joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014a0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
test ebx, ebx
je 0x40151d
push esi
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4014b3
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x401517
push esi
push ebx
lea eax, [esi + 1]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
cmp word [edi], 0x22
jne 0x401517
cmp word [edi + esi*2 - 2], 0x22
jne 0x401517
xor eax, eax
mov word [edi + esi*2 - 2], ax
lea eax, [esi - 4]
push eax
lea eax, [edi + 2]
push eax
push edi
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x401760
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.C:WindowsSystem32kernel32.dll]
mov ax, word [0x403388]
push esi
movups xmmword [ebp - 0x194], xmm0
push edi
movups xmm0, xmmword [0x403358]
push 0x14e
mov word [ebp - 0x154], ax
lea eax, [ebp - 0x152]
movups xmmword [ebp - 0x184], xmm0
push 0
movups xmm0, xmmword [0x403368]
push eax
movups xmmword [ebp - 0x174], xmm0
movups xmm0, xmmword [0x403378]
movups xmmword [ebp - 0x164], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
push esi
call fcn.00401f66
add esp, 4
mov edi, eax
lea eax, [ebp - 0x194]
push edi
push esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40185a
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1a0]
push eax
push 0x40338c
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40185a
cmp dword [ebp - 0x198], 0
je 0x40185a
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax + 0x10]
mov eax, ecx
shr eax, 0x10
cmp eax, 0xa
jne 0x40185a
test cx, cx
jne 0x40185a
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401f18
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00401f18
mov esp, ebp
pop ebp
ret
Function at 0x401de0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x114]
xor esi, esi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401e6f
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x10c]
push eax
push 0x14
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x114]
test eax, eax
cmovne esi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401e6f
push 0x40030
push str.LAST.exe
push str.SUCCESSED_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401f18
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401760
test eax, eax
je 0x401e8e
call fcn.00401620
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401f18
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x38
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x150], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x144], str.runas
lea eax, [ebp - 0x108]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x134], 0
push eax
mov dword [ebp - 0x13c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401f18
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c33ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
movzx eax, al
push 0x40
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0066eb10
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
add esp, 0xc
xor edx, edx
sub esi, eax
lea ecx, [ebp - 0x44]
add ecx, edx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x4c3436
lea eax, [ebp - 0xa4]
push eax
call fcn.0047a1e0
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0047a220
push edi
lea eax, [ebp - 0xa4]
push eax
call fcn.00479800
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4c34e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x778400]

Function at 0x4c34f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4c354d
mov eax, dword [edi + 0x3c]
xor esi, esi
mov ecx, dword [eax + edi + 0x78]
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov ebp, dword [ecx + 0x18]
test ebp, ebp
je 0x4c354d
mov ebx, dword [esp + 0x1c]
mov ch, byte [ebx]
mov edx, dword [eax + esi*4]
add edx, edi
mov cl, byte [edx]
cmp cl, ch
jne 0x4c3548
mov eax, ebx
sub edx, ebx
test cl, cl
je 0x4c3555
cmp byte [eax], 0
je 0x4c3555
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x4c3532
mov eax, dword [esp + 0x18]
inc esi
cmp esi, ebp
jb 0x4c3523
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4c3580
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
add ebp, 0xc
push edi
mov ebp, dword [ebp]
mov ebx, dword [ebp + 0x30]
test ebx, ebx
je 0x4c3594
test eax, eax
je 0x4c35df
movzx eax, word [ebx]
xor edi, edi
xor esi, esi
mov ecx, eax
test ax, ax
je 0x4c35d7
movzx ecx, ax
lea esi, [esi + 1]
movzx eax, ax
lea edx, [ecx - 0x41]
add ecx, 0x20
cmp dx, 0x19
movzx ecx, cx
cmova ecx, eax
movzx eax, cx
add edi, eax
movzx eax, word [ebx + esi*2]
test ax, ax
jne 0x4c35b0
mov eax, dword [esp + 0x14]
cmp eax, edi
jne 0x4c3594
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4c35f0
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
mov eax, dword fs:[0x30]
sub esp, 0xc
mov eax, dword [eax + 0xc]
add eax, 0xc
nop
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x4c3600
push ebx
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [0x77d7f8]
push esi
push edi
push eax
mov dword [esp + 0x1c], ebp
call fcn.004c3580
mov ecx, dword [0x77d800]
add esp, 4
mov ebx, eax
mov dword [esp + 0x14], ebx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x104
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor esi, esi
movzx ecx, word [edi + edx*2]
mov eax, edx
cmp ecx, 0x5c
cmovne eax, esi
mov esi, eax
test cx, cx
je 0x4c3667
inc edx
jmp 0x4c3651
lea esi, [edi + esi*2]
mov edi, dword [0x77d814]
mov ecx, dword [edi]
test ecx, ecx
je 0x4c36cc
movzx ebx, word [esi + 2]
xor eax, eax
mov ebp, ebx
test bx, bx
je 0x4c368c
inc eax
cmp word [esi + eax*2 + 2], 0
jne 0x4c3683
cmp al, cl
je 0x4c3699
cmp al, byte [edi + 1]
jne 0x4c37aa
xor edx, edx
xor ecx, ecx
test bx, bx
je 0x4c36b6
mov eax, ebp
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2 + 2]
test ax, ax
jne 0x4c36a4
cmp edx, dword [edi + 4]
je 0x4c36c4
cmp edx, dword [edi + 8]
jne 0x4c37aa
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [0x77d800]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x77d7fc], edx
jbe 0x4c371b
nop word [eax + eax]
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x77d804]
add edx, eax
cmp edx, dword [0x77d7fc]
jb 0x4c3700
push esi
push ebx
invalid
Function at 0x583db0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x583dfd
push eax
push str.WSAStartup_failed___d_
push esi
call fcn.0055c180
add esp, 0xc
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x583e25
shr eax, 8
test al, al
jne 0x583e25
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
push str.insufficient_winsock_version_to_support_telnet
push esi
call fcn.0055c180
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 2
pop esi
call fcn.0066c98d
mov esp, ebp
pop ebp
ret

Function at 0x584640
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x1a8]
mov byte [ebp + 8], 0xff
mov byte [ebp + 9], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x584688
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055c180
add esp, 0xc
push dword [ebp + 0x10]
push ebx
push str.SENT
push dword [esi]
call fcn.00583f40
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5847b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x1f
mov eax, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x150]
jne 0x5848fc
push edi
lea eax, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], eax
cmp eax, edi
jae 0x5847e5
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5847f0
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x5847fb
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 0xc], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [ebp + 0xc]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x58482c
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x584836
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x584840
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x58484a
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x584855
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x584860
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
lea esi, [ebx + 0x1cb0]
mov dword [ebx + 0x1eb4], eax
sub eax, esi
sub eax, 2
mov dword [edi], esi
mov edi, dword [ebp - 4]
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push edi
call fcn.00584040
add esp, 0x10
push 0
push 3
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x5848b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055c180
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push esi
call fcn.005846a0
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [esi + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x5848fb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0055c180
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f5a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x743470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x74346c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x743470], edx
cmp eax, 0x26f
jl 0x40f5b0
mov dword [0x68c170], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40f5f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x743474]
mov ebx, dword [eax*4 + 0x743470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x743aa4]
mov dword [eax*4 + 0x743470], edx
cmp eax, 0xe2
jl 0x40f600
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x743474]
mov ebx, dword [eax*4 + 0x743470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x7430e4]
mov dword [eax*4 + 0x743470], edx
cmp eax, 0x26e
jl 0x40f650
mov edx, dword [0x743470]
mov ecx, dword [0x743e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x743aa0]
mov dword [0x743e2c], eax
mov dword [0x68c170], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f6e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x68c170]
add dword [0x68c170], 1
mov eax, dword [0x742020]
cmp eax, dword [0x68b8c0]
jne 0x40f706
cmp ebx, 0x271
jb 0x40f728
mov eax, dword [0x742020]
call fcn.0040f5a0
not dword [0x742020]
mov eax, dword [0x742020]
mov dword [0x68b8c0], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40f744
call fcn.0040f5f0
xor ebx, ebx
mov dword [0x68c170], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x743470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411370
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x68b600]
cmp ax, 0xcb
je 0x41147c
cmp ax, 0xcc
je 0x41147c
mov edx, dword [0x744070]
test edx, edx
je 0x4113a5
mov eax, dword [0x743f20]
call edx
mov ebx, eax
jmp 0x4113aa
mov ebx, 0x743f24
cmp word [0x743f10], 0
jle 0x4113d0
mov eax, 0x743ef0
call fcn.00411640
mov eax, ebx
call fcn.00410ef0
mov eax, ebx
call fcn.00410f70
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x4113f2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4113ed
mov edx, edi
mov eax, ebx
call fcn.00410340
jmp 0x4113f0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4113d8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x743f10], 0
jle 0x41147c
mov edx, 0x743e30
mov eax, ebx
call fcn.00410490
mov edi, eax
test edi, edi
je 0x41144c
mov eax, dword [0x743ec4]
mov dword [edi + 0xc], eax
cmp dword [0x743ec4], 0
je 0x411440
mov eax, dword [0x743ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x743ec4], eax
nop
sub word [0x743f10], 1
cmp word [0x743f10], 0
sete bl
mov eax, 0x743ef0
call fcn.00411660
test bl, bl
je 0x41147c
mov eax, 0x743ef0
call fcn.00411630
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413840
push ebp
push 0x414ce0
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41398a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b920
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x4138ef
mov edx, 0x7432f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413941
call sub.kernel32.dll_GetLastError
call fcn.00404120
lea eax, [ebp - 0x10]
call fcn.0040a4a0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a930
mov edx, dword [ebp - 0x14]
mov ecx, 0x6ad350
lea eax, [ebp - 0x10]
call fcn.0040a7d0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b200
jmp 0x4139d8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41395a
cmp eax, ecx
je 0x413964
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b920
cmp byte [0x68b890], 0
jne 0x4139d8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bf40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b290
lea esi, [esi]
jmp 0x4139d8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b920
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x4139ae
mov eax, 0x7432f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x68b890], 0
jne 0x4139d8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bf40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b290
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413840
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413e10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x743260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413ff0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x743260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004036a0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x68b680], eax
mov ebx, eax
jmp 0x413fb3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413e98
cmp byte [ebx], 0
je 0x413fbc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413f13
mov al, byte [ebx]
cmp al, 1
jb 0x413f08
sub al, 0x20
jbe 0x413ed8
sub al, 2
je 0x413eec
jmp 0x413f08
mov al, byte [ebp - 0x114]
test al, al
je 0x413f18
add dword [ebp - 0x110], 1
jmp 0x413f10
cmp byte [ebx + 1], 0x22
je 0x413f03
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413f10
add ebx, 1
jmp 0x413f10
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413ec8
test dword [ebp - 0x10c], 0xffffffff
je 0x413fac
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413ff0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x743260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413fa3
mov al, byte [ebx]
cmp al, 1
jb 0x413f98
sub al, 0x20
jbe 0x413f68
sub al, 2
je 0x413f7c
jmp 0x413f98
mov al, byte [ebp - 0x114]
test al, al
je 0x413fa8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413fa0
cmp byte [ebx + 1], 0x22
je 0x413f93
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413fa0
add ebx, 1
jmp 0x413fa0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413f58
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413e9b
mov ebx, dword [ebp - 0x10c]
mov dword [0x743250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x743260
call fcn.004111a0
mov eax, dword [0x743260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427780
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 8]
mov ebx, eax
mov word [esp + 4], dx
mov dword [esp], ecx
mov eax, ecx
mov edi, ebx
mov edx, edi
call fcn.00408ad0
mov eax, edi
test edi, edi
je 0x4277a5
mov eax, dword [eax - 4]
mov esi, eax
cmp esi, 1
jl 0x4277f0
xor ebx, ebx
mov esi, esi
add ebx, 1
mov eax, dword [esp]
call fcn.00403bb0
movzx edx, word [esp + 4]
shr edx, 8
movzx ecx, byte [edi + ebx - 1]
xor edx, ecx
mov byte [eax + ebx - 1], dl
movzx edx, byte [edi + ebx - 1]
movzx eax, word [esp + 4]
add eax, edx
imul eax, eax, 0xb315
add eax, 0x8288
mov word [esp + 4], ax
cmp esi, ebx
jg 0x4277b0
mov esi, esi
lea esp, [esp + 8]
pop edi
pop esi
pop ebx
ret
Function at 0x4278e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 8]
mov edi, eax
mov byte [esp], dl
mov dword [esp + 4], ecx
mov edx, edi
test edi, edi
je 0x4278f9
mov edx, dword [edx - 4]
mov eax, dword [esp + 4]
xor cx, cx
call fcn.00409950
mov eax, edi
test edi, edi
je 0x42790e
mov eax, dword [eax - 4]
mov esi, eax
cmp esi, 1
jl 0x427938
xor ebx, ebx
nop
add ebx, 1
mov eax, dword [esp + 4]
call fcn.00403bb0
mov cl, byte [edi + ebx - 1]
mov dl, byte [esp]
xor dl, cl
mov byte [eax + ebx - 1], dl
cmp esi, ebx
jg 0x427918
lea esi, [esi]
lea esp, [esp + 8]
pop edi
pop esi
pop ebx
ret
Function at 0x43ba50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x43bafa
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x43bb16
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x43bb16
sub dx, 0x20
je 0x43baf0
sub dx, 0x80
je 0x43baf0
sub dx, 0x1f62
jb 0x43bb16
sub dx, 1
jbe 0x43baf0
sub dx, 6
je 0x43baf0
sub dx, 0x26
jne 0x43bb16
nop
jmp 0x43baf0
cmp eax, dword [ebp - 0x20]
jg 0x43ba98
lea esi, [esi]
jmp 0x43bb16
cmp dword [ebp - 0x1c], 2
jne 0x43bb0a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x43bb16
mov al, byte [ebp - 0xc]
call fcn.0040b570
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x43bb94
sub ax, 0x21
je 0x43bba8
sub ax, 0x17
je 0x43bbb4
sub ax, 0x222
je 0x43bbc0
sub ax, 0x392
je 0x43bbc8
sub ax, 1
je 0x43bbd0
sub ax, 0x1996
je 0x43bbd8
sub ax, 1
je 0x43bbe0
sub ax, 6
je 0x43bbe8
sub ax, 0xb
je 0x43bbf8
sub ax, 0x1b
je 0x43bbf0
sub ax, 0x367
je 0x43bc00
jmp 0x43bc08
mov ax, word [ebp - 0x24]
call fcn.0040b610
mov byte [ebp - 0x10], al
jmp 0x43bc10
mov byte [ebp - 0x10], 0x20
jmp 0x43bc10
mov byte [ebp - 0x10], 0x2e
jmp 0x43bc10
mov byte [ebp - 0x10], 0x27
jmp 0x43bc10
mov byte [ebp - 0x10], 0x2c
jmp 0x43bc10
mov byte [ebp - 0x10], 0x27
jmp 0x43bc10
mov byte [ebp - 0x10], 0x20
jmp 0x43bc10
mov byte [ebp - 0x10], 0x20
jmp 0x43bc10
mov byte [ebp - 0x10], 0x20
jmp 0x43bc10
mov byte [ebp - 0x10], 0x20
jmp 0x43bc10
mov byte [ebp - 0x10], 0x2d
jmp 0x43bc10
mov byte [ebp - 0x10], 0x27
jmp 0x43bc10
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret