joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x110
mov ebx, dword [esp + 0x120]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x404607
cmp byte [ebx], 0
je 0x404472
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x4045f7
and eax, 0x10
jne 0x404490
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
xor eax, eax
add esp, 0x110
pop ebx
pop esi
pop edi
ret
push esi
push 0x104
push ebx
lea esi, [esp + 0xc]
push esi
call sub.msvcrt.dll__fullpath
mov ecx, esi
pop ebx
mov ebx, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4044a6
test edx, 0x8080
jne 0x4044cc
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebx
lea edx, [ecx + 0x132]
push edx
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4045e7
push ecx
push ecx
push esi
lea esi, [eax + 0x12c]
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
cmp byte [ebx + 0x12c], 0
je 0x404597
mov ecx, esi
mov edi, esi
nop
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x404510
test edx, 0x8080
jne 0x404536
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, edi
cmp byte [ecx + ebx + 0x12b], 0x2f
je 0x404597
mov ecx, esi
mov edi, esi
nop
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x404550
test edx, 0x8080
jne 0x404576
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, edi
cmp byte [ecx + ebx + 0x12b], 0x5c
je 0x404597
push edx
push edx
push 0x404420
push esi
call sub.msvcrt.dll_strcat
add esp, 0x10
push eax
push eax
push 0x404422
push esi
call sub.msvcrt.dll_strcat
add esp, 0x10
lea edx, [ebx + 0x14]
mov eax, ebx
mov dword [ebx + 0x124], 0xffffffff
mov dword [ebx + 0x128], 0
mov dword [ebx + 0x118], 0
mov word [ebx + 0x11c], 0
mov word [ebx + 0x11e], 0
mov dword [ebx + 0x120], edx
jmp 0x40447f
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x40447d
call sub.msvcrt.dll__errno
mov dword [eax], 2
jmp 0x40447d
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x40447d
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x16fa754d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2a4d3e49
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000716f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000720c
push ebx
push esi
call fcn.10007138
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100070cc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100071b9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000720b
push edi
push eax
call fcn.1000812a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100071d9
call fcn.10005c14
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000720a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100070cc
add esp, 0x20
test eax, eax
jne 0x100071f8
push edi
call fcn.10005c14
jmp 0x10007200
push ebx
call fcn.10005c14
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007479
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e4e8
push 0x1000e4e0
push str.FlsAlloc
push 0x1f
call fcn.10007395
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100074ad
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d108]
call esi
jmp 0x100074b3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100074f7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e4f8
push 0x1000e4f0
push str.FlsGetValue
push 0x21
call fcn.10007395
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000752e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d108]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007536
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e500
push 0x1000e4f8
push str.FlsSetValue
push 0x22
call fcn.10007395
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007570
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000d108]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cbf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cc1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cc1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422008]
jne 0x40100a
repz ret
jmp fcn.004016a1

Function at 0x406a84
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403de3
and dword [ebp - 4], 0
cmp dword [0x423de4], 0
mov ebx, eax
jne 0x406b35
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406be6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406be6
push eax
call fcn.00403d71
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423de4], eax
call esi
push eax
call fcn.00403d71
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423de8], eax
call esi
push eax
call fcn.00403d71
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423dec], eax
call esi
push eax
call fcn.00403d71
pop ecx
mov dword [0x423df4], eax
test eax, eax
je 0x406b35
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403d71
pop ecx
mov dword [0x423df0], eax
mov eax, dword [0x423df0]
cmp eax, ebx
je 0x406b8d
cmp dword [0x423df4], ebx
je 0x406b8d
push eax
call fcn.00403dec
push dword [0x423df4]
mov esi, eax
call fcn.00403dec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406b8d
test edi, edi
je 0x406b8d
call esi
test eax, eax
je 0x406b84
