joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100185b9
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
push esi
push edi
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0xc], eax
mov esi, ecx
cmp eax, edi
je 0x1001865c
dec dword [esp + 0xc]
cmp dword [esp + 0x74], edi
jne 0x1001866d
mov ecx, dword [esp + 0x6c]
mov al, byte [esi]
mov byte [esp + ecx + 0x2c], al
inc dword [esp + 0x6c]
add dword [esp + 0x24], 8
jne 0x10018639
inc dword [esp + 0x28]
jne 0x10018639
mov dword [esp + 0x74], 1
cmp dword [esp + 0x6c], 0x40
jne 0x10018649
lea eax, [esp + 0x10]
call fcn.1001837d
inc esi
cmp dword [esp + 0xc], edi
jne 0x1001860c
cmp dword [esp + 0x74], edi
jne 0x1001866d
cmp dword [esp + 0x70], edi
jne 0x1001866d
lea eax, [esp + 0x10]
call fcn.10018535
mov dword [esp + 0x70], 1
lea ecx, [esp + 0x11]
lea esi, [esp + 0x10]
sub ecx, ebx
lea eax, [ebx + 2]
sub esi, ebx
mov dl, byte [ecx + eax]
mov byte [eax - 2], dl
mov dl, byte [esi + eax]
mov byte [eax - 1], dl
mov dl, byte [esp + edi*4 + 0x11]
mov byte [eax], dl
mov dl, byte [esp + edi*4 + 0x10]
mov byte [eax + 1], dl
inc edi
add eax, 4
cmp edi, 5
jb 0x1001867c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100186a4
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 4]
push eax
push 0x10020668
push 1
push esi
push 0x10020738
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1001872c
push edi
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
lea edi, [ebp - 8]
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push ecx
call dword [edx + 0xc]
pop edi
test eax, eax
js 0x1001872c
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1001872c
push 8
call fcn.10010a45
pop ecx
cmp eax, esi
jne 0x1001874a
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x10018739
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x10018746
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x10018755
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
pop esi
leave
ret
Function at 0x1001882d
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push str.ROOTCIMV2
xor esi, esi
call fcn.100186a4
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x10018894
mov edi, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push str.Caption
push str.SELECT__FROM_Win32_OperatingSystem
call fcn.10018784
add esp, 0xc
test eax, eax
je 0x1001888a
push dword [ebp - 0x10]
call fcn.10012fb9
mov esi, eax
pop ecx
test esi, esi
je 0x10018880
push 0x10020c44
push esi
call dword [0x1002cd78]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 4]
call fcn.10018758
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x10018903
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push str.ROOTCIMV2
xor esi, esi
call fcn.100186a4
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x1001896a
mov edi, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push str.Name
push str.SELECT__FROM_Win32_Processor
call fcn.10018784
add esp, 0xc
test eax, eax
je 0x10018960
push dword [ebp - 0x10]
call fcn.10012fb9
mov esi, eax
pop ecx
test esi, esi
je 0x10018956
push 0x10020c44
push esi
call dword [0x1002cd78]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 4]
call fcn.10018758
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x1001deec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
lea ebx, [edx + eax - 0x21524111]
push esi
mov eax, ebx
push edi
mov esi, ebx
mov dword [ebp - 4], eax
cmp edx, 0xc
jbe switch.0x1001dfde
lea eax, [edx - 0xd]
push 0xc
xor edx, edx
pop edi
div edi
inc eax
mov dword [ebp - 8], eax
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
movzx edi, byte [ecx + 4]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
add edi, esi
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 0xa]
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 0xb]
movzx esi, byte [ecx + 3]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, ebx
movzx ebx, byte [ecx + 2]
shl esi, 8
add esi, ebx
movzx ebx, byte [ecx + 1]
shl esi, 8
add esi, ebx
movzx ebx, byte [ecx]
shl esi, 8
add esi, ebx
shl eax, 8
add eax, edx
sub esi, eax
add esi, dword [ebp - 4]
mov edx, eax
rol edx, 4
xor edx, esi
add eax, edi
sub edi, edx
mov esi, edx
rol esi, 6
xor esi, edi
add edx, eax
sub eax, esi
mov edi, esi
add esi, edx
rol edi, 8
xor edi, eax
sub edx, edi
mov eax, edi
rol eax, 0x10
xor eax, edx
add edi, esi
sub esi, eax
mov edx, eax
ror edx, 0xd
xor esi, edx
mov edx, dword [ebp + 8]
add eax, edi
mov ebx, esi
sub edi, esi
rol ebx, 4
sub edx, 0xc
xor ebx, edi
add esi, eax
add ecx, 0xc
dec dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edx
jne 0x1001df1c
cmp edx, 0xc
ja 0x1001e047
jmp dword [edx*4 + 0x1001e098]
movzx edx, byte [ecx + 0xb]
shl edx, 0x18
add ebx, edx
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add ebx, edx
movzx edx, byte [ecx + 9]
shl edx, 8
add ebx, edx
movzx edx, byte [ecx + 8]
add ebx, edx
movzx edx, byte [ecx + 7]
shl edx, 0x18
add esi, edx
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx edx, byte [ecx + 5]
shl edx, 8
add esi, edx
movzx edx, byte [ecx + 4]
add esi, edx
movzx edx, byte [ecx + 3]
shl edx, 0x18
add eax, edx
movzx edx, byte [ecx + 2]
shl edx, 0x10
add eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
add eax, edx
movzx ecx, byte [ecx]
add eax, ecx
xor ebx, esi
mov ecx, esi
rol ecx, 0xe
sub ebx, ecx
