joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30b394
Capabilities:
Enumerate processes

Disassembly:
push edi
push esi
push ebp
sub esp, 0x128
mov edi, dword [esp + 0x13c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x30b433
lea edx, [esp]
push 0x128
push 0
push edx
call fcn.00311ff4
add esp, 0xc
mov dword [esp], 0x128
lea edx, [esp]
push edx
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x30b3f8
cmp esi, dword [esp + 8]
je 0x30b40f
lea edx, [esp]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x30b3e4
mov dword [edi], 0xe
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x128
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x138]
push ebp
mov dword [ecx], edx
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x128
pop ebp
pop esi
pop edi
ret
call fcn.003057f4
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
mov dword [edi], eax
add esp, 0x128
pop ebp
pop esi
pop edi
ret

Function at 0x30b44c
Capabilities:
Get session user name

Disassembly:
push edi
push esi
push ebp
sub esp, 0x108
mov esi, dword [esp + 0x118]
mov ebp, dword [esp + 0x11c]
mov eax, dword [esp + 0x124]
cmp eax, dword [ebp]
jae 0x30b49e
push eax
push 0x20
push esi
call fcn.00311ff4
add esp, 0xc
mov eax, dword [esp + 0x120]
mov dword [eax], 0x16
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
add esp, 0x108
pop ebp
pop esi
pop edi
ret
mov dword [esp], 0x101
lea edx, [esp + 4]
lea eax, [esp]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x30b55b
lea edi, [esp + 4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x30b4d6
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x30b4ca
mov dword [esp], eax
cmp eax, dword [ebp]
jbe 0x30b512
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x22
mov eax, dword [esp + 0x120]
lea edx, [esp + 4]
mov dword [eax], 0x81
push dword [ebp]
push edx
push esi
call fcn.00312070
add esp, 0xc
add esp, 0x108
pop ebp
pop esi
pop edi
ret
mov eax, dword [esp + 0x120]
mov dword [eax], 0
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0
lea eax, [esp + 4]
push dword [esp]
push eax
push esi
call fcn.00312070
mov eax, dword [esp + 0xc]
mov ebp, dword [ebp]
lea edx, [esi + eax]
sub ebp, eax
push ebp
push 0x20
push edx
call fcn.00311ff4
add esp, 0x18
add esp, 0x108
pop ebp
pop esi
pop edi
ret
call fcn.003057f4
push dword [ebp]
push 0x20
push esi
call fcn.00311ff4
add esp, 0xc
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x120]
mov eax, dword [eax]
mov dword [edx], eax
add esp, 0x108
pop ebp
pop esi
pop edi
ret
Function at 0x30c038
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
cmp eax, dword [esp + 0x28]
jbe 0x30c07b
mov eax, dword [esp + 0x24]
mov dword [eax], 0x16
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
mov eax, dword [esp + 0x2c]
push eax
push 0x20
push esi
call fcn.00311ff4
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x30c17e
mov edi, dword [edi]
test edi, edi
jbe 0x30c0bf
movsx edx, byte [ebx + edi - 1]
push edx
call dword [sym.imp.MSVCRT.dll_isspace]
pop ecx
test eax, eax
je 0x30c0bf
add edi, 0xffffffff
je 0x30c0bf
movsx edx, byte [ebx + edi - 1]
push edx
call dword [sym.imp.MSVCRT.dll_isspace]
pop ecx
test eax, eax
jne 0x30c0a9
push edi
push ebx
push ebp
call fcn.00312070
mov byte [edi + ebp], 0
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x30c153
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x30c0f1
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x30c0e5
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [edx], ebx
cmp ebx, ecx
jbe 0x30c11d
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov dword [eax], 0x22
mov dword [edx], 0x81
jmp 0x30c13c
mov edx, dword [esp + 0x2c]
lea ecx, [ebx + esi]
sub edx, ebx
push edx
push 0x20
push ecx
call fcn.00311ff4
add esp, 0xc
mov edx, dword [esp + 0x24]
mov dword [edx], 0
push ebx
push edi
push esi
call fcn.00312070
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov edx, dword [eax]
mov dword [ecx], edx
push dword [ebx]
push 0x20
push esi
call fcn.00311ff4
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [edx], eax
push dword [ecx]
push 0x20
push esi
call fcn.00311ff4
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x30c3e0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov esi, dword [esp + 0x18]
mov eax, 0x64
mov dword [esp], eax
push 0x65
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x30c533
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
test edi, edi
je 0x30c511
movsx edx, byte [edi]
cmp edx, 0x3d
jne 0x30c509
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x30c438
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x30c42c
lea edi, [eax + edi + 1]
movsx edx, byte [edi]
cmp edx, 0x3d
je 0x30c422
test edx, edx
je 0x30c4c3
push 0x3d
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x30c4f0
mov edx, dword [esp]
sub esi, edi
lea ebx, [esi + 1]
cmp ebx, edx
jbe 0x30c487
mov dword [esp], ebx
push ebp
call dword [sym.imp.MSVCRT.dll_free]
lea edx, [esi + 2]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x30c4dc
push ebx
push edi
push ebp
call fcn.00312070
mov byte [ebp + esi + 1], 0
push ebp
call dword [sym.imp.MSVCRT.dll__putenv]
add esp, 0x10
test eax, eax
je 0x30c406
mov esi, dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll__errno]
push ebp
mov edx, dword [eax]
mov dword [esi], edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, dword [esp + 0x18]
mov dword [esi], 0
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
mov dword [esi], eax
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, dword [esp + 0x18]
mov dword [esi], 0xe
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
movsx edx, byte [edi]
jmp 0x30c444
mov esi, dword [esp + 0x18]
call fcn.003057f4
call dword [sym.imp.MSVCRT.dll__errno]
push ebp
mov edx, dword [eax]
mov dword [esi], edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
mov dword [esi], eax
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x30c564
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push esi
sub esp, 0x44
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x54]
mov dword [esi], 0
mov eax, dword [eax]
cmp eax, 2
je 0x30c634
cmp eax, 5
je 0x30c625
cmp eax, 6
je 0x30c616
cmp eax, 4
je 0x30c607
cmp eax, 0x1e
je 0x30c5ed
cmp eax, 0x55
jne 0x30c5bb
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x50]
mov dword [edx], eax
add esp, 0x44
pop esi
ret
cmp eax, 0x56
jne 0x30c5d9
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x50]
mov dword [edx], eax
add esp, 0x44
pop esi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x16
mov dword [eax], edx
mov dword [esi], edx
add esp, 0x44
pop esi
ret
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x50]
mov dword [edx], eax
add esp, 0x44
pop esi
ret
mov eax, dword [esp + 0x50]
mov dword [eax], 0x800
add esp, 0x44
pop esi
ret
mov eax, dword [esp + 0x50]
mov dword [eax], 3
add esp, 0x44
pop esi
ret
mov eax, dword [esp + 0x50]
mov dword [eax], 0x14
add esp, 0x44
pop esi
ret
mov eax, dword [esp + 0x50]
mov dword [eax], 0x3e8
add esp, 0x44
pop esi
ret

Function at 0x30cc78
Capabilities:
Create directory

Disassembly:
push ebp
push ebx
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x30ccdc
push dword [ebp]
push dword [esp + 0x10]
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
push ebx
mov edx, dword [ebp]
mov byte [ebx + edx], 0
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 0x10
test eax, eax
jne 0x30ccc3
mov edx, dword [esp + 0x18]
mov dword [edx], 0
jmp 0x30ccd1
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
mov dword [ecx], edx
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop ebx
pop ebp
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [edx], eax
pop ebx
pop ebp
ret

Function at 0x30cd68
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
add eax, 1
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x30cdcc
push dword [ebp]
push dword [esp + 0x10]
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
push ebx
mov edx, dword [ebp]
mov byte [ebx + edx], 0
call dword [sym.imp.MSVCRT.dll__rmdir]
add esp, 0x10
test eax, eax
jne 0x30cdb3
mov edx, dword [esp + 0x14]
mov dword [edx], 0
jmp 0x30cdc1
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
mov dword [ecx], edx
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop ebx
pop ebp
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [edx], eax
pop ebx
pop ebp
ret
Function at 0x30cde0
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
add eax, 1
mov esi, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x30ce9b
mov edx, dword [esi]
add edx, 1
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x30ce80
push dword [edi]
push dword [esp + 0x18]
push ebp
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [edi]
mov byte [ebp + edx], 0
push dword [esi]
push dword [esp + 0x2c]
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
push ebx
push ebp
mov edx, dword [esi]
mov byte [ebx + edx], 0
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 0x20
test eax, eax
jne 0x30ce5c
mov edx, dword [esp + 0x24]
mov dword [edx], 0
jmp 0x30ce6a
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [esp + 0x24]
mov edx, dword [eax]
mov dword [ecx], edx
push ebp
call dword [sym.imp.MSVCRT.dll_free]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [esp + 0x24]
push ebp
mov edx, dword [eax]
mov dword [ecx], edx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [edx], eax
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x30dbc4
Capabilities:
Read file on windows

Disassembly:
push edi
mov ecx, dword [esp + 8]
test ecx, ecx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
je 0x30dc16
test edx, edx
je 0x30dc16
test eax, eax
je 0x30dc16
test edi, edi
je 0x30dc16
push dword [eax]
push edx
push dword [ecx]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x30dc06
mov eax, dword [esp + 0x18]
mov dword [eax], 0
pop edi
ret
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x18]
mov eax, dword [eax]
mov dword [edx], eax
pop edi
ret
mov eax, dword [esp + 0x18]
mov dword [eax], 0xffffffff
pop edi
ret
Function at 0x310250
Capabilities:
Enumerate files on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x144
mov ebx, dword [esp + 0x158]
test ebx, ebx
je 0x31041b
mov eax, dword [ebx]
cmp eax, 0x3e7
je 0x31028b
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x14
xor eax, eax
add esp, 0x144
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, dword [ebx + 4]
test eax, eax
je 0x31030b
lea eax, [esp + 4]
push eax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x3103c2
lea edi, [esp + 0x30]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x3102c2
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x3102b6
mov edx, dword [ebx + 0x14]
mov esi, eax
lea ebp, [esi + 1]
cmp ebp, dword [edx + 4]
jbe 0x3102f2
push dword [edx]
call dword [sym.imp.MSVCRT.dll_free]
add esi, 1
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 8
mov edx, dword [ebx + 0x14]
mov dword [edx], eax
mov eax, dword [ebx + 0x14]
mov dword [eax + 4], ebp
mov edx, dword [ebx + 0x14]
lea edi, [esp + 0x30]
mov esi, dword [edx]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x3102f8
jmp 0x3103b4
lea eax, [esp + 4]
push eax
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x310416
mov ebp, dword [ebx + 0x14]
test ebp, ebp
je 0x3103f8
lea edi, [esp + 0x30]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x310349
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x31033d
mov ecx, dword [ebp]
mov edi, eax
test ecx, ecx
je 0x3103d4
lea edx, [edi + 1]
cmp edx, dword [ebp + 4]
mov dword [esp], edx
jbe 0x310391
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add edi, 1
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 8
mov edx, dword [ebx + 0x14]
mov dword [edx], eax
mov ebp, dword [ebx + 0x14]
mov ecx, dword [ebp]
test ecx, ecx
je 0x31041b
mov edx, dword [esp]
mov dword [ebp + 4], edx
mov ebp, dword [ebx + 0x14]
lea edi, [esp + 0x30]
mov edx, 1
mov dword [ebx + 4], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 8], esi
mov esi, dword [ebp]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x3103a6
mov eax, dword [ebx + 0x14]
add esp, 0x144
pop ebx
pop ebp
pop esi
pop edi
ret
call fcn.003057f4
xor eax, eax
add esp, 0x144
pop ebx
pop ebp
pop esi
pop edi
ret
lea edx, [edi + 1]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov edx, dword [ebx + 0x14]
mov dword [edx], eax
mov edx, dword [ebx + 0x14]
mov ecx, dword [edx]
test ecx, ecx
je 0x31041b
add edi, 1
mov dword [edx + 4], edi
mov ebp, dword [ebx + 0x14]
jmp 0x310391
push 8
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebx + 0x14], eax
test eax, eax
je 0x31041b
mov dword [eax], 0
mov ebp, dword [ebx + 0x14]
jmp 0x31032f
call fcn.003057f4
xor eax, eax
add esp, 0x144
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x311014
Capabilities:
Get geographical location

Disassembly:
push esi
push ebx
sub esp, 0x80
xor eax, eax
mov esi, dword [esp + 0x8c]
mov ebx, dword [esp + 0x90]
mov dword [0x31c864], eax
mov dword [0x31c868], eax
lea edx, [esp]
push dword [esp + 0x98]
push esi
mov dword [0x31c86c], edx
call fcn.00311d14
mov dword [0x31c870], eax
push eax
push esi
push dword [0x31c86c]
call fcn.00312070
add esp, 0x14
mov eax, dword [0x31c86c]
add eax, dword [0x31c870]
mov byte [eax], 0
test ebx, ebx
jne 0x31107f
mov dword [0x31c874], 0
jmp 0x3110b8
push dword [esp + 0x9c]
push ebx
call fcn.00311d14
mov dword [0x31c874], eax
lea edx, [esp + 0x48]
mov dword [0x31c878], edx
lea ecx, [esp + 0x48]
push eax
push ebx
push ecx
call fcn.00312070
add esp, 0x14
mov eax, dword [0x31c878]
add eax, dword [0x31c874]
mov byte [eax], 0
push 1
push 0x311c24
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test eax, eax
je 0x311125
mov eax, dword [0x31c864]
test eax, eax
je 0x311117
mov eax, dword [0x31c868]
test eax, eax
je 0x311109
mov eax, dword [esp + 0x94]
test eax, eax
je 0x311134
mov eax, dword [esp + 0x94]
mov edx, dword [eax]
cmp edx, 0xffffffff
jne 0x3110fe
mov eax, dword [0x31c87c]
mov dword [0x31c8a4], eax
xor eax, eax
add esp, 0x80
pop ebx
pop esi
ret
mov eax, 0xfff0bdbf
add esp, 0x80
pop ebx
pop esi
ret
mov eax, 0xfff0bdc0
add esp, 0x80
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x80
pop ebx
pop esi
ret
lea eax, [esp + 0x40]
push 0x40
push eax
push 0x1004
push dword [0x31c87c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x31115f
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x80
pop ebx
pop esi
ret
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x311181
mov eax, 0xfff0bdbe
add esp, 0x80
pop ebx
pop esi
ret
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
jne 0x31119a
mov eax, 0xfff0bdbe
add esp, 0x80
pop ebx
pop esi
ret
push ebx
call dword [sym.imp.MSVCRT.dll__setmbcp]
mov edx, dword [0x31c87c]
mov dword [0x31c8a4], edx
xor eax, eax
add esp, 0x84
pop ebx
pop esi
ret

Function at 0x3114f0
Capabilities:
Get geographical location

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, dword [esp + 0x14]
test edi, edi
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
je 0x31153a
mov eax, dword [esp + 0x20]
push eax
push 0x20
push edi
call fcn.00311ff4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov edx, dword [esp + 0x20]
mov dword [0x31c8a4], eax
push edx
push edi
push 0x1001
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [eax + edi - 1], 0x20
test esi, esi
je 0x311562
push ebx
push 0x20
push esi
call fcn.00311ff4
add esp, 0xc
push ebx
push esi
push 0x1002
push dword [0x31c8a4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [eax + esi - 1], 0x20
test ebp, ebp
je 0x31156f
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp], eax
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x311574
Capabilities:
Get geographical location

Disassembly:
push edi
push esi
push ebx
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push edi
push esi
push dword [eax]
push dword [0x31c8a4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x3115a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xffffffa9
pop ebx
pop esi
pop edi
ret
lea ebx, [eax - 1]
lea eax, [esi + eax - 1]
sub edi, ebx
push edi
push 0x20
push eax
call fcn.00311ff4
mov eax, ebx
add esp, 0xc
pop ebx
pop esi
pop edi
ret
Function at 0x401000
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ecx
cmp byte [0x411007], 0
mov dword [esp], 0
je 0x40102d
push str.password:
call fcn.00401617
lea eax, [esp + 4]
push eax
push 0x40e1b0
call fcn.004015fa
add esp, 0xc
push esi
push 0x40e1ac
push str.RunTmpXXX.exe
call fcn.00401566
mov esi, eax
add esp, 8
test esi, esi
je 0x4010c2
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x401070
mov eax, 0xc
jmp 0x401060
xor dword [eax + section..data], ecx
add eax, 4
cmp eax, 0xb01089
jl 0x401060
push esi
push 0xb0107d
push 1
push 0x41100c
call fcn.00401430
push esi
call fcn.00401265
push str.RunTmpXXX2.exe
call fcn.004011c8
push str.RunTmpXXX.exe
call fcn.004010d9
push str.RunTmpXXX2.exe
call fcn.004010d9
push str.RunTmpXXX.exe
call fcn.004011c8
push str.RunTmpXXX2.exe
call fcn.004011c8
add esp, 0x28
xor eax, eax
pop esi
pop ecx
ret
push str.Cant_create_run_file_nPress_Enter_n
call fcn.00401617
add esp, 4
call fcn.004011c3
xor eax, eax
pop esi
pop ecx
ret

Function at 0x401f8e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x401fb5
call fcn.00401f58
mov dword [eax], esi
call fcn.00401f45
push 0x16
pop esi
mov dword [eax], esi
call fcn.004019f2
mov eax, esi
jmp 0x40200a
test dword [ebp + 0xc], 0xfffffff9
jne 0x401f9b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401fe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401f6b
pop ecx
call fcn.00401f45
mov eax, dword [eax]
jmp 0x40200a
test al, 0x10
jne 0x402008
test al, 1
je 0x402008
test byte [ebp + 0xc], 2
je 0x402008
call fcn.00401f58
mov dword [eax], 5
call fcn.00401f45
mov dword [eax], 0xd
jmp 0x401fd9
xor eax, eax
pop esi
pop ebp
ret

Function at 0x406be2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xf124a0]
jne 0x406bec
repz ret
jmp fcn.0040aa89
Function at 0x40a6b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xf124a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004066ad
and dword [ebp - 0x14], 0
cmp dword [0xf138b4], 0
mov dword [ebp - 0x18], eax
jne 0x40a766
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a80e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a80e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xf138b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xf138b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xf138bc], eax
call edi
push eax
call esi
mov dword [0xf138c4], eax
test eax, eax
je 0x40a766
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xf138c0], eax
mov eax, dword [0xf138c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a7bf
cmp dword [0xf138c4], ecx
je 0x40a7bf
push eax
call esi
push dword [0xf138c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a7bf
test ebx, ebx
je 0x40a7bf
call edi
test eax, eax
je 0x40a7b6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a7b6
test byte [ebp - 8], 1
jne 0x40a7bf
or dword [ebp + 0x10], 0x200000
jmp 0x40a7f2
mov eax, dword [0xf138b8]
cmp eax, dword [ebp - 0x18]
je 0x40a7f2
push eax
call esi
test eax, eax
je 0x40a7f2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a7f2
mov eax, dword [0xf138bc]
cmp eax, dword [ebp - 0x18]
je 0x40a7f2
push eax
call esi
test eax, eax
je 0x40a7f2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xf138b4]
call esi
test eax, eax
je 0x40a80e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a810
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406be2
leave
ret

Function at 0xc36e84
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36e84
ret