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406b84
test byte [ebp - 0xc], 1
jne 0x406b8d
or dword [ebp + 0x10], 0x200000
jmp 0x406bc6
mov eax, dword [0x423de8]
cmp eax, ebx
je 0x406bc6
push eax
call fcn.00403dec
pop ecx
test eax, eax
je 0x406bc6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406bc6
mov eax, dword [0x423dec]
cmp eax, ebx
je 0x406bc6
push eax
call fcn.00403dec
pop ecx
test eax, eax
je 0x406bc6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423de4]
call fcn.00403dec
pop ecx
test eax, eax
je 0x406be6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406be8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e2c0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x422008]
xor eax, esp
mov dword [esp + 0x800], eax
cmp dword [0x8098d4], 0x114e
mov eax, dword [esp + 0x808]
mov dword [0x809718], eax
jne 0x41e301
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret
Function at 0x41e3e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc04
mov eax, dword [0x422008]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x423000]
push ebx
mov ebx, dword [0x80971c]
push esi
mov esi, dword [0x8098d4]
push eax
call fcn.0041e2c0
add esp, 4
cmp dword [0x8098d4], 0x2f
jne 0x41e41f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
call fcn.0041e330
add esp, 4
cmp dword [0x8098d4], 0x568
pop esi
pop ebx
jne 0x41e457
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
lea edx, [esp + 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.00401000
add esp, 0xc04
ret
Function at 0x40afb6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0x108f4
pop ebx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
add ebx, 0x114df
and ebx, 0x6cf7
pop ebx
push esi
push ecx
add esp, 4
call 0x40afb6
add byte [edi + 0x50], cl
cmp ecx, dword [ecx + 0x45]
xor eax, 0x834e344d
les eax, [ebx + ebp*8]
add al, 0x37
inc edi
inc eax
cmp eax, dword [ecx + 0xcf1f6]
add byte [esi - 0x75], bl
test eax, ebp
invalid
Function at 0x40c67d
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0xce02
or ecx, 0xaded
sub ecx, 0x4cd1
pop ecx
push ebx
push edx
add esp, 4
sub ebx, 0x36bf
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x40c6cb
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x40c496
mov dword [ebp - 0x2a8], 0
Function at 0x425640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46f9b0
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004027c0
mov edi, eax
add esp, 4
test edi, edi
je 0x4256e0
push 1
mov dword [ebp - 4], 0
call fcn.00438306
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], 0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4347ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004347f5

Function at 0x434aa6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x477598]
sub edx, 1
jne 0x434aaf
pop ebp
ret
Function at 0x44d250
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47f9d0
push 0x47f9c8
push str.FlsAlloc
push 0x1e
call fcn.0044d11a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44d284
push dword [ebp + 8]
mov ecx, esi
call dword [0x473320]
call esi
jmp 0x44d28a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44d2ce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47f9e0
push 0x47f9d8
push str.FlsGetValue
push 0x20
call fcn.0044d11a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44d305
push dword [ebp + 8]
mov ecx, esi
call dword [0x473320]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x451509
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4515a6
push ebx
push esi
call fcn.004514d2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004501d6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x451553
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4515a5
push edi
push eax
call fcn.0044e27f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x451573
call fcn.0044ce3f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4515a4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004501d6
add esp, 0x20
test eax, eax
jne 0x451592
push edi
call fcn.0044ce3f
jmp 0x45159a
push ebx
call fcn.0044ce3f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x45a127
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x17f10c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181b520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov al, 1
push edi
lea ebx, [ebx]
movzx edx, al
mov byte [ebp + edx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [ebp + ecx - 0x204], al
inc ecx
neg dl
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x17f10e0
mov al, 1
mov ecx, 0x185f380
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x185f3a8
jl 0x17f1115
mov dword [0x185e780], 0x63
mov dword [0x186194c], 0
mov edx, 1
jmp 0x17f1160
movzx eax, byte [ebp + edx - 0x104]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [edx*4 + 0x185e780], eax
mov dword [eax*4 + 0x18617c0], edx
inc edx
cmp edx, 0x100
jl 0x17f1160
xor ecx, ecx
mov dl, byte [ecx + 0x185e780]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
movzx esi, al
