joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401077
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, 0x44fb40
mov ecx, edi
call fcn.004017eb
mov esi, eax
test esi, esi
js 0x401139
push 0x43d420
push dword [ebp + 0xc]
call fcn.0042155a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x401139
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.00401840
mov dword [ebp - 8], eax
test eax, eax
jne 0x4010c9
or eax, 0xffffffff
jmp 0x40113c
push 0x8000
call fcn.0041d020
mov dword [ebp - 4], eax
pop ecx
test esi, esi
je 0x401117
jmp 0x4010e0
mov eax, dword [ebp - 4]
mov ecx, 0x8000
cmp esi, ecx
mov edi, ecx
mov ecx, 0x44fb40
cmovl edi, esi
push edi
push eax
push dword [ebp - 8]
call fcn.00401a05
push ebx
push edi
push 1
push dword [ebp - 4]
call fcn.004217a9
add esp, 0x10
cmp eax, edi
jl 0x401112
sub esi, edi
jne 0x4010dd
mov edi, 0x44fb40
push dword [ebp - 8]
mov ecx, edi
call fcn.004017c2
push ebx
call fcn.00421419
push dword [ebp - 4]
call fcn.0041c9d4
pop ecx
pop ecx
test esi, esi
jne 0x401139
xor eax, eax
jmp 0x40113c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40610e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
or ecx, 0xffffffff
cmp dword [ebp + 0xc], edx
jle 0x406139
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43d4c0]
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x40611f
pop esi
not ecx
mov eax, ecx
pop ebp
ret 8

Function at 0x408db6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00408e6b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x408dd2
or eax, 0xffffffff
jmp 0x408df4
push esi
push edi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004217a9
push edi
mov esi, eax
call fcn.00421419
add esp, 0x14
call fcn.00425108
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x408eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x408ede
cmp dword [ebp + 0xc], 0
je 0x408ede
cmp dword [ebp + 0x10], 0
jg 0x408ec9
xor eax, eax
pop ebp
ret
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00425374
add esp, 0x10
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x40e5bd
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041d4b0
push esi
push edi
call fcn.00404cbc
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0041d11e
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00408d9e
push dword [ebp - 4]
lea eax, [edi + 0x368]
push eax
call fcn.0040a682
lea eax, [ebp - 4]
push eax
call fcn.00408dab
add esp, 0x18
lea eax, [ebp - 0x1004]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x20
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0041cfa7
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.00408d9e
push dword [ebp - 4]
lea esi, [edi + 0x338]
push esi
call fcn.0040a682
push 0x5c
push dword [esi]
call fcn.0041cac1
push dword [esi]
lea eax, [edi + 0x384]
push eax
call fcn.0040a682
push str.hsptv_
push dword [esi]
call fcn.00421820
lea eax, [ebp - 4]
push eax
call fcn.00408dab
push dword [esi]
lea eax, [edi + 0x388]
push eax
call fcn.0040a682
add esp, 0x40
pop edi
pop esi
leave
ret

Function at 0x40f524
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shl eax, 2
push ebx
push esi
mov esi, dword [ebp + 0xc]
not eax
xor ebx, ebx
and eax, 8
or eax, 2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp byte [esi], bl
je 0x40f5b6
push 0x3c
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0041eb30
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
push eax
push esi
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], ebx
call fcn.00408d9e
mov dword [ebp - 0x38], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00408d9e
add esp, 0x1c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
lea eax, [ebp - 4]
push eax
je 0x40f628
call fcn.00408dab
lea eax, [ebp - 8]
push eax
call fcn.00408dab
pop ecx
pop ecx
jmp 0x40f624
push eax
test cl, 0x10
je 0x40f5dc
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d9e
pop ecx
pop ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40f613
test cl, 0x20
je 0x40f5fe
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d9e
pop ecx
pop ecx
push eax
push str.print
jmp 0x40f5d3
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d9e
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00408dab
pop ecx
cmp esi, 0x20
jl 0x40f638
pop esi
pop ebx
leave
ret
call fcn.00408dab
lea eax, [ebp - 8]
push eax
call fcn.00408dab
pop ecx
pop ecx
push 0x44c354
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0xe
push eax
call fcn.0041ed0c
int3
Function at 0x40f64e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0041d4b0
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, ecx
mov byte [ebp - 0x1004], dl
push esi
sub eax, edx
je 0x40f714
sub eax, 1
je 0x40f707
sub eax, 1
je 0x40f6f3
sub eax, 1
je 0x40f6df
sub eax, 1
je 0x40f6cf
sub eax, 1
je 0x40f6c5
sub eax, 1
je 0x40f6b4
test ecx, 0x10000
je 0x40f76e
push edx
movzx eax, cx
push eax
lea eax, [ebp - 0x1004]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x40f727
mov esi, dword [0x450a18]
add esi, 0x390
jmp 0x40f769
mov esi, 0x43d43e
jmp 0x40f769
mov eax, dword [0x450a18]
mov esi, dword [eax + 0x368]
jmp 0x40f769
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40f727
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40f727
mov eax, dword [0x450a18]
mov esi, dword [eax + 0x384]
jmp 0x40f769
lea eax, [ebp - 0x1004]
push 0x1000
push eax
call fcn.004238b4
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.00408d9e
mov eax, dword [0x450a18]
push dword [ebp + 8]
add eax, 0x338
push eax
call fcn.0040a682
lea eax, [ebp + 8]
push eax
call fcn.00408dab
mov eax, dword [0x450a18]
push 0x5c
mov esi, dword [eax + 0x338]
push esi
call fcn.0041cac1
add esp, 0x1c
mov eax, esi
pop esi
leave
ret
push 0x44c354
lea eax, [ebp - 4]
mov dword [ebp - 4], 3
push eax
call fcn.0041ed0c
int3
Function at 0x40f784
Capabilities:
Get hostname
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0x104
push edi
push 4
pop edi
test bl, 0x10
je 0x40f7ab
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test bl, 0x20
je 0x40f7d0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp + 0x10]
and ebx, 0xf
mov ecx, dword [ebp + ebx*4 - 0x48]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x40f8e5
push esi
sub ebx, 0
je 0x40f84a
sub ebx, 1
je 0x40f83a
sub ebx, 1
je 0x40f815
sub ebx, 1
je 0x40f800
sub ebx, 0xd
je 0x40f7fb
sub ebx, 1
je 0x40f7f6
xor eax, eax
jmp 0x40f8e4
mov eax, dword [ebp - 0x14]
jmp 0x40f80b
mov eax, dword [ebp - 0x10]
jmp 0x40f80b
mov eax, dword [0x450a18]
mov eax, dword [eax + 0x37c]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40f8dd
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp + 8]
push eax
push esi
call fcn.00408d9e
push dword [ebp + 8]
call fcn.00423250
add esp, 0xc
jmp 0x40f8b8
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x40f823
mov esi, dword [ebp + 0x10]
push str.Windows
push esi
call fcn.00421810
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov ecx, 0x43db80
mov eax, 0x43db84
test ebx, ebx
cmovs ecx, eax
push ecx
push esi
call fcn.00421820
mov eax, ebx
shr eax, 8
movzx eax, al
push eax
movzx eax, bl
push eax
lea eax, [ebp - 0xc8]
push str._ver_d._d
push eax
call fcn.00401b4a
lea eax, [ebp - 0xc8]
push eax
push esi
call fcn.00421820
lea eax, [ebp + 8]
push eax
push esi
call fcn.00408d9e
push dword [ebp + 8]
call fcn.00423250
add esp, 0x2c
mov edi, eax
cmp esi, dword [ebp + 8]
je 0x40f8d0
push edi
push dword [ebp + 8]
push esi
call fcn.0041e5b0
add esp, 0xc
mov byte [edi + esi], 0
lea eax, [ebp + 8]
push eax
call fcn.00408dab
pop ecx
push 2
pop edi
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov dword [ecx], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x412746
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x43c7a1
call fcn.0041d488
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x450acc]
test byte [eax + 0x30c], 2
je 0x4127bb
cmp dword [esi + 4], 0x200
jne 0x41280a
cmp dword [0x450ae0], 0
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 0xe]
jne 0x4127b0
cmp dword [0x450ae4], ecx
jne 0x412839
cmp dword [0x450ae8], eax
jne 0x412839
jmp 0x4127bb
mov dword [0x450ae4], ecx
mov dword [0x450ae8], eax
cmp dword [esi + 4], 0x100
jne 0x4127fb
cmp dword [esi + 8], 9
jne 0x4127cf
call fcn.004121f6
push 2
call fcn.0040568e
pop ecx
test eax, eax
je 0x4127fb
push dword [esi + 0xc]
and dword [ebp - 4], 0
push dword [esi + 8]
push 2
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 2
call fcn.00405857
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
cmp dword [esi + 4], 0x100
jne 0x4127fb
cmp dword [0x450ae0], 0
jne 0x4127bb
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 0x44c354
jmp 0x412845
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0x44c354
push eax
call fcn.0041ed0c
int3
Function at 0x412cbe
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0xec], 9
je 0x412dfd
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x412d0b
cmp dword [ebp - 0x18], 0x12
je 0x412e87
lea eax, [ebp - 0x1c]
