joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f0b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x4303d8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x41f0f2
call edi
mov esi, eax
test esi, esi
je 0x41f0dc
mov eax, 1
jmp 0x41f0ed
call ebp
mov ebx, eax
test ebx, ebx
je 0x41f1ff
mov eax, 2
mov dword [0x4303d8], eax
cmp eax, 1
jne 0x41f192
test esi, esi
jne 0x41f10b
call edi
mov esi, eax
test esi, esi
je 0x41f1ff
cmp word [esi], 0
mov eax, esi
je 0x41f125
add eax, 2
cmp word [eax], 0
jne 0x41f113
add eax, 2
cmp word [eax], 0
jne 0x41f113
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x41f184
push edi
call fcn.00417f10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41f184
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x41f176
push ebx
call fcn.00417ea0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x41f1ff
test ebx, ebx
jne 0x41f1a3
call ebp
mov ebx, eax
test ebx, ebx
je 0x41f1ff
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x41f1bb
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41f1ab
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41f1ab
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00417f10
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x41f1dd
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x41f250
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x42e928
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x41f274
add eax, 8
inc ebp
cmp eax, 0x42e9b8
jb 0x41f265
cmp ecx, dword [ebp*8 + 0x42e928]
jne 0x41f41b
mov eax, dword [0x42ff14]
cmp eax, 1
je 0x41f3dd
test eax, eax
jne 0x41f2a0
cmp dword [0x42c064], 1
je 0x41f3dd
cmp ecx, 0xfc
je 0x41f41b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41f2db
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x41f324
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x4285f0
add ebx, ecx
push ebx
call fcn.00417da0
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4285d0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x42e92c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00420c80
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x431820]
test eax, eax
je 0x41f3ee
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x41f3f8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x42e92c]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x421170
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x43046c]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
test eax, eax
jne 0x4211b8
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x421198
mov eax, 1
jmp 0x4211b3
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x421289
mov eax, 2
mov dword [0x43046c], eax
cmp eax, 1
jne 0x4211d8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x42129b
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4211f3
mov ecx, dword [0x42ffa8]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test esi, esi
jne 0x421212
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00417f10
mov edi, eax
add esp, 4
test edi, edi
jne 0x421226
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x421280
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x421264
mov edx, dword [esp + 0x24]
push eax
push eax
push 0xffffffffffffffff
push edi
push 1
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x421280
push edi
call fcn.00417ea0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push edi
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jne 0x421290
push edi
call fcn.00417ea0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.00417ea0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4212a0
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x430470]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
test eax, eax
jne 0x4212e8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4212cc
mov eax, 1
jmp 0x4212e3
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x4213c8
mov eax, 2
mov dword [0x430470], eax
cmp eax, 2
jne 0x421308
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x4213da
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x421323
mov ecx, dword [0x42ffa8]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jne 0x421342
pop edi
pop esi
pop ebp
pop ebx
ret
lea edx, [edi + edi]
push edx
call fcn.00417f10
mov esi, eax
add esp, 4
test esi, esi
jne 0x421359
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4213bf
mov eax, dword [esp + 0x20]
push 0
test eax, eax
push 0
jne 0x4213a0
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x4213bf
push esi
call fcn.00417ea0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0x220
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x4213cf
push esi
call fcn.00417ea0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00417ea0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4216b0
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x42186e
push 0x3d
push edi
call fcn.00421b60
mov esi, eax
add esp, 8
test esi, esi
je 0x42186e
cmp edi, esi
je 0x42186e
mov dl, byte [esi + 1]
mov ecx, dword [0x42fecc]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x42fec8]
cmp eax, ecx
jne 0x421707
push eax
call fcn.00421940
add esp, 4
mov dword [0x42fec8], eax
test eax, eax
jne 0x421782
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x42172e
mov eax, dword [0x42fed0]
test eax, eax
je 0x42172e
call fcn.004210f0
test eax, eax
je 0x42177d
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x42173a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.00417f10
add esp, 4
mov dword [0x42fec8], eax
test eax, eax
je 0x42186e
mov dword [eax], 0
mov eax, dword [0x42fed0]
test eax, eax
jne 0x42177d
push 4
call fcn.00417f10
add esp, 4
mov dword [0x42fed0], eax
test eax, eax
je 0x42186e
mov dword [eax], 0
mov eax, dword [0x42fec8]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.004218c0
mov esi, eax
add esp, 8
test esi, esi
jl 0x42187f
cmp dword [ebx], 0
je 0x42187f
test ebp, ebp
je 0x421877
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.00417ea0
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x4217d9
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x4217c8
lea eax, [esi*4]
push eax
push ebx
call fcn.004219b0
add esp, 8
test eax, eax
je 0x4217f3
mov dword [0x42fec8], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x421866
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00417f10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x421866
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00417ea0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [ebx + esi*4], edi
jmp 0x4217f7
test ebp, ebp
jne 0x421866
test esi, esi
jge 0x421889
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.004219b0
add esp, 8
test eax, eax
je 0x42186e
mov dword [eax + esi*4], edi
mov dword [eax + esi*4 + 4], 0
mov dword [0x42fec8], eax
jmp 0x4217f7
Function at 0x4220e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x422249
mov dword [ebp - 8], 0x200
jo 0x422114
ja 0x422112
xchg ebp, ebp
je 0x422112
xchg ebx, ebx
nop
jmp 0x422117
jo 0x422109
adc dword [ebp + 0x6a51f04d], ecx
add byte [edx], ch
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x14], eax
add byte [edx], 0x89
inc ebp
in al, dx
jnp 0x422143
mov edx, edx
jmp 0x422151
nop
nop
ja 0x42214c
xchg ebp, ebp
je 0x42214c
nop
jnp 0x42213f
xchg eax, eax
sbb dword [ebx + 0xf00ec7d], eax
test edx, ecx
add byte [eax], al
add bh, al
test eax, ebp
std
invalid
cmp dword [ebp - 0x14], 0
jne 0x422225
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00422330
add esp, 0x10
mov dword [ebp - 0x14], eax
jmp 0x422192
mov ebx, ebx
js 0x422195
nop
jns 0x422195
jmp 0x42218b
jg 0x4221a0
nop
xchg ecx, ecx
js 0x4221a5
xchg ebp, ebp
jns 0x4221a5
ja 0x4221a2
jg 0x422197
arpl word [ebx + 0x7500ec7d], ax
js 0x422137
cmp dword [ebp - 0x14], 0
jne 0x422223
mov ecx, dword [ebp - 0x218]
mov byte [ebp + ecx - 0x31c], 0
js 0x4221c4
invalid
nop
xchg esi, esi
jg 0x4221c9
xchg esi, esi
jle 0x4221c9
je 0x4221c6
js 0x4221bb
fmul dword [ebp - 0x31b6b]
call dword [edx - 0x18]
mov eax, dword [eax]
add byte [eax], al
lea edx, [ebp - 0x31c]
push edx
call 0x422260
add esp, 4
and eax, 0xffff
test eax, eax
je 0x422223
jbe 0x4221e7
nop
nop
jmp 0x4221f5
je 0x4221f0
xchg edi, edi
ja 0x4221f0
xchg ebp, ebp
nop
jbe 0x4221e3
je 0x422207
xor ecx, dword [ebx - 0x3899f3bb]
add byte [ecx], al
add byte [edi + 9], bh
mov eax, dword [ebp + 0xc]
mov word [eax], 1
jg 0x422208
nop
xchg ebp, ebp
js 0x42220d
xchg edi, edi
jns 0x42220d
add eax, 0xf37f0077
ja 0x42220a
jg 0x4221ff
lea edi, [ecx + ecx - 0x70]
jl 0x422218
nop
nop
ja 0x422216
xchg ebx, ebx
nop
jmp 0x422221
je 0x42221c
xchg esi, esi
jl 0x42220f
ja 0x422233
xor ebp, ebx
jmp 0x422227
jmp 0x422249
jmp 0x422227
jmp 0x422249
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jl 0x42223b
nop
nop
ja 0x422239
xchg ebp, ebp
nop
jmp 0x422244
je 0x42223f
xchg eax, eax
jl 0x422232
ja 0x422256
fucompi st(1)
stosb byte es:[edi], al
invalid
jmp 0x4220f3
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
int3
Function at 0x422330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
jnp 0x42235e
mov ebx, ebx
nop
nop
nop
jmp 0x422369
ja 0x422364
xchg ebp, ebp
je 0x422364
jnp 0x422357
xchg edi, edi
xor al, byte [ebx + 0xf00fc7d]
test dword [ebx + 0x73000000], eax
or esi, dword [edi + eax - 0x79]
in eax, dx
cmp dword [ebp - 4], 0
jne 0x4223f6
jae 0x422380
je 0x42237e
xchg ebp, ebp
ja 0x42237e
xchg edi, edi
nop
jmp 0x422383
jae 0x422375
cmp ch, byte [eax + 0x30]
mov byte [0x43e80042], al
or al, 0
add byte [ebx + 0x458904c4], al
hlt
push 0x42a230
call fcn.00422fd0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4223ec
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jbe 0x4223cb
ja 0x4223cb
jnp 0x4223d0
mov ecx, dword [edi]
add byte [eax], al
add byte [edx + 0xd], bh
jp 0x4223d0
mov eax, eax
nop
nop
ja 0x4223cb
xchg eax, eax
js 0x4223bb
jns 0x4223bb
and byte [ebx - 0x17ad0bab], cl
invalid
mov edx, dword [ebp - 0xc]
push edx
call fcn.00417ea0
add esp, 4
jg 0x4223e7
nop
xchg edx, edx
js 0x4223ec
xchg ebx, ebx
jns 0x4223ec
ja 0x4223e9
jg 0x4223de
and eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x422409
je 0x422409
jbe 0x42240e
xchg byte [edi], cl
add byte [eax], al
add byte [eax - 0x78f48b70], dl
invalid
nop
nop
je 0x42240e
xchg ebx, ebx
ja 0x42240e
ja 0x422409
jae 0x4223f9
jb 0x4223f9
adc eax, 0x7770b70
jo 0x42241b
ja 0x422419
xchg edx, edx
je 0x422419
xchg ebx, ebx
nop
jmp 0x42241e
jo 0x422410
sub ecx, dword [ebx + 0x5e5ffc45]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, eax
dec eax
test edx, edx
jbe 0x4224fd
push edi
mov edi, dword [esp + 0x14]
sub edi, ecx
push esi
mov esi, dword [esp + 0xc]
inc eax
push ebp
push ebx
mov dword [esp + 0x1c], eax
mov eax, ecx
xor edx, edx
mov ebx, 0x7b
mov ebp, 0x7f
div ebx
xor eax, eax
mov al, byte [edx + esi]
xor edx, edx
mov ebx, eax
mov eax, ecx
div ebp
xor eax, eax
mov al, byte [edx + esi]
mov edx, ecx
xor ebx, eax
and edx, ebp
mov al, byte [ebx + 0x42a790]
mov bl, byte [edx + esi]
xor al, bl
mov bl, byte [ecx + edi]
xor bl, al
mov eax, dword [esp + 0x1c]
mov byte [ecx + edi], bl
inc ecx
dec eax
mov dword [esp + 0x1c], eax
jne 0x4224b2
pop ebx
pop ebp
pop esi
pop edi
mov eax, 0x3e9
ret
Function at 0x404d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x404d19
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp fcn.00404d40

Function at 0x406eb0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
sub esp, 0x20c
mov eax, dword [0x415060]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push edi
mov edi, dword [esp + 0x21c]
push 0x1fe
lea eax, [esp + 0x16]
push 0
push eax
mov dword [esp + 0x18], 0
mov word [esp + 0x1c], 0
call fcn.00408150
push esi
push edi
lea ecx, [esp + 0x24]
push str._s_s
push ecx
mov edx, 0x100
call fcn.00406da0
add esp, 0x1c
push 0x412438
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x406f53
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._nERROR:
call esi
push str.find_resource_failed_
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004080b5
add esp, 0x20c
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x406f95
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._nERROR:
call esi
push str.resource_is_empty_
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004080b5
add esp, 0x20c
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406fd3
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._nERROR:
call esi
push str.load_resource_failed_
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004080b5
add esp, 0x20c
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea edx, [esp + 8]
push edx
mov esi, eax
call fcn.00401c30
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.00401c80
add esp, 0xc
test eax, eax
je 0x40702c
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._nERROR:
call esi
push str.can_not_create_file
call esi
pop edi
mov eax, 0xb
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004080b5
add esp, 0x20c
ret
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00401d70
add esp, 0xc
test eax, eax
je 0x40706c
push str.can_not_open_write_file
call fcn.00406dc0
add esp, 4
pop edi
mov eax, 9
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004080b5
add esp, 0x20c
ret
lea ecx, [esp + 8]
push ecx
call fcn.00401cc0
mov ecx, dword [esp + 0x214]
add esp, 4
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004080b5
add esp, 0x20c
ret
Function at 0x408b50
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x1c
push 0x413990
call fcn.004098d8
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x408aaa
push 0x12
call fcn.00408a0a
pop ecx
mov eax, 0xff
jmp 0x408c1f
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x408ac5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x408aa0
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x408af7
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x416134], esi
mov dword [0x41613c], eax
mov dword [0x416140], ecx
mov dword [0x416144], edx
mov dword [0x416138], edi
call fcn.00408a2e
mov dword [ebp - 0x20], eax
push 1
call fcn.0040998c
pop ecx
test eax, eax
jne 0x408b3d
push 0x1c
call fcn.00408a0a
pop ecx
call fcn.0040a726
test eax, eax
jne 0x408b4e
push 0x10
call fcn.00408a0a
pop ecx
call fcn.0040cdad
and dword [ebp - 4], 0
call fcn.0040cb6d
test eax, eax
jge 0x408b68
push 0x1b
call fcn.004099e6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x419bc0], eax
call fcn.0040ca38
mov dword [0x415fc8], eax
call fcn.0040c97f
test eax, eax
jge 0x408b8e
push 8
call fcn.004099e6
pop ecx
call fcn.0040c70c
test eax, eax
jge 0x408b9f
push 9
call fcn.004099e6
pop ecx
push 1
call fcn.00409b02
pop ecx
test eax, eax
je 0x408bb2
push eax
call fcn.004099e6
pop ecx
mov eax, dword [0x416154]
mov dword [0x416158], eax
push eax
push dword [0x41614c]
push dword [0x416148]
call main
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x408be0
push eax
call fcn.00409c76
call fcn.00409c98
jmp 0x408c15
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.0040991d
ret
call fcn.0040cdf5
jmp 0x408a6f

Function at 0x409d02
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4151a0]
je 0x409d1d
inc edi
cmp edi, 0x17
jb 0x409d0e
sub edi, edi
pop ss
jae 0x81409e9d
push ebp
push 3
call 0xa340d700
cmp eax, 1
pop ecx
je 0x409e69
push 3
call fcn.0040d700
test eax, eax
pop ecx
jne 0x409d51
cmp dword [0x415070], 1
je 0x409e69
cmp ebx, 0xfc
je 0x409e9c
invalid
push 0xfffffffffffffff4
call dword [0x412006]
add byte [ebx + 0x55ee3be8], cl

Function at 0x409e70
Capabilities:
Write file on windows

Disassembly:
add byte [ebx + 0x55ee3be8], cl
and eax, 0x74fffd83
and byte [edx], ch
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4151a4]
push dword [esi]
call fcn.0040d610
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop eax
pop esi
pop ebx
pop ecx
ret