movzx edx, dl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx + 0x18613c0], eax
ror eax, 8
mov dword [ecx + 0x1860fc0], eax
ror eax, 8
mov dword [ecx + 0x1860bc0], eax
ror eax, 8
mov dword [ecx + 0x18607c0], eax
mov al, byte [ecx + 0x18617c0]
test al, al
je 0x17f126f
movzx edx, al
movzx esi, byte [ebp + edx - 0x104]
movzx eax, byte [ebp - 0xf9]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [ebp + edx - 0x204]
mov dword [ebp - 0x208], eax
movzx eax, byte [ebp - 0xf7]
add eax, esi
cdq
idiv edi
movzx eax, byte [ebp - 0xfb]
add eax, esi
movzx ebx, byte [ebp + edx - 0x204]
cdq
idiv edi
movzx eax, byte [ebp - 0xf6]
add eax, esi
mov esi, 0xff
movzx edi, byte [ebp + edx - 0x204]
cdq
idiv esi
movzx eax, byte [ebp + edx - 0x204]
mov edx, dword [ebp - 0x208]
jmp 0x17f1277
xor edx, edx
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edx
mov dword [ecx + 0x18603c0], eax
ror eax, 8
mov dword [ecx + 0x185ffc0], eax
ror eax, 8
mov dword [ecx + 0x185ef80], eax
ror eax, 8
mov dword [ecx + 0x185eb80], eax
add ecx, 4
cmp ecx, 0x400
jl 0x17f11a2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x18013cb
mov esp, ebp
pop ebp
ret
Function at 0x40e5d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x592c58
push 0xa
push 0x40e668
mov eax, dword [0x592c40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40e5f8
call fcn.0041cae8
push ebx
mov eax, dword [0x592c40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40e60f
call fcn.0041cae8
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40e621
call fcn.0041cae8
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x592c5c], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x592c60], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x592c64], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x592c68], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x592c6c], ecx
add edx, dword [eax + 0x14]
mov dword [0x592c70], edx
pop esi
pop ebx
ret

Function at 0x4134cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x413575
test eax, edx
je 0x413578
push 0
push 0
cmp word [eax - 0xa], 2
je 0x4134f5
push edx
mov edx, eax
mov eax, esp
call fcn.00407628
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x41350b
push eax
lea eax, [esp + 8]
call fcn.00407628
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41351a
movzx eax, word [eax]
sub eax, ecx
jmp 0x413541
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41355b
add ecx, 4
js 0x413532
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x413558
push eax
mov eax, ecx
mov edx, 2
call fcn.004067e4
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41353f
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x413541
xor eax, eax
ret
test eax, eax
je 0x413588
test edx, edx
jne 0x4134dc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x414a88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00407488
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x414aa6
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x414ac7
cmp ebx, 3
je 0x414ac7
cmp ebx, 0x7b
je 0x414ac7
mov eax, esi
call fcn.00414a48
test al, al
jne 0x414acb
xor eax, eax
jmp 0x414acd
mov al, 1
pop esi
pop ebx
ret

Function at 0x419a30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x419a69
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00407538
jmp 0x419a72
mov eax, ebx
mov edx, esi
call fcn.004073fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419a7c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x419a9e
movzx eax, word [esp]
jmp 0x419aa0
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41a230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41a355
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041a040
mov esi, eax
mov eax, dword [0x58f37c]
cmp byte [eax], 0
je 0x41a2fd
mov eax, dword [0x58eec8]
call fcn.00404b0c
call fcn.0040440c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41a208]
call fcn.00409044
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41a370
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41a339
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x58ee20]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x592c40]
call fcn.0040924c
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a35c
lea eax, [ebp - 4]
mov edx, dword [0x41a208]
call fcn.00409164
ret
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x78352687
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x275b63b0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x6ce1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006ce140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006ce140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006ce140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006ce140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6cebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6cec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6e087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6cec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6cec52
xor eax, eax
pop esi
leave
ret 4