joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42024f
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x420268
or eax, 0xffffffff
jmp 0x4202c9
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4202c5
push 0x3d
push esi
call fcn.004204bb
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4202c5
cmp esi, eax
je 0x4202c5
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x42ea90]
sete cl
cmp eax, dword [0x42ea94]
mov dword [ebp - 8], ecx
jne 0x4202ab
mov edi, eax
call fcn.004201ee
mov dword [0x42ea90], eax
cmp eax, ebx
jne 0x420304
cmp dword [ebp + 0xc], ebx
je 0x4202cd
cmp dword [0x42ea98], ebx
je 0x4202cd
call fcn.0041f7fa
test eax, eax
je 0x420304
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x4202d6
xor eax, eax
jmp 0x4202c8
push 4
call fcn.004171e4
cmp eax, ebx
pop ecx
mov dword [0x42ea90], eax
je 0x4202c5
mov dword [eax], ebx
cmp dword [0x42ea98], ebx
jne 0x420304
push 4
call fcn.004171e4
cmp eax, ebx
pop ecx
mov dword [0x42ea98], eax
je 0x4202c5
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x42ea90]
call fcn.004201a1
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x420365
cmp dword [esi], ebx
je 0x420365
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00417260
cmp dword [ebp - 8], ebx
pop ecx
jne 0x420348
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x4203a6
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x42033f
mov eax, edi
shl eax, 2
push eax
push dword [0x42ea90]
call fcn.0041fb72
cmp eax, ebx
pop ecx
pop ecx
je 0x4203a6
jmp 0x4203a1
cmp dword [ebp - 8], ebx
jne 0x420411
cmp edi, ebx
jge 0x420374
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x42ea90]
call fcn.0041fb72
cmp eax, ebx
pop ecx
pop ecx
je 0x4202c5
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x42ea90], eax
cmp dword [ebp + 0xc], ebx
je 0x4203fb
push dword [ebp - 4]
call fcn.004167e0
inc eax
inc eax
push eax
call fcn.004171e4
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4203fb
push dword [ebp - 4]
push esi
call fcn.004177f0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4203f4
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00417260
pop ecx
cmp dword [ebp - 8], ebx
je 0x420409
push dword [ebp - 4]
call fcn.00417260
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4202c8
push dword [ebp - 4]
call fcn.00417260
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x4202d2
Function at 0x420656
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x420683
test byte [esp + 8], 0x80
je 0x420671
and eax, 0xfffffffe
jmp 0x420674
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x420694
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041ba02
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403203
pop dword [ebp - 0x24]
mov eax, 0x28c877a
sub eax, 0x24c5577
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xc1a21eb7
sub dword [ebp - 0x34], 0x734fd96c
mov dword [ebp - 0x30], 0xbcbe45a7
add dword [ebp - 0x30], 0x7575069e
mov dword [ebp - 0x2c], 0x1662d9ec
add dword [ebp - 0x2c], 0x35e96a42
mov dword [ebp - 0x28], 0x650120c4
sub dword [ebp - 0x28], 0x650120c4
lea eax, [ebp - 0x34]
push eax
mov eax, 0xb4aed569
add eax, 0x4b91ab23
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xbbaa080d
add dword [ebp - 0x34], 0xb8c86149
mov dword [ebp - 0x30], 0x2f837343
sub dword [ebp - 0x30], 0xee1711ce
mov dword [ebp - 0x2c], 0x509a0dfe
add dword [ebp - 0x2c], 0x12d55e6e
mov dword [ebp - 0x28], 0xd4658485
add dword [ebp - 0x28], 0x2b9a7b7b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xa293398c
add eax, 0x5dad4748
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x337fd
push 0
call eax
mov ecx, 0xb27db641
sub ecx, 0xb27d7aa2
xor edx, edx
add edx, eax
mov edi, 0x44ac473a
sub edi, 0x446b373a
add edi, dword [ebp - 0x24]
mov esi, 0x6c662911
sub esi, 0xd822907d
xor dword [ebp - 0x20], 0xc9bcda94
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0x45345fe9
xor ebx, esi
mov dword [edx], ebx
sub dword [ebp - 8], 0x148d4bf7
add edx, 4
add edi, 4
loop 0x403327
add eax, 0x71fe15a7
add eax, 0x8e02cba8
xor ebx, ebx
add ebx, eax
add eax, 0xee877980
add eax, 0x11788685
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x406588
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00406a48
mov byte [esp], al
cmp byte [esp], 0
jne 0x406711
test edi, edi
je 0x406711
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406651
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40662c
cmp edi, 0xffffffff
je 0x4065ed
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4065ed
mov byte [esp], 0
jmp 0x406711
cmp dword [esi], 1
jg 0x40662c
cmp dword [esi], 0
jne 0x40661e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40661e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406711
lea eax, [esp + 0xc]
call fcn.0040623c
dec ebp
test ebp, ebp
jg 0x4065d2
cmp edi, 0xffffffff
je 0x406651
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40664f
mov byte [esp], 0
jmp 0x406711
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406596
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406651
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040678c
mov edx, eax
mov ebx, dword [0x4238f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4066b5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4066b3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4066b5
xor edi, edi
cmp byte [esp], 0
je 0x4066db
mov ebx, dword [esi]
test bl, 1
jne 0x4066f1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4066bb
mov byte [esp + 1], 1
jmp 0x4066f1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4066db
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406668
cmp byte [esp], 0
je 0x406711
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4075d8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x423054], 0
je 0x40763f
cmp word [0x423340], 0xd7b2
jne 0x407601
cmp dword [0x423348], 0
jbe 0x407601
mov eax, 0x42333c
call dword [0x423358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40766c
call fcn.00407dd4
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x421026], 0
jne 0x40765b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40a2f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a457
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040785c
cmp si, word [0x4219f8]
jb 0x40a388
cmp si, word [0x421bf8]
ja 0x40a388
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40a388
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4219f8]
jae 0x40a362
mov edi, ebx
dec edi
jmp 0x40a383
cmp si, word [ebx*8 + 0x4219f8]
jbe 0x40a372
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40a383
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4219fc]
call fcn.0040a20c
jmp 0x40a388
cmp edi, dword [ebp - 8]
jae 0x40a34c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40a437
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40a437
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407f00
push dword [ebp - 0x160]
push 0x40a474
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00407f00
push dword [ebp - 0x164]
push 0x40a484
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407f00
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004080b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a45e
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004078bc
pop eax
jmp eax
Function at 0x40a60c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a712
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x425c10
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x425c28]
jne 0x40a658
mov eax, esi
mov edx, 0x425c2a
mov ecx, 0x55
call fcn.00407f00
push 0x425c10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40a6fa
push 0x425c10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040785c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40a6c7
cmp byte [0x425c0c], 0
je 0x40a68c
mov edx, esi
mov eax, ebx
call fcn.0040a4f0
jmp 0x40a6c7
mov edx, esi
mov eax, ebx
call fcn.0040a2f0
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40a6c7
cmp dword [esi], 0
je 0x40a6b0
mov eax, esi
mov edx, 0x40a72c
call fcn.00407fd8
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040a2f0
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407fd8
push 0x425c10
call sub.kernel32.dll_EnterCriticalSection
mov word [0x425c28], bx
mov eax, dword [esi]
call fcn.00407e74
mov ecx, eax
mov eax, 0x425c2a
mov edx, 0xaa
call fcn.0040a16c
push 0x425c10
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a719
lea eax, [ebp - 4]
call fcn.0040785c
pop eax
jmp eax
Function at 0x40a954
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407950
xor eax, eax
push ebp
push 0x40ab7c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40a99a
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40a9b4
mov eax, dword [ebp - 4]
call fcn.00407e74
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0040a16c
cmp word [ebp - 0x21e], 0
je 0x40ab5f
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ab8c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40aa83
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ab8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40aa83
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40abc8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40aa83
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40abc8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40aa83
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40abfc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40aa83
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ac30
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40ab5f
xor eax, eax
push ebp
push 0x40ab58
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0040a754
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40aae6
mov eax, dword [ebp - 0x14]
call fcn.004044f8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00407ec4
jmp 0x40ab31
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x40ac70
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40ab31
mov eax, dword [ebp - 0x14]
call fcn.004044f8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x40ac70
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00407ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ab5f
cmp dword [ebp - 0xc], 0
je 0x40ab4c
mov eax, dword [ebp - 0xc]
call fcn.00404514
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ab83
lea eax, [ebp - 8]
mov edx, 2
call fcn.004078bc
pop eax
jmp eax
Function at 0x40ae90
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407950
xor eax, eax
push ebp
push 0x40af52
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407f00
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00408030
mov eax, dword [ebx]
call fcn.0040ad38
test al, al
jne 0x40af2d
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407f00
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00408030
mov eax, dword [ebx]
call fcn.0040ad38
test al, al
jne 0x40af2d
mov eax, ebx
call fcn.0040785c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40af59
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004078bc
lea eax, [ebp - 4]
call fcn.0040785c
pop eax
jmp eax

Function at 0x40c918
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x416b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x416bb9
test eax, edx
je 0x416bbc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x416b77
movzx eax, word [eax]
sub eax, ecx
jmp 0x416b9e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x416b9f
add ecx, 4
js 0x416b8f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x416b9c
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x416b9e
xor eax, eax
ret
test eax, eax
je 0x416bc8
test edx, edx
jne 0x416b68
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x418ddc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x418e15
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004079a8
jmp 0x418e1e
mov eax, ebx
mov edx, esi
call fcn.00407b24
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x418e28
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x418e4c
movzx eax, word [esp]
jmp 0x418e4e
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41a56c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41a693
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041a374
mov esi, eax
mov eax, dword [0x4226ac]
cmp byte [eax], 0
je 0x41a639
mov eax, dword [0x4225b4]
call fcn.00405024
call fcn.0040464c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41a53c]
call fcn.00409a80
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41a6ac
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x41a675
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x42258c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x426634]
call fcn.00409e10
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a69a
lea eax, [ebp - 4]
mov edx, dword [0x41a53c]
call fcn.00409ba4
pop eax
jmp eax

Function at 0x41c4ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407c24
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c8f8
mov edi, eax
cmp edi, 0x104
jbe 0x41c497
mov eax, edi
add eax, eax
call fcn.004044f8
mov esi, eax
jmp 0x41c499
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c8f8
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41c4d2
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41c4bc
mov eax, esp
cmp esi, eax
je 0x41c4df
mov eax, esi
call fcn.00404514
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41c518
cmp bl, 0
je 0x41c514
cmp bl, 0x41
jl 0x41c50f
cmp bl, 0x5a
jg 0x41c50f
or bl, 0x20
xor al, bl
inc esi
jmp 0x41c4f3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41c458

Function at 0x41c878
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407f00
add esp, 0x800
pop ebx
ret
Function at 0x41d0b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41d0d4
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x41d0ee
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41d0e9
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41d0f3
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x41d161
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x41d1aa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41d11f
inc dword [ebp - 0xc]
jmp 0x41d137
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x41d137
cmp dword [ebp - 0xc], 0
jle 0x41d137
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x41d159
xor eax, eax
jmp 0x41d155
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41d154
mov eax, esi
jmp 0x41d1ad
inc eax
cmp eax, ecx
jle 0x41d141
inc esi
cmp esi, dword [ebp - 8]
jl 0x41d10b
jmp 0x41d1aa
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x41d1aa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41d182
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x41d1a4
xor eax, eax
jmp 0x41d1a0
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41d19f
mov eax, esi
jmp 0x41d1ad
inc eax
cmp eax, ecx
jle 0x41d18c
inc esi
cmp esi, dword [ebp - 8]
jl 0x41d16a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10