax, [ebp - 0x3c]
call fcn.00403a50
lea eax, [ebp - 4]
call fcn.00403a50
mov edx, 0x5a2c38
lea eax, [ebp - 8]
call fcn.0040e240
mov edx, 0x5a2c38
lea eax, [ebp - 0xc]
call fcn.0040e240
pop eax
test eax, eax
je 0x42345e
call fcn.0040d890
pop esi
pop ebx
leave
ret
Function at 0x4242a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x42433c
mov eax, dword [ebp - 0x1c]
sub eax, 2
mov dword [ebp - 0x20], 0
cmp eax, dword [ebp - 0x20]
jl 0x424358
sub dword [ebp - 0x20], 1
nop
add dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x424358
sub dx, 0x20
je 0x424335
sub dx, 0x80
je 0x424335
sub dx, 0x1f62
jb 0x424358
sub dx, 1
jbe 0x424335
sub dx, 6
je 0x424335
sub dx, 0x26
jne 0x424358
jmp 0x424335
cmp eax, dword [ebp - 0x20]
jg 0x4242e8
jmp 0x424358
cmp dword [ebp - 0x1c], 2
jne 0x42434c
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x424358
mov al, byte [ebp - 0xc]
call fcn.0040b0e0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x4243a6
sub ax, 0x21
je 0x4243b4
sub ax, 0x17
je 0x4243ba
sub ax, 0x222
je 0x4243c0
sub ax, 0x392
je 0x4243c6
sub ax, 1
je 0x4243cc
sub ax, 0x1996
je 0x4243d2
sub ax, 1
je 0x4243d8
sub ax, 6
je 0x4243de
sub ax, 0xb
je 0x4243ea
sub ax, 0x1b
je 0x4243e4
sub ax, 0x367
je 0x4243f0
jmp 0x4243f6
mov ax, word [ebp - 0x24]
call fcn.0040b150
mov byte [ebp - 0x10], al
jmp 0x4243fc
mov byte [ebp - 0x10], 0x20
jmp 0x4243fc
mov byte [ebp - 0x10], 0x2e
jmp 0x4243fc
mov byte [ebp - 0x10], 0x27
jmp 0x4243fc
mov byte [ebp - 0x10], 0x2c
jmp 0x4243fc
mov byte [ebp - 0x10], 0x27
jmp 0x4243fc
mov byte [ebp - 0x10], 0x20
jmp 0x4243fc
mov byte [ebp - 0x10], 0x20
jmp 0x4243fc
mov byte [ebp - 0x10], 0x20
jmp 0x4243fc
mov byte [ebp - 0x10], 0x20
jmp 0x4243fc
mov byte [ebp - 0x10], 0x2d
jmp 0x4243fc
mov byte [ebp - 0x10], 0x27
jmp 0x4243fc
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x10]
leave
ret

Function at 0x447270
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x447334
mov ebx, 1
sub ebx, 1
mov esi, esi
add ebx, 1
lea eax, [ebx*4 + 0x5a5adc]
mov edx, 0
call fcn.00408a00
mov dword [ebx*4 + 0x5a5afc], 0xffffffff
cmp ebx, 7
jl 0x4472a8
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x447334
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0xa
call fcn.004093c0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.0043f6a0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x447334
push 4
push ebx
push esi
mov eax, 0x447130
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x4471d0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
call fcn.0040d760
lea eax, [ebp - 0x38]
call fcn.00403a50
pop eax
test eax, eax
je 0x44734b
call fcn.0040d890
pop esi
pop ebx
leave
ret
Function at 0x4479f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x447af4
mov eax, dword [ebp - 0x3c]
mov edx, 0
call fcn.0040af20
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004456e0
jmp 0x447ae3
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040aed0
mov edx, dword [ebp - 4]
mov al, 0x3d
call fcn.0040b610
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx - 1]
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b560
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.004456e0
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040b3d0
test eax, eax
jne 0x447ad2
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x447ab4
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea eax, [ebx + 1]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040b560
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
call fcn.0040af20
jmp 0x447aee
mov eax, esi
call fcn.00403f30
shl eax, 1
lea eax, [esi + eax]
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x447a60
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040d760
lea eax, [ebp - 0x38]
call fcn.0040ac70
lea eax, [ebp - 0x34]
call fcn.0040ac70
lea eax, [ebp - 4]
call fcn.0040ac70
lea eax, [ebp - 8]
call fcn.0040ac70
pop eax
test eax, eax
je 0x447b23
call fcn.0040d890
pop edi
pop esi
pop ebx
leave
ret
Function at 0x462f10
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x463065
cmp byte [ebp - 4], 0
je 0x46300f
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040a700
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040a700
lea eax, [ebp - 0x44]
call fcn.0040ac70
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040b1d0
mov edx, dword [ebp - 0x48]
mov ecx, 0x569948
lea eax, [ebp - 0x44]
call fcn.0040af60
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040ae60
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x46300f
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
mov dx, 0
call fcn.004092c0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x569958
call fcn.00408b00
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x463065
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040a700
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040a700
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.0040aac0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00408a00
cmp byte [ebp - 4], 0
je 0x463065
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040d760
lea eax, [ebp - 0x4c]
call fcn.00403a50
lea eax, [ebp - 0x48]
call fcn.0040ac70
lea eax, [ebp - 0x44]
call fcn.0040ac70
lea eax, [ebp - 0xc]
call fcn.0040a160
lea eax, [ebp - 0x10]
call fcn.0040a160
lea eax, [ebp - 0x14]
call fcn.0040a160
pop eax
test eax, eax
je 0x4630a4
call fcn.0040d890
leave
ret

Function at 0x4631e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d4e0
call fcn.0040f0d0
push eax
test eax, eax
jne 0x46322b
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0040c200
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x463222
mov eax, 0x5a42e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040d760
lea eax, [ebp - 0x34]
call fcn.0040ac70
pop eax
test eax, eax
je 0x463242
call fcn.0040d890
mov eax, dword [ebp - 8]
leave
ret
Function at 0x482d30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 4]
mov edi, edx
mov dword [esp], eax
lea eax, [ecx - 1]
mov esi, eax
mov ecx, 0
cmp esi, ecx
jl 0x482d78
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov al, byte [esp]
mov dl, byte [edi]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x5a6180]
xor edx, eax
mov dword [esp], edx
add edi, 1
cmp esi, ecx
jg 0x482d50
mov eax, dword [esp]
lea esp, [esp + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4a0240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov ecx, eax
mov eax, 0
lea ebx, [ecx + 1]
movzx edx, byte [ecx]
add edx, 1
and edx, 0xff
lea edx, [ecx + edx]
jmp 0x4a0271
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor esi, ecx
mov eax, esi
add ebx, 1
cmp ebx, edx
jb 0x4a0260
pop esi
pop ebx
ret

Function at 0x4aa8e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4aa910
mov eax, esi
call fcn.004aed40
cmp byte [esi + 0x40], 0
je 0x4aa909
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4aa9a8
mov dword [esi + 0x14], 0xcb
cmp dword [esi + 0x14], 0xcb
jne 0x4aa98a
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4aa982
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4aa939
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4aa94d
mov bl, 0
jmp 0x4aa9a8
cmp edi, 2
je 0x4aa982
cmp dword [esi + 8], 0
je 0x4aa92c
cmp edi, 3
je 0x4aa962
cmp edi, 1
jne 0x4aa92c
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
cmp eax, dword [edx + 8]
jl 0x4aa92c
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x4aa92c
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4aa99f
cmp dword [esi + 0x14], 0xcc
je 0x4aa99f
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004aac90
mov eax, esi
call fcn.004aa9b0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret