joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488b2a
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
mov esi, eax
push str.Microsoft_WinInet_
push dword [esi + 8]
call edi
pop ecx
pop ecx
test eax, eax
je 0x488bad
mov edx, dword [esi + 0x18]
cmp edx, 0x14
jb 0x488cd7
mov eax, dword [esi + 0x1c]
push 4
pop ecx
mov edi, 0x4a9a40
lea esi, [eax + 4]
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x488cd7
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0x4a
mov dword [ebp - 0x14], 0x4aa240
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x488cc4
push str.___CredentialBlob:
jmp 0x488c9c
push str.AppSense_DataNow_
push dword [esi + 8]
call edi
pop ecx
pop ecx
test eax, eax
je 0x488cd7
push str._Ivanti_FileDirector_credential_blob__n
call fcn.00409709
cmp dword [esi + 0x18], 0x14
pop ecx
jb 0x488cd7
mov ebx, dword [esi + 0x1c]
push 0xc
mov edi, ebx
mov esi, str.AppN_DN_Win
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x488cd7
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
xor esi, esi
cmp dword [ebx + 0xc], esi
je 0x488c64
push str.Decrypting_additional_blob_n
call fcn.00409709
mov eax, dword [ebx + 0xc]
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [ebx + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
call edi
test eax, eax
je 0x488c51
push str.___CredentialBlob:
call fcn.00409709
push dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040edaf
push 0x49ed98
call fcn.00409709
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x488c64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
cmp dword [ebx + 0x10], esi
je 0x488cd7
push str.Decrypting_additional_blob_n
call fcn.00409709
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0xc]
pop ecx
lea eax, [ebx + eax + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
call edi
test eax, eax
je 0x488cc4
push str.___UnkBlob_______:
call fcn.00409709
push dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040edaf
push 0x49ed98
call fcn.00409709
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x488cd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48f43b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x48f4c1
cmp dword [ebp + 0xc], 0
push esi
jle 0x48f4ac
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x48f4a5
push 5
push str._HTC:
push dword [edi + esi*4]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x48f482
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x48f463
jmp 0x48f4a5
mov eax, dword [edi + esi*4]
push 0xa
add eax, 0xa
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0048f4d7
add esp, 0x14
test esi, esi
jne 0x48f4b7
push str.__No_shared_memory__no_SSO_enabled___n
jmp 0x48f4b1
push str.ERROR_Citrix_SSO_Program_args___No_command_module_
call fcn.00409709
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
jmp 0x48f4d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_Citrix_SSO_Program_args___CommandLineToArgvW__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
pop edi
pop ebp
ret
Function at 0x48f4d7
Capabilities:
Encode data using xor
Encrypt data using dpapi
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x48f5e7
push edi
push 0x61c
push esi
push esi
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, esi
je 0x48f5c8
push ebx
push 0x610
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x48f5bc
push 1
lea esi, [edi + 0xc]
push 0x610
mov ecx, 0x184
mov edi, ebx
push ebx
rep movsd dword es:[edi], dword [esi]
call sub.ADVAPI32.dll_SystemFunction041
test eax, eax
jl 0x48f5a8
mov eax, dword [ebx + 0x400]
xor edi, edi
xor cl, cl
mov dword [ebp - 8], eax
lea esi, [ebx + 0x404]
test eax, eax
jbe 0x48f584
mov al, byte [edi + esi]
mov dl, al
xor dl, cl
xor dl, 0x43
mov byte [edi + esi], dl
inc edi
mov cl, al
cmp edi, dword [ebp - 8]
jb 0x48f56f
push dword [ebx + 0x604]
lea eax, [ebx + 0x200]
push esi
push dword [ebx + 0x400]
push eax
push ebx
push str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
call fcn.00409709
add esp, 0x18
jmp 0x48f5b5
push eax
push str.ERROR_Citrix_SSO_Program_FileMapping___RtlDecryptMemory:_0x_08x_n
call fcn.00409709
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop ebx
jmp 0x48f5db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x48f5fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x4942e6
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push dword [ebp + 8]
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0xc], eax
cmp eax, esi
je 0x49445d
cmp eax, 0xffffffff
je 0x49445d
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x49443e
push 0x10000000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 8], eax
cmp eax, esi
je 0x494451
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp eax, esi
mov dword [esp + 0x20], esi
jl 0x494432
mov ecx, dword [esp + 0x18]
jg 0x494374
cmp ecx, esi
jbe 0x494432
jmp 0x494374
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
add edi, 0x10000000
mov esi, edx
adc esi, 0
cmp esi, eax
jg 0x49439c
jl 0x49438d
cmp edi, ecx
jae 0x49439c
and dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0x10000000
jmp 0x4943aa
sub ecx, dword [esp + 0x20]
sbb eax, edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
push 0
push 0
push edx
push dword [esp + 0x2c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4943ff
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x30]
push dword [esp + 0x14]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4943f1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
call fcn.0049425a
add dword [esp + 0x10], eax
jmp 0x494412
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_sekurlsa_sk_search_file___ReadFile__0x_08x__n
jmp 0x49440b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_sekurlsa_sk_search_file___SetFilePointerEx__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [esp + 0x1c]
mov edx, esi
cmp edx, eax
mov dword [esp + 0x20], edi
jl 0x494370
jg 0x494432
mov ecx, dword [esp + 0x18]
cmp edi, ecx
jb 0x494374
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x494451
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_sekurlsa_sk_search_file___GetFileSizeEx__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x494470
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_sekurlsa_sk_search_file___CreateFile__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49c0ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x49c0e9
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.00497092
add esp, 0x14
jmp 0x49c1c7
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x49c1c7
test al, 0x40
jne 0x49c1c7
test al, 2
je 0x49c10b
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x49c1c7
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x49c0cb
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x49c1b7
cmp eax, 0xffffffff
je 0x49c1b7
test byte [esi + 0xc], 0x82
jne 0x49c18c
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x49c177
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x49c177
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x49c17c
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x49c18c
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x49c1aa
mov eax, dword [esi + 0xc]
test al, 8
je 0x49c1aa
test eax, 0x400
jne 0x49c1aa
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x49c1ca
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x49da71
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x49daa0
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.00497092
add esp, 0x14
jmp 0x49db8a
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x49db8a
test al, 0x40
jne 0x49db8a
test al, 2
je 0x49dac2
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x49db8a
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x49da82
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x49db7a
cmp eax, 1
je 0x49db7a
cmp eax, 0xffffffff
je 0x49db7a
test byte [esi + 0xc], 0x82
jne 0x49db4c
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x49db37
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x49db37
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x49db3c
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x49db4c
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x49db6a
mov eax, dword [esi + 0xc]
test al, 8
je 0x49db6a
test eax, 0x400
jne 0x49db6a
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x49db8f
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x438cc9
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ebx
add esi, 0xb6d8d84c
or esi, esi
inc esi
call fcn.00438d06
mov esi, 0x6993a41a
sub ecx, esi
xor dword [edi], ebx
sub esi, ecx
inc edi
and esi, ecx
cmp edi, edx
jne fcn.00438cc9
sub esi, 0x664afd46
add ecx, esi
push 0x5851d61f
pop ecx
ret
Function at 0x408244
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040863c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4083d0
test edi, edi
je 0x4083d0
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408307
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4082e2
cmp edi, 0xffffffff
je 0x4082a3
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4082a3
mov byte [esp], 0
jmp 0x4083d0
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4082e2
test ebx, ebx
jne 0x4082d8
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402770
test eax, eax
jne 0x4082d8
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4083d0
call 0x408760
dec ebp
test ebp, ebp
jg 0x408288
cmp edi, 0xffffffff
je 0x408307
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408305
mov byte [esp], 0
jmp 0x4083d0
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408252
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x408307
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408440
mov edx, eax
mov ebx, dword [0x55c8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40836e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40836c
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40836e
xor edi, edi
cmp byte [esp], 0
je 0x408397
mov ebx, dword [esi]
test bl, 1
jne 0x4083b0
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x408374
mov byte [esp + 1], 1
jmp 0x4083b0
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402770
cmp ebx, eax
jne 0x408397
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408321
cmp byte [esp], 0
je 0x4083d0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409160
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x55c058], 0
je 0x4091c7
cmp word [0x55c344], 0xd7b2
jne 0x409189
cmp dword [0x55c34c], 0
jbe 0x409189
mov eax, 0x55c340
call dword [0x55c35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4091f4
call fcn.00409fac
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x556032], 0
jne 0x4091e3
push 0
push 0x5569f2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x409384
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x556034], 0
je 0x4093af
mov edx, edi
mov eax, esi
call dword [0x556034]
mov ebx, eax
jmp 0x4093c0
mov eax, 8
call fcn.00404554
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x55c059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40934c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x4093f5
mov edx, 8
mov eax, ebx
call fcn.00404570
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40bd08
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40be6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004094c8
cmp si, word [0x556a30]
jb 0x40bda0
cmp si, word [0x556c30]
ja 0x40bda0
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40bda0
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x556a30]
jae 0x40bd7a
mov edi, ebx
dec edi
jmp 0x40bd9b
cmp si, word [ebx*8 + 0x556a30]
jbe 0x40bd8a
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40bd9b
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x556a34]
call fcn.0040bc18
jmp 0x40bda0
cmp edi, dword [ebp - 8]
jae 0x40bd64
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40be4f
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40be4f
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a330
push dword [ebp - 0x160]
push 0x40be88
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a330
push dword [ebp - 0x164]
push 0x40be98
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a330
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040a568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be74
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409528
ret
Function at 0x40c020
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c123
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x55eb88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x55eba0]
jne 0x40c06c
mov eax, esi
mov edx, 0x55eba2
mov ecx, 0x55
call fcn.0040a330
push 0x55eb88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40c10d
push 0x55eb88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.004094c8
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c0db
cmp byte [0x55eb84], 0
je 0x40c0a0
mov edx, esi
mov eax, ebx
call fcn.0040bf04
jmp 0x40c0db
mov edx, esi
mov eax, ebx
call fcn.0040bd08
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40c0db
cmp dword [esi], 0
je 0x40c0c4
mov eax, esi
mov edx, 0x40c13c
call fcn.0040a488
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040bd08
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a488
push 0x55eb88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x55eba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.0040a28c
push eax
push 0x55eba2
call sub.kernel32.dll_lstrcpynW
push 0x55eb88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c12a
lea eax, [ebp - 4]
call fcn.004094c8
ret
Function at 0x421ea8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov byte [esp], 0
mov eax, ebp
test eax, eax
je 0x421ec0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x421ec8
mov al, 1
jmp 0x421ee5
movzx esi, word [ebp]
mov eax, esi
call fcn.004128a8
test al, al
jne 0x421ee1
cmp si, 0x5f
je 0x421ee1
xor eax, eax
jmp 0x421ee3
mov al, 1
xor al, 1
test al, al
jne 0x421f75
test bl, bl
je 0x421f35
mov eax, ebp
test eax, eax
je 0x421efc
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x421f71
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.00412934
test al, al
jne 0x421f29
cmp di, 0x5f
je 0x421f29
cmp di, 0x2e
je 0x421f29
xor eax, eax
jmp 0x421f2b
mov al, 1
test al, al
je 0x421f75
inc esi
dec ebx
jne 0x421f09
jmp 0x421f71
mov eax, ebp
test eax, eax
je 0x421f40
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x421f71
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.00412934
test al, al
jne 0x421f67
cmp di, 0x5f
je 0x421f67
xor eax, eax
jmp 0x421f69
mov al, 1
test al, al
je 0x421f75
inc esi
dec ebx
jne 0x421f4d
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x422a38
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x422b6c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ebx, byte [0x422b7c]
mov dl, 1
mov eax, esi
call fcn.00422d00
test al, al
jne 0x422a89
mov dl, 1
mov eax, esi
call fcn.00422c68
test al, al
je 0x422b1f
lea edx, [ebp - 0x424]
mov eax, esi
call fcn.00422f7c
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 4]
call fcn.004290cc
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a28c
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x422b1a
test byte [ebp - 0xc], 1
je 0x422ae5
or bl, 1
test byte [ebp - 0xc], 2
je 0x422aee
or bl, 2
test byte [ebp - 0xc], 0x80
je 0x422af7
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x422b0b
dec eax
je 0x422b10
dec eax
je 0x422b15
dec eax
jne 0x422b46
or bl, 0x10
jmp 0x422b46
or bl, 4
jmp 0x422b46
or bl, 8
jmp 0x422b46
call fcn.00429914
lea edx, [ebp - 0x428]
mov eax, dword [0x55b1f8]
call fcn.0040d230
mov ecx, dword [ebp - 0x428]
mov dl, 1
mov eax, dword [0x41cab8]
call fcn.00427bf8
call fcn.00408bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422b73
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00409528
lea eax, [ebp - 4]
call fcn.004094c8
ret