push eax
call fcn.00412746
pop ecx
jmp 0x412df0
mov eax, dword [esi + 0xec]
sub eax, 1
je 0x412d85
sub eax, 1
je 0x412da5
sub eax, 1
je 0x412d4c
push 3
pop ecx
sub eax, ecx
je 0x412e7e
sub eax, 1
je 0x412e75
sub eax, 1
jne 0x412e03
mov dword [esi + 0xec], ecx
jmp 0x412df0
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp dword [ebp - 0x18], 0x12
je 0x412e87
lea eax, [ebp - 0x1c]
push eax
call fcn.00412746
cmp dword [esi + 0xec], 3
pop ecx
je 0x412d4c
push 0x4ff
push 0x3e8
jmp 0x412e28
cmp dword [0x44f0b8], 0xffffffff
jne 0x412d96
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x412d98
call ebx
push eax
call fcn.00404374
pop ecx
mov dword [esi + 0xec], eax
cmp dword [0x44f0b8], 0xffffffff
jne 0x412e08
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push edi
call fcn.00404321
pop ecx
test eax, eax
je 0x412dd1
mov ecx, dword [esi + 0xf8]
push 0x4ff
sub ecx, edi
push ecx
jmp 0x412e26
mov eax, dword [0x450acc]
test byte [eax + 0x30c], 2
je 0x412dee
mov eax, dword [0x450ae0]
test eax, eax
je 0x412dee
dec eax
mov dword [0x450ae0], eax
xor edi, edi
cmp dword [esi + 0xec], 9
jne 0x412cdf
mov dword [esi + 0xec], edi
pop edi
pop esi
pop ebx
leave
ret
call ebx
lea edi, [eax + 5]
push edi
call fcn.00404321
pop ecx
test eax, eax
je 0x412e3b
mov eax, dword [esi + 0xf8]
push 0x4ff
sub eax, edi
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x412df0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
cmp eax, dword [esi + 0xf8]
jl 0x412e33
mov dword [esi + 0xfc], eax
xor edi, edi
mov eax, dword [0x450acc]
mov dword [esi + 0xec], edi
test byte [eax + 0x30c], 2
je 0x412df0
mov eax, dword [0x450ae0]
test eax, eax
je 0x412df0
dec eax
mov dword [0x450ae0], eax
jmp 0x412df0
mov dword [ebp + 8], 0x2d
jmp 0x412e8a
mov dword [ebp + 8], 0xa
jmp 0x412e8a
mov dword [ebp + 8], edi
push 0x44c354
lea eax, [ebp + 8]
push eax
call fcn.0041ed0c
int3
Function at 0x414776
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
push edi
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x18], ecx
push dword [edi + 8]
call esi
cmp dword [edi + 0xc], 0
mov ebx, dword [ebp + 0xc]
jl 0x414807
mov ecx, dword [ebp - 0x18]
push dword [edi + 0xc]
mov ecx, dword [ecx + 0x130]
call fcn.004163dd
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], eax
sub ecx, 1
je 0x4147d9
sub ecx, 1
je 0x4147cf
movzx ecx, word [edi + 0x14]
movzx edx, word [edi + 0x16]
jmp 0x4147e1
movzx ecx, word [edi + 0x18]
movzx edx, word [edi + 0x1a]
jmp 0x4147e1
movzx ecx, word [edi + 0x1c]
movzx edx, word [edi + 0x1e]
push 0xcc0020
movsx eax, dx
push eax
movsx eax, cx
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, 0x200
test word [edi + 2], ax
je 0x414834
push 0xfffffffffffffffd
push 0xfffffffffffffffd
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 8]
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x118]
push eax
push 0xff
push 0xd
push dword [edi + 8]
call esi
push 0
push 0
push 0x31
push dword [edi + 8]
call esi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
call edi
push 1
push ebx
mov esi, eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x25
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00408d9e
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
lea eax, [ebp - 4]
push eax
call fcn.00408dab
pop ecx
push esi
push ebx
call edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x415d0e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
push 0x43d420
mov esi, ecx
push eax
push dword [ebp + 8]
mov ebx, dword [esi + 0x40]
call fcn.00408d9e
pop ecx
pop ecx
push eax
call fcn.0042155a
mov edi, eax
lea eax, [ebp - 4]
push eax
call fcn.00408dab
add esp, 0xc
test edi, edi
jne 0x415d50
or eax, 0xffffffff
jmp 0x415da2
mov ecx, dword [esi + 0x3c]
mov eax, 0x4d42
mov word [ebp - 0x14], ax
lea eax, [ebx + 0xe]
add eax, ecx
mov dword [ebp - 0x12], eax
lea eax, [ecx + 0xe]
mov dword [ebp - 0xa], eax
xor eax, eax
push edi
push 0xe
mov dword [ebp - 0xe], eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004217a9
push edi
push dword [esi + 0x3c]
push 1
push dword [esi + 0x18]
call fcn.004217a9
push edi
push ebx
push 1
push dword [esi + 0x14]
call fcn.004217a9
push edi
call fcn.00421419
add esp, 0x34
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x416977
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, ecx
call fcn.00416289
mov eax, dword [edi + 0x324]
and dword [ebp + 8], 0
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x4169c9
mov eax, dword [esi + 0x34]
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.004155c2
push 0x1bc
push esi
call fcn.0041d229
mov eax, dword [edi + 0x324]
pop ecx
pop ecx
push 0
push dword [ebp + 8]
and dword [eax + ebx*4], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1bc
call fcn.0041d1f9
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x416a05
xor eax, eax
mov dword [esi + 0x1b8], 0xf
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x1b4], eax
mov byte [esi + 0x1a4], al
mov dword [esi], eax
mov dword [esi + 0xc4], eax
jmp 0x416a07
xor esi, esi
mov eax, dword [edi + 0x324]
xor ecx, ecx
inc ecx
mov dword [eax + ebx*4], esi
mov eax, dword [ebp + 0x14]
and eax, ecx
mov dword [esi + 0x44], ecx
push eax
push dword [ebp + 0x10]
mov dword [esi + 0x48], ebx
mov ecx, esi
push dword [ebp + 0xc]
mov dword [esi + 0x130], edi
push dword [ebp + 8]
push dword [edi + 0x320]
call fcn.004166ed
and dword [esi + 0x50], 0
and dword [esi + 0x54], 0
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41b50d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x41b53b
cmp eax, edi
jge 0x41b52f
push esi
call fcn.0041a697
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x41b55e
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x41b544
mov dword [esi + 8], edx
jmp 0x41b573
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x41b569
xor dl, dl
jmp 0x41b56e
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x41b55e
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x41b5ac
mov dword [0x450b18], str.zlib_corrupt
xor eax, eax
jmp 0x41b5f1
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x41b5c1
mov dword [0x450b18], str.read_past_buffer
jmp 0x41b5a8
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x41b5db
push edi
push ecx
push esi
call fcn.0041c8bf
add esp, 0xc
test eax, eax
je 0x41b5a8
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0041e5b0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x41cd28
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429b1f
Function at 0x41cd3f
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ecx, esi
and ecx, 1
mov eax, esi
shl ecx, 4
mov ebx, ecx
or ebx, 6
and al, 2
push edi
lea eax, [ebp - 0x140]
cmove ebx, ecx
push eax
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x41cd83
xor eax, eax
jmp 0x41ce25
and esi, 4
xor eax, eax
mov ecx, ebx
and ecx, dword [ebp - 0x140]
cmp eax, ecx
sbb eax, eax
neg eax
test esi, esi
jne 0x41cda1
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
test eax, eax
je 0x41cdf3
mov al, byte [ebp - 0x114]
xor ecx, ecx
test al, al
setne cl
cmp al, 0x2e
jne 0x41cdcf
mov al, byte [ebp - 0x113]
xor edx, edx
test al, al
cmove ecx, edx
cmp al, 0x2e
jne 0x41cdcf
cmp byte [ebp - 0x112], dl
je 0x41cdf3
test ecx, ecx
je 0x41cdf3
lea eax, [ebp - 0x114]
inc edi
push eax
push dword [ebp + 0xc]
call fcn.0040a662
push 0x43d9e8
push dword [ebp + 0xc]
call fcn.0040a662
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41cd86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41cd86
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43261e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043249d
Function at 0x408218
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40826a
test eax, edx
je 0x40826d
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40822d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408253
add ecx, 4
js 0x408243
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408250
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408279
test edx, edx
jne 0x408220
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b5b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5f1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404904
jmp 0x40b5fa
mov eax, ebx
mov edx, esi
call fcn.00404868
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b604
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b626
movzx eax, byte [esp]
jmp 0x40b628
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bcb8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bb30
mov eax, dword [0x45ca5c]
cmp byte [eax], 0
je 0x40bd34
mov eax, dword [0x45c884]
call fcn.004031c8
call fcn.00402fac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d38
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bd7c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bd6a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x45c830]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45f7f4]
call fcn.0040596c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret