joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x446c50
push 0xa
push 0x40add8
mov eax, dword [0x446c40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40ad68
call fcn.004155b8
push ebx
mov eax, dword [0x446c40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40ad7f
call fcn.004155b8
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40ad91
call fcn.004155b8
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x446c54], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x446c58], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x446c5c], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x446c60], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x446c64], ecx
add edx, dword [eax + 0x14]
mov dword [0x446c68], edx
pop esi
pop ebx
ret

Function at 0x40e4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40e599
test eax, edx
je 0x40e59c
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40e519
push edx
mov edx, eax
mov eax, esp
call fcn.00406d34
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40e52f
push eax
lea eax, [esp + 8]
call fcn.00406d34
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40e53e
movzx eax, word [eax]
sub eax, ecx
jmp 0x40e565
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40e57f
add ecx, 4
js 0x40e556
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40e57c
push eax
mov eax, ecx
mov edx, 2
call fcn.004062a8
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40e563
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40e565
xor eax, eax
ret
test eax, eax
je 0x40e5ac
test edx, edx
jne 0x40e500
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40f618
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406bbc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40f631
test al, 0x10
jne 0x40f635
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40f63c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00406bbc
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x40f65e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x412b94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x412bcd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406c6c
jmp 0x412bd6
mov eax, ebx
mov edx, esi
call fcn.00406b30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412be0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x412c02
movzx eax, word [esp]
jmp 0x412c04
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x413394
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4134b9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004131a4
mov esi, eax
mov eax, dword [0x443ddc]
cmp byte [eax], 0
je 0x413461
mov eax, dword [0x443c78]
call fcn.00404888
call fcn.004042e8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41336c]
call fcn.00408194
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4134d4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41349d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x443c48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x446c40]
call fcn.00408258
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4134c0
lea eax, [ebp - 4]
mov edx, dword [0x41336c]
call fcn.004081a0
ret
Function at 0x415460
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004065b8
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x41540a
mov eax, edi
add eax, eax
call fcn.004041a0
mov esi, eax
jmp 0x41540c
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415445
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41542f
mov eax, esp
cmp esi, eax
je 0x415452
mov eax, esi
call fcn.004041bc
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41548c
cmp bl, 0
je 0x415488
cmp bl, 0x41
jl 0x415483
cmp bl, 0x5a
jg 0x415483
or bl, 0x20
xor al, bl
inc esi
jmp 0x415467
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4153cc
Function at 0x43f334
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, dword [0x443ddc]
mov byte [eax], 1
mov eax, 0x43b4f0
call fcn.0040a110
xor eax, eax
push ebp
push 0x43f523
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x43f4b5
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0043af5c
test al, al
jne 0x43f3ab
mov eax, dword [0x443c78]
mov edx, 0x43f540
call fcn.00407390
call fcn.00404c1c
call fcn.004042e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f500
xor edx, edx
push ebp
push 0x43f457
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [0x443c80]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x43f56c
call fcn.00406fe0
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
call fcn.00406bbc
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x443c84]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, 0x43f5a0
call fcn.00406fe0
mov edx, dword [ebp - 0x1c]
mov eax, 0x43f5c8
call fcn.0043b10c
push 0
mov edx, dword [0x443c80]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
mov ecx, 0x43f5f8
call fcn.00406fe0
mov eax, dword [ebp - 0x20]
call fcn.00406bbc
push eax
mov edx, dword [0x443c84]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, 0x43f5a0
call fcn.00406fe0
mov eax, dword [ebp - 0x24]
call fcn.00406bbc
push eax
call sub.kernel32.dll_CopyFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f486
mov eax, dword [0x443c84]
mov eax, dword [eax]
call fcn.0043b258
mov eax, dword [0x443c78]
mov edx, 0x43f650
call fcn.00407390
call fcn.00404c1c
call fcn.004042e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f52a
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00406b28
lea eax, [ebp - 0x14]
call fcn.00406b20
ret
Function at 0x44a210
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, 0x190
push edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a2e2
lea ecx, [esp + 0x20]
push ebp
mov ebp, 4
push ecx
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a290
mov ebx, dword [esp + 0x1c]
xor esi, esi
test edi, edi
mov dword [esp + 0x14], ebp
je 0x44a2a9
mov eax, dword [0x65bb1c]
push 0x65b838
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop ebp
jne 0x44a2d7
or esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov edx, ebx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4780aa
Capabilities:
Encode data using xor

Disassembly:
adc bh, byte [edx]
scasb al, byte es:[edi]
push ds
mov dh, 0xa8
imul ebp, dword [esi], 0xbfc0a5b
cld
or esi, dword [edi]
cld
or esi, dword [edi]
adc dword [edx + 0x657c3665], 0x12953193
les esp, [ebx + edi*8 + 2]
js 0x4780a0
xor dword [ebp - 0x49b3bee], edx
add bh, byte [eax - 0x1d]
sti
inc edi
sub ch, byte [ecx]
cmp dh, byte [ebx - 0x7d457a91]
sub edi, eax
jbe 0x4780f5
fstp dword [ebp*8 + 0x773e4ace]
and eax, 0x239af29e
call 0x74aa4f38
lodsb al, byte [esi]
inc esp
dec esi
jge 0x4780b4
sar dword [edx - 0x49cc48eb], cl
push cs
jo 0x478112
cmp esi, dword [ebx - 0x37a73ff5]
mov bl, 0x99
sbb dword [ebp + 0x282fc0c0], esi
shr byte [edi], 0x28
movsd dword es:[edi], dword [esi]
xlatb
pop ds
xchg ebp, eax
fimul word [eax + edi*4 + 0xd19f0c9]
or ah, byte [eax - 0x200d8df1]
mov al, 0xee
lodsb al, byte [esi]
sub al, 0x8c
adc bh, byte [edx]
adc cl, dl
and ah, byte [esi - 0x273f6928]
test al, 0xd5
sub al, 0xb7
adc al, bh
in eax, dx
sub eax, edx
sub al, 0x98
sbb byte [esi - 0x4f12a388], bl
sbb dword [eax + 0x32f4c91c], edx
inc ebp
push es
fild dword [ebx - 0x35]
jo 0x478125
js 0x478183
in eax, dx
mov al, 0x19
nop
sbb al, 0xc9
hlt
test byte [edx - 0x57aef65d], 0x52
jmp 0xfa8a4784
adc al, 0x9f
dec esp
and dword [edi + 9], esi
rcr byte [ebp - 2], cl
dec esi
xor eax, dword [edi + ebx]
or edx, edx
pop ebp
dec byte [esi + 0x33]
add al, 0x1f
dec esi
pop eax
mov dl, 0xfa
sbb dword [edx + eax*8 - 0x17], edi
inc esp
xor eax, 0x96b05a68
jmp 0x478165
or eax, 0xc825a13
sahf
push ss
cld
xchg esi, eax
mov dh, 0x36
push 0x4b274269
mov al, byte [edi]
movlps xmm0, qword [eax - 0x14853669]
add bh, ch
je 0x4781ee
jp 0x47816b
pushal
add edx, ebx
pop ds
mov edi, ds
jecxz 0x4781d2
aas
xchg ebp, eax
mov al, byte [0xcdc2fc9d]
adc word [ecx + 0x52], bp
mov edx, 0x60028906
xor dh, bl
cmp esi, dword [ebx]
xor dword [eax + 0x674a3ab0], 0x5708e2d1
imul byte [edx + ecx + 0x48]
add ch, byte [edx - 0x6b41fadb]
and eax, 0xb194be05
test al, 0x93
mov cl, 0xa8
xchg ebx, eax
jge 0x4781ce
popfd
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xd881c442]
inc ecx
push edi
invalid
mov edi, 0xcf8a2abb
invalid
Function at 0x49a95a
Capabilities:
Encode data using xor

Disassembly:
invalid
inc edx
lodsd eax, dword [esi]
inc ebp
outsb dx, byte [esi]
jmp 0xf36f5792
pop eax
test byte [ebx - 0x197c0db0], cl
ja 0x49a97b
and esi, 0x77
sbb ecx, ebx
loope 0x49a946
fabs
loope 0x49a926
rcr bl, 0xc1
fcmovnb st(0), st(1)
rcl byte [eax + 0x29], cl
out dx, eax
std
mov edi, 0x35301904
add eax, 0x2fbf1c33
in al, dx
wait
outsb dx, byte [esi]
scasd eax, dword es:[edi]
aad 0x97
xor eax, 0x620f62bd
xor esp, dword [eax - 0x7e6645d]
aaa
inc ecx
jp 0x49a958
imul esi, edx, 0x1be211a1
or al, 0x10
mov bh, 0x27
scasb al, byte es:[edi]
push esp
inc edx
dec esp
cdq
cdq
jo 0x49a97c
push esp
xchg byte [ecx - 0x293521a3], dl
mov bl, 6
lahf
pop edx
xchg esi, eax
adc dword [ebx], ebx
xchg esp, eax
lea esi, [edx + ebx*4]
leave
jge 0x49a95d
lds edi, [ebx]
sub eax, 0x4734840c
sti
loope 0x49a9c3
push 0x3d
xchg ebp, eax
or eax, 0xa5ed9671
xchg esi, eax
in eax, dx
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, ebp
mov dword [eax - 0x2b76410e], ebx
push es
aaa
pop eax
bound ebx, qword [ecx + 0x36]
cmp eax, 0x5b210a36
loop 0x49a993
clc
fsub dword [edx - 0x3f6de76]
cmp dword [ecx - 0x783e5eea], ecx
sbb ecx, eax
cmp al, byte [ecx + 0x346df8a3]
rcl byte [ecx - 0x65], cl
and edx, esi
jo 0x49a9b1
sar byte [edi], 1
pop esi
invalid

Function at 0x62b3ca
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
sbb byte [ecx - 0x54], bl
sub dword [edi - 0x76273d7e], esp
add byte [edx - 0x4a], ah
jae 0x62b3cc
inc ebx
cmp byte [esi - 0x73], dl
ja 0x62b3e1
inc ebp
mov ebp, 0xb4432d30
mov dl, 0xf3
xor byte [0xf3b2b443], ch
and cl, byte [eax + 0x41]
out 0x16, eax
out 0x13, eax
mov word [ecx], es
out dx, eax
sal dword [edi + 0x33f4bd], cl
add byte [esi + 0x69], ah
xchg esi, eax
cmp esp, ebp
sbb edi, dword [ebp + 0x3a71332a]
imul dx, word [esi - 0x42e413c7], 0x332a
jno 0x62b427
cli
wait
xor ebx, ecx
mov ch, 0xc3
sbb eax, 0xc169c331
cmp byte [edx - 0x47], dh
jae 0x62b455
loopne 0x62b3b5
imul edi, eax, 0x7d
pop esi
out 0x29, eax
adc eax, 0xa628c304
cmp edx, edx
inc esi
inc eax
dec eax
jecxz 0x62b480
sahf
imul edx, esp, 0xbef9902e
cmpsb byte [esi], byte es:[edi]
push ds
mov ebx, 0x2383248d
jp 0x62b44f
imul edx, dword [ebx - 0x5aed86d1], 0x27
movsd dword es:[edi], dword [esi]
daa
jno 0x62b45e
jns 0x62b3e2
leave
test byte [edx - 2], cl
mov bl, bh
in al, dx
or ebx, dword ds:[edi]
xchg ebp, eax
pop ebp
mov edx, 0x93f83316
insd dword es:[edi], dx
pop ds
push cs
inc ebp
salc
mov dl, 0x37
imul ebx, dword [eax], 0x20
sbb ebx, esp
ror byte [eax + ebp*2 + 0x19d6ba10], 0xe1
xchg edi, eax
mov edx, 0x97e119d6
ret
insd dword es:[edi], dx
insd dword es:[edi], dx
or dword [esi - 0x19], edx
mov dl, 0xac
xor esp, ebx
push edi
or dh, byte [ebx + 0x33]
pushal
test eax, 0xc95128c1
xchg edi, eax
or al, 0x16
iretd
add byte [eax + 0x79], cl
mov bl, 0x74
call 0xca91b3be
xor esi, dword [esi - 0x35]
test eax, 0xbb8c7d45
sbb cl, dh
add byte [eax - 0x1e7dfb87], ch
xor byte [esi + 0x468b5b40], 0x52
and ecx, edi
lodsb al, byte [esi]
adc byte [ebx + 0x4a32484b], 0x6b
sub al, 0x2c
ficom dword [ebx - 0x461c48]
adc al, 0x5b
push ds
loop 0x62b483
invalid
Function at 0x64e05d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x658408
cmp edx, dword [eax]
je 0x64e07f
add eax, 8
inc ecx
cmp eax, 0x658498
jl 0x64e070
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x658408]
jne 0x64e1ad
mov eax, dword [0xa5bd60]
cmp eax, 1
je 0x64e187
test eax, eax
jne 0x64e0b0
cmp dword [0x658334], 1
je 0x64e187
cmp edx, 0xfc
je 0x64e1ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e0e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ea40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064eed0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e12a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064eed0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653e2c
push edi
call fcn.00650da0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ea40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ea50
lea eax, [ebp - 0xa0]
push 0x653e0c
push eax
call fcn.0064ea50
push dword [esi + 0x65840c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ea50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650d14
add esp, 0x2c
pop edi
jmp 0x64e1ad
lea eax, [ebp + 8]
lea esi, [esi + 0x65840c]
push 0
push eax
push dword [esi]
call fcn.0064eed0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a91f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40a942
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40a944
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40a97d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40a967
mov eax, esp
cmp esi, eax
je 0x40a98a
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40a9c4
cmp bl, 0
je 0x40a9c0
cmp bl, 0x41
jl 0x40a9bb
cmp bl, 0x5a
jg 0x40a9bb
or bl, 0x20
xor al, bl
inc esi
jmp 0x40a99f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a904

Function at 0x40b5b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b5fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b548
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b601
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40b818
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b8af
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b863
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b899
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b87c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b88f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b6d8
mov ebx, eax
test esi, esi
je 0x40b88f
dec esi
jmp 0x40b86a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8b6
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b8c0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408134
add esp, 0x208
pop ebx
ret
Function at 0x40ba24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bb5c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40ba81
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
cmp dword [ebp - 0x14], 0
jne 0x40ba98
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bb46
cmp dword [ebp - 0x14], 0x70000000
jb 0x40baa6
call fcn.00409734
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40ba4a
test eax, eax
jne 0x40bb46
bound ecx, qword [ebx + 0x453bf045]
or al, 0x74
or byte [ebx + 0x4a3bf045], cl
push cs
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40baf4
mov eax, dword [ebp - 0x10]
cmp ecx, dword [edx + 0xe]
cmpsd dword [esi], dword es:[edi]
mov cl, 0x8b
jne 0x40bae3
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40bafc
dec esi
test esi, esi
je 0x40bb0b
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x40bafb
cmp dword [ebp - 0x10], 7
jne 0x40bb16
test esi, esi
je 0x40bb16
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404f00
cmp dword [ebp - 0x10], 7
jne 0x40bb39
test esi, esi
je 0x40bb39
lea eax, [ebp - 4]
call fcn.004054ac
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb63
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40c5a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d98
mov eax, esi
mov edx, 8
test al, 1
je 0x40c5bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c5be
shr eax, 1
dec edx
jne 0x40c5af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c5a8
pop esi
ret

Function at 0x40c5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d94], 0
jne 0x40c5f7
call fcn.0040c5a0
push 1
push 0x417d94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c622
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c5fd
mov eax, ebx
pop edi
pop esi
pop ebx
ret