mov edx, ebx
rol edx, 0xb
mov ecx, ebx
xor ecx, eax
sub ecx, edx
xor esi, ecx
mov eax, ecx
ror eax, 7
sub esi, eax
xor ebx, esi
mov eax, esi
rol eax, 0x10
sub ebx, eax
mov eax, ebx
mov edi, eax
mov edx, eax
xor edx, ecx
rol edi, 4
sub edx, edi
mov ecx, edx
rol ecx, 0xe
xor esi, edx
sub esi, ecx
mov ecx, esi
ror ecx, 8
xor eax, esi
sub eax, ecx
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x1001e08c
Function at 0x1001edb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x1001edd5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x1001eded
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x1001ee1c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x1001ee5e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x1001ef32
sub edx, 0x10000
js 0x1001ef32
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x1001ee44
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x1001ee44
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x1001eeb5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x1001eeb2
add edx, 8
jne 0x1001ee99
jmp 0x1001ef23
add edx, 4
test eax, 0xffff
jne 0x1001eec2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x1001ef23
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x1001eef6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x1001ee44
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x1001ef32
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x1001ee44
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x1001ef43
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406c3f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x406c60
jl 0x406c57
test edi, edi
jne 0x406c60
xor eax, eax
xor edx, edx
jmp 0x406d21
cmp dword [ebx + 0x38], 0
je 0x406c75
push eax
push edi
push dword [ebp + 8]
call fcn.00406d27
jmp 0x406d21
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x406cbc
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x406cbc
cmp eax, edi
jb 0x406c96
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00408e90
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x406cc2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x406d16
mov ecx, ebx
call fcn.004064ec
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x406d01
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040cf6a
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x406d16
jmp 0x406cd4
test edx, edx
je 0x406d16
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040cf6a
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x406e16
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x406e38
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406efb
jmp 0x406ef6
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x406e5e
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x406e63
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x406ec3
jg 0x406e78
test esi, esi
je 0x406ec3
test ecx, ecx
jl 0x406ebe
jg 0x406e82
test eax, eax
je 0x406ebe
cmp edi, ecx
jg 0x406e94
jl 0x406e8c
cmp esi, eax
jae 0x406e94
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00408e90
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x406ec6
mov ecx, dword [ebp + 8]
jmp 0x406ed0
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x406eea
jg 0x406ed0
test esi, esi
je 0x406eea
cmp dword [ebx + 0x4c], 0
je 0x406eea
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040d5d6
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x408266
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4082a5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4082a5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4082a5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4082a5
cmp dword [ecx + 0x74], 0xe
jbe 0x4082a5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x413a0c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413882

Function at 0x41e4a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e4cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e4cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406804
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406940
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405dc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b1050], 0
je 0x405e29
cmp word [0x4b132c], 0xd7b2
jne 0x405df1
cmp dword [0x4b1334], 0
jbe 0x405df1
mov eax, 0x4b1328
call dword [0x4b1344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ae030], 0
jne 0x405e45
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405fb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4ae034], 0
je 0x405fda
mov edx, esi
mov eax, ebx
call dword [0x4ae034]
jmp 0x405fe9
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4b1051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405f7c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4085cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408733
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406804
cmp si, word [0x4ae7dc]
jb 0x408666
cmp si, word [0x4ae9dc]
ja 0x408666
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408666
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4ae7dc]
jae 0x408640
mov edi, ebx
dec edi
jmp 0x408661
cmp si, word [ebx*8 + 0x4ae7dc]
jbe 0x408650
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408661
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4ae7e0]
call fcn.004084dc
jmp 0x408666
cmp edi, dword [ebp - 0xc]
jae 0x40862a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408715
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408715
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004069ec
push dword [ebp - 0x164]
push 0x408750
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.004069ec
push dword [ebp - 0x168]
push 0x408760
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004069ec
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40873a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004067fc
ret
Function at 0x4088ec
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4089f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b3b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4b3b70]
jne 0x408938
mov eax, esi
mov edx, 0x4b3b74
mov ecx, 0x55
call fcn.004069ec
push 0x4b3b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4089db
push 0x4b3b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406804
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4089a9
cmp byte [0x4b3b54], 0
je 0x40896e
mov edx, esi
mov eax, ebx
call fcn.004087cc
jmp 0x4089a9
mov edx, esi
mov eax, ebx
call fcn.004085cc
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4089a9
cmp dword [esi], 0
je 0x408992
mov eax, esi
mov edx, 0x408a0c
call fcn.00406c00
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004085cc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c00
push 0x4b3b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4b3b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406890
push eax
push 0x4b3b74
call sub.kernel32.dll_lstrcpynW
push 0x4b3b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4089f8
lea eax, [ebp - 4]
call fcn.004067f4
ret
Function at 0x4090e0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.004067ec
mov eax, dword [ebp - 0x21c]
call fcn.004067ec
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x40927f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406804
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00406890
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409180
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x409192
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x40917d
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x40924b
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x4091bb
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408c30
cmp dword [ebp - 0x220], 0
je 0x4091f3
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00408fd4
pop ecx
mov ebx, eax
jmp 0x40924b
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.004088ec
mov eax, dword [ebp - 0x224]
call fcn.00408fd4
pop ecx
mov ebx, eax
test bl, bl
jne 0x40923e
cmp byte [0x4b3b54], 0
jne 0x40923e
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.004088ec
mov eax, dword [ebp - 0x228]
call fcn.00408fd4
pop ecx
mov ebx, eax
test bl, bl
jne 0x40924b
push ebp
call fcn.00409084
pop ecx
mov ebx, eax
test bl, bl
je 0x409261
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004069ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409286
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.004067fc
ret

Function at 0x4099f8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x40c900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x4b3c4c
push 0xa
push 0x40c994
mov eax, dword [0x4b3c3c]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40c924
call fcn.0041742c
push ebx
mov eax, dword [0x4b3c3c]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40c93b
call fcn.0041742c
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40c94d
call fcn.0041742c
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x4b3c50], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x4b3c54], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x4b3c58], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x4b3c5c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x4b3c60], ecx
add edx, dword [eax + 0x14]
mov dword [0x4b3c64], edx
pop esi
pop ebx
ret

Function at 0x410244
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4102ed
test eax, edx
je 0x4102f0
push 0
push 0
cmp word [eax - 0xa], 2
je 0x41026d
push edx
mov edx, eax
mov eax, esp
call fcn.00406a08
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x410283
push eax
lea eax, [esp + 8]
call fcn.00406a08
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x410292
movzx eax, word [eax]
sub eax, ecx
jmp 0x4102b9
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4102d3
add ecx, 4
js 0x4102aa
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x4102d0
push eax
mov eax, ecx
mov edx, 2
call fcn.00406054
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4102b7
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4102b9
xor eax, eax
ret
test eax, eax
je 0x410300
test edx, edx
jne 0x410254
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4147ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x414825
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406940
jmp 0x41482e
mov eax, ebx
mov edx, esi
call fcn.00406804
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x414838
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41485a
movzx eax, word [esp]
jmp 0x41485c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret