joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002e00
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.10003f00
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x1001016c
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x10002ec2
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x10002ebb
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x10002ea6
lea edx, [esi + 1]
push edx
call fcn.10002c50
mov edi, eax
add esp, 4
test edi, edi
je 0x10002e98
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.10004190
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x10002e52
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x10002ed5
push eax
call fcn.10004330
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.10002c50
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x10010168
call fcn.10004100
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x10003030
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10007b84
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1000309a
push esi
lea edi, [eax + 0x400]
call fcn.10007b79
push edi
call fcn.10007b84
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1000306a
push esi
xor edi, edi
call dword [0x100128b0]
add esp, 4
test eax, eax
je 0x100030b6
push eax
push esi
call fcn.100044f0
add esp, 8
mov edi, eax
push esi
call fcn.10007b79
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100038e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10003949
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10002c50
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x10004970
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x1000497c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x10004a0f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x100049d9
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.10004a20
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x100049ae
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x10004a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x10004b3d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10004a92
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x10004abe
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.10004a20
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x10004aff
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10004a81
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10005b00
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x100129b4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x10005b13
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x10005b54
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10012a5c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10005b86
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10005b8a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x10005b7b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10005ba8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10005bac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x10005b9d
xor ecx, ecx
mov eax, 0x100129c4
xor ebx, ebx
mov bl, byte [ecx + 0x10012a6c]
cmp byte [esp + ebx + 0x14], 0
je 0x10005bd7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x10012a84]
cmp byte [esp + ebx + 0x14], 0
je 0x10005bee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x10005bbe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10005b47
lea edx, [esp + 0x84]
push edx
call fcn.10005c30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401443
pop dword [ebp - 0x34]
mov eax, 0xcfde2732
add eax, 0x3061ed11
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xd00d9ecb
add dword [ebp - 0x44], 0x7e44a680
mov dword [ebp - 0x40], 0x70318a8b
sub dword [ebp - 0x40], 0x3dfe3e46
mov dword [ebp - 0x3c], 0x38b69c0a
sub dword [ebp - 0x3c], 0xec6a57dc
mov dword [ebp - 0x38], 0xab09e40e
sub dword [ebp - 0x38], 0xab09e40e
lea eax, [ebp - 0x44]
push eax
mov eax, 0x9b46f8f8
sub eax, 0x9b0677f4
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xaab8a161
add dword [ebp - 0x44], 0xc9b9c7f5
mov dword [ebp - 0x40], 0x4ad6d22e
add dword [ebp - 0x40], 0xf6958f47
mov dword [ebp - 0x3c], 0x94ab03e2
add dword [ebp - 0x3c], 0xcec4688a
mov dword [ebp - 0x38], 0xc93b1e6
add dword [ebp - 0x38], 0xf36c4e1a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x3752db43
sub eax, 0x37125a43
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6b6
push 0
call eax
mov ecx, 0x9dbc5652
sub ecx, 0x9dbc01ce
xor esi, esi
add esi, eax
mov edi, 0x93d7753b
sub edi, 0x9390913b
add edi, dword [ebp - 0x34]
mov edx, 0xc5ed056f
add edx, 0x1b7c6db3
sub dword [ebp - 0x14], ecx
mov ebx, dword [edi]
sub dword [ebp - 0x30], 0x9f16ea7f
sub ebx, edx
sub dword [ebp - 0x20], ebx
mov dword [esi], ebx
xor dword [ebp - 0x30], 0x7e4c3dba
add esi, 0x81711243
add esi, 0x7e8eedc1
add edi, 0xcf1c208b
sub edi, 0xcf1c2087
loop 0x401567
add eax, 0x560804af
add eax, 0xa9f94034
mov ebx, eax
add eax, 5
mov ecx, 0xb1df73c7
sub ecx, 0xb19f73c7
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b658
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
sub eax, esi
and eax, esi
and eax, esi
call fcn.0043b69d
inc eax
inc eax
sub eax, 0x98a1bf5f
xor dword [edx], ebx
add esi, eax
inc edx
sub esi, 1
sub esp, 4
mov dword [esp], 0x2276efc9
pop eax
add esi, esi
cmp edx, ecx
jne fcn.0043b658
sub esi, esi
sub eax, eax
sub eax, 0x7ad46ad0
ret

Function at 0x40e8fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x40e8fa
lcall 0x5de5, 0x8b10c483
jmp loc.0091a768
Function at 0x402a90
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004044fc
test esi, esi
jne 0x402ac6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004045ec
jmp 0x402ae4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402944
mov edi, eax
test esi, esi
je 0x402ae4
cmp dword [ebx], 0
je 0x402ae4
dec esi
jmp 0x402acd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403024
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x447008], 0x8088405
inc edx
mov dword [ebx + 0x447008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4035b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x447024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40364c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40362c
xor eax, eax
push ebp
push 0x403625
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403668
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40362c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x447024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x447024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4042dc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x44c044], 0
je 0x40433d
cmp word [0x44c218], 0xd7b2
jne 0x404305
cmp dword [0x44c220], 0
jbe 0x404305
mov eax, 0x44c214
call dword [fcn.0044c230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x447074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404364
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x447034], 0
jne 0x404359
push 0
push 0x44706c
push 0x447074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4044b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402728
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x44c045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404478
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406454
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4064ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040476c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403040
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4064a4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064c1
lea eax, [ebp - 0x10]
call fcn.004044fc
ret

Function at 0x408508
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004049bc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408521
test al, 0x10
jne 0x408525
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b170
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b1a9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004045ec
jmp 0x40b1b2
mov eax, ebx
mov edx, esi
call fcn.00404550
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b1bc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b1dd
mov al, byte [esp]
jmp 0x40b1df
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c784
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c7e8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040476c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408134
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c7ef
lea eax, [ebp - 0xc]
call fcn.004044fc
ret

Function at 0x41c49c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041c2f4
dec esi
jne 0x41c4be
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x42a2ec
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x42a2f4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42a4e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x42a4fc
mov eax, esi
call fcn.00427de4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404550
lea ecx, [ebp - 0x10]
mov edx, 0x42a510
mov eax, esi
call fcn.00427de4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404550
lea ecx, [ebp - 0x14]
mov edx, 0x42a528
mov eax, esi
call fcn.00427de4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404550
lea ecx, [ebp - 0x18]
mov edx, 0x42a544
mov eax, esi
call fcn.00427de4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404550
lea ecx, [ebp - 0x1c]
mov edx, 0x42a560
mov eax, esi
call fcn.00427de4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404550
lea ecx, [ebp - 0x24]
mov edx, 0x42a578
mov eax, esi
call fcn.00427de4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407d24
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408134
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x42a590
mov eax, esi
call fcn.00427de4
mov eax, dword [ebp - 0x28]
call fcn.00426ee0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x42a5a0
mov eax, esi
call fcn.00427de4
mov eax, dword [ebp - 0x2c]
call fcn.00426ee0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x42a5b8
mov eax, esi
call fcn.00427de4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408134
inc eax
je 0x42a489
lea ecx, [ebp - 0x34]
mov edx, 0x42a5b8
mov eax, esi
call fcn.00427de4
mov eax, dword [ebp - 0x34]
call fcn.004080f8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409874
fstp qword [ebp - 0x3c]
wait
call fcn.00409bd8
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x42a4a4
lea ecx, [ebp - 0x40]
mov edx, 0x42a5b8
mov eax, esi
call fcn.00427de4
mov eax, dword [ebp - 0x40]
call fcn.00426ee0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x42a5c8
mov eax, esi
call fcn.00427de4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a4ed
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404520
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404520
ret
Function at 0x436f04
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x436f5e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00436ef4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004258c4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004254c4
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436f65
lea eax, [ebp - 4]
call fcn.004044fc
ret

Function at 0x43c1c4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x44aa84]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x43c200
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x43c218
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x43c211
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403004
xor edx, edx
mov eax, 0x44ac84
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x43c282
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x43c236
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x43c4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x43c4d9
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x43c4d2
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x43c4eb
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x43c4e4
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0043c0b4
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43c505
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.0043c1c4
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x43c58a
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x43c5a7
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0043c144
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43c5d0
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc