joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bd5
Capabilities:
Create pipe

Disassembly:
push ebp
mov eax, 0x824c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ad50
sub esp, eax
mov esi, dword [ebp + 8]
cmp dword [0x410018], 0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x8230], 0
mov dword [ebp - 0x822c], 0
je 0x403c37
mov eax, dword [0x410a20]
test eax, eax
je 0x403c37
mov dword [esp + 0x10], 0x418dd0
mov dword [esp + 0xc], 0x418d50
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check_Java_Version:__s_min_s_max_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x8228]
mov dword [esp + 8], eax
lea eax, [ebp - 0x822c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8230]
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [ebp - 0x8228], 0xc
mov dword [ebp - 0x8220], 1
mov dword [ebp - 0x8224], 0
call sub.kernel32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x403ca6
mov eax, dword [0x410a20]
test eax, eax
je 0x403c9f
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_create_pipe_n
call sub.msvcrt.dll_fputs
xor eax, eax
jmp 0x403e0f
mov eax, dword [ebp - 0x8230]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.kernel32.dll_SetHandleInformation
sub esp, 0xc
test eax, eax
jne 0x403cfe
mov eax, dword [0x410a20]
test eax, eax
je 0x403ce4
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_set_handle_information_n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x822c]
jmp 0x403d88
xor eax, eax
mov ecx, 0x2000
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x811c]
mov cl, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 4], esi
lea esi, [ebp - 0x811c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call fcn.00401fa1
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x8018]
mov dword [esp + 8], str.__s___version
mov dword [esp + 4], 0x8000
mov dword [esp], esi
call fcn.004058d0
mov eax, dword [ebp - 0x822c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00403638
test eax, eax
jne 0x403d96
mov eax, dword [0x410a20]
test eax, eax
je 0x403d82
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_run_java_w___version_n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
jmp 0x403c9f
xor eax, eax
mov ecx, 0x20
lea edi, [ebp - 0x821c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x819c]
lea esi, [ebp - 0x821c]
mov cl, 0x20
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x8230]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004034dc
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x821c], 0
push edi
lea edi, [ebp - 0x819c]
je 0x403c9f
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00401d30
mov eax, dword [ebx]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040373f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404640
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x404690
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40475b
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x4046e1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x4046c9
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x4046d9
cmp ecx, 0x40
je 0x4046d9
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00404640
lea esi, [esi]
lea edi, [edi]
Function at 0x40b300
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
and esp, 0xfffffff0
sub esp, 0x410
call fcn.004049e0
call fcn.0040183c
call sub.kernel32.dll_GetCommandLineA
cmp byte [eax], 0x22
jne 0x40b33e
inc eax
mov dword [esp + 4], 0x22
mov dword [esp], eax
call sub.msvcrt.dll_strchr
lea edx, [eax + 1]
lea ecx, [eax + 2]
cmp byte [eax + 1], 0
jmp 0x40b358
mov dword [esp + 4], 0x20
mov dword [esp], eax
call sub.msvcrt.dll_strchr
mov edx, section..rdata
lea ecx, [eax + 1]
test eax, eax
cmovne edx, ecx
mov dword [esp + 4], 0
mov dword [esp], edx
call fcn.00404208
cmp eax, 0xb7
jne 0x40b3aa
xor al, al
mov ecx, 0x100
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x10]
mov dword [esp + 4], edi
mov dword [esp], 0x69
call fcn.004019e6
mov dword [esp], edi
call fcn.0040184b
call fcn.00401699
mov eax, 2
jmp 0x40b45c
dec eax
je 0x40b3bc
call fcn.004018ae
mov eax, 1
jmp 0x40b45c
mov dword [esp], 0x1f
lea edi, [esp + 0x10]
call fcn.00401ae0
mov dword [0x410008], eax
mov dword [esp + 4], edi
mov dword [esp], 1
mov dword [esp + 0x10], 0
call fcn.00403389
test eax, eax
jne 0x40b3f4
call fcn.004018ae
jmp 0x40b432
cmp dword [0x410008], 0
je 0x40b422
mov edx, dword [esp + 0x10]
test edx, edx
je 0x40b422
mov eax, dword [0x410a20]
test eax, eax
je 0x40b422
mov dword [esp + 8], edx
mov dword [esp + 4], str.Exit_code:_t_d__restarting_the_application__n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [0x410008], 0
je 0x40b432
cmp dword [esp + 0x10], 0
jne 0x40b3d1
mov eax, dword [0x410a20]
test eax, eax
je 0x40b453
mov edx, dword [esp + 0x10]
mov dword [esp + 4], str.Exit_code:_t_d_n
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
call fcn.00401699
mov eax, dword [esp + 0x10]
mov edi, dword [ebp - 4]
leave
ret

Function at 0x43d478
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x43d444
add byte [esi + 0x1454109], dl
imul eax, dword [eax], 0
xchg esi, eax
add eax, 0x8c014541
sub eax, 0x3dee8225
cmp al, byte [ebp + 1]
les eax, [ecx]
ljmp 0:0xfcc8
adc dl, 0x99
mov dx, bp
mov edx, 0xf964dc51
mov esi, 0x64fe62a9
mov ebx, 0x91ed4f71
dec edi
in eax, dx
xchg ecx, eax
movsx ebx, bx
mov cx, ax
call 0x43d478
xchg ebx, eax
adc dword [ebp + 0x4b], edx
test eax, 0x4fe0e4c6
in eax, dx
pop esi
jp 0x43d482
loope 0x43d456
push ebx
inc ebx
push 0x1ce9e28a
add byte [eax], al
add cl, ch
loope 0x43d422
mov esi, 0x2550f6a7
not byte [eax + 0x25]
inc ecx
cmpsb byte [esi], byte es:[edi]
and edi, dword [ebx - 0x2bf7d38d]
test eax, 0xfbc99a7
mov word [esp + eax*4 - 0x4f], gs
or eax, dword [eax - 8]
xor ecx, 0x9dcf3ff3
pop ebp
sbb ch, 0x27
movsx ecx, dx
mov cl, 0xbf
mov ecx, 0x583b06f1
add ebp, 0xc229213e
and bh, 0x31
mov ecx, 0x13b235a9
movsx ebx, dx
xor ebx, 0x455675c1
dec byte [ebp + 0x3dd6de9d]
mov dl, 0x69
dec esi
mov cl, 0xb8
adc edx, 0x3e805361
sub ebp, 1
mov di, cx
adc ecx, 0xbe1abd71
mov edi, esi
mov ecx, 0x81664829
mov ebx, 0x7d28f893
cmp edi, 0x64fe5e70
jne 0x43d4bb
mov edx, 0x47091243
jmp 0x43d43b
Function at 0x4015d8
Capabilities:
Encode data using xor

Disassembly:
push 0x403adc
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp esp, esi
mov byte [0x19c6f6a6], al
inc ebp
mov bl, byte [edi - 0x10]
inc esi
fst dword [eax + 0xb56a]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0xccb3a4b9
xor dword [eax], eax
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
push cs
adc eax, 0x3cd07fbb
test al, 0xfe
dec ebp
xchg edx, eax
pop eax
sbb byte [edi + 0x768d4309], 0xcd
invalid
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x15c
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
mov ebx, dword [esp + 0x16c]
push esi
push edi
push 0x40
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0x44
call fcn.00401410
mov ecx, 3
mov word [esp + 0x48], cx
mov ecx, 0xc
mov esi, str.chrome.exe___apphttp:__www.1card1.cn_Login.aspx
lea edi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
push 0xd3
lea edx, [esp + 0xa1]
push 0
push edx
mov dword [esp + 0x50], 1
movsb byte es:[edi], byte [esi]
call fcn.00401410
mov eax, ebx
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401073
sub eax, edx
cmp eax, 1
jbe 0x401098
push ebx
lea eax, [esp + 0x64]
push eax
mov ecx, eax
push str._s__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x80]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call fcn.00401368
pop edi
pop esi
pop ebx

Function at 0x401400
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x40140a
repz ret
jmp fcn.00402a8d
Function at 0x404167
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004016ad
and dword [ebp - 4], 0
cmp dword [0x40b5cc], 0
mov ebx, eax
jne 0x404218
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4042c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4042c9
push eax
call fcn.0040163b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b5cc], eax
call esi
push eax
call fcn.0040163b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b5d0], eax
call esi
push eax
call fcn.0040163b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b5d4], eax
call esi
push eax
call fcn.0040163b
pop ecx
mov dword [0x40b5dc], eax
test eax, eax
je 0x404218
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040163b
pop ecx
mov dword [0x40b5d8], eax
mov eax, dword [0x40b5d8]
cmp eax, ebx
je 0x404270
cmp dword [0x40b5dc], ebx
je 0x404270
push eax
call fcn.004016b6
push dword [0x40b5dc]
mov esi, eax
call fcn.004016b6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404270
test edi, edi
je 0x404270
call esi
test eax, eax
je 0x404267
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404267
test byte [ebp - 0xc], 1
jne 0x404270
or dword [ebp + 0x10], 0x200000
jmp 0x4042a9
mov eax, dword [0x40b5d0]
cmp eax, ebx
je 0x4042a9
push eax
call fcn.004016b6
pop ecx
test eax, eax
je 0x4042a9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4042a9
mov eax, dword [0x40b5d4]
cmp eax, ebx
je 0x4042a9
push eax
call fcn.004016b6
pop ecx
test eax, eax
je 0x4042a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b5cc]
call fcn.004016b6
pop ecx
test eax, eax
je 0x4042c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4042cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403190
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4031cc
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4031ec
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040552c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4041b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x50f020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40424c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40422c
xor eax, eax
push ebp
push 0x404225
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404268
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40422c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x50f020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x50f020], ax
mov esp, ebp
pop ebp
ret

Function at 0x405068
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x59c04c], 0
je 0x4050c9
cmp word [0x59c220], 0xd7b2
jne 0x405091
cmp dword [0x59c228], 0
jbe 0x405091
mov eax, 0x59c21c
call dword [0x59c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4050f0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x50f02c], 0
jne 0x4050e5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x50f034], 0
je 0x405266
mov edx, esi
mov eax, ebx
call dword [0x50f034]
jmp 0x405275
mov eax, 8
call fcn.00402f88
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x59c04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405208
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x406b84
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406db4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406c07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406db4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406c07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406dd0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406c90
xor eax, eax
push ebp
push 0x406c89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004069c0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406c6e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406df0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406c6e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c90
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406daa
cmp byte [ebp - 0xd], 0
jne 0x406cd7
cmp byte [ebp - 0x12], 0
je 0x406daa
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406cf0
dec ebx
cmp byte [ebx], 0x2e
je 0x406cff
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406cef
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406daa
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406d3c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406daa
cmp byte [ebp - 0xd], 0
je 0x406daa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406daa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409abc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409b0e
test eax, edx
je 0x409b11
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409ad1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x409af7
add ecx, 4
js 0x409ae7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x409af4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409b1d
test edx, edx
jne 0x409ac4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40a89c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040574c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a8b5
test al, 0x10
je 0x40a8b9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a8c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040574c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a8d9
test al, 0x10
jne 0x40a8dd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40aa84
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040574c
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x40aa98
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0040574c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40aaba
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40e12c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e165
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004053ac
jmp 0x40e16e
mov eax, ebx
mov edx, esi
call fcn.00405310
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e178
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e19a
movzx eax, byte [esp]
jmp 0x40e19c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40e978
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40e7f0
mov eax, dword [0x59b820]
cmp byte [eax], 0
je 0x40e9f4
mov eax, dword [0x59b474]
call fcn.004037bc
call fcn.004030e4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040afe8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ea3c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ea2a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x59b3e8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x59e7f8]
call fcn.00406968
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40f2f4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f3ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405354
lea eax, [ebp - 4]
call fcn.004057a4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40f3b4
mov eax, ebx
call fcn.00402f88
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40f3ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040574c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40f397
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40f3dc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40f397
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f3b4
mov eax, dword [ebp - 0x10]
call fcn.00402fa4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f3d1
lea eax, [ebp - 4]
call fcn.004052bc
ret

Function at 0x422ab0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004227ec
dec esi
jne 0x422ad2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret