joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405090
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov edi, edx
or eax, eax
je 0x40509e
mov eax, dword [eax - 4]
or edx, edx
je 0x4050a5
mov edx, dword [edx - 4]
mov ecx, eax
cmp ecx, edx
jbe 0x4050ad
mov ecx, edx
cmp ecx, ecx
repe cmpsb byte [esi], byte es:[edi]
je 0x4050dd
mov bl, byte [esi - 1]
cmp bl, 0x61
jb 0x4050c3
cmp bl, 0x7a
ja 0x4050c3
sub bl, 0x20
mov bh, byte [edi - 1]
cmp bh, 0x61
jb 0x4050d3
cmp bh, 0x7a
ja 0x4050d3
sub bh, 0x20
cmp bl, bh
je 0x4050af
jmp 0x417e2b
sub eax, edx
pop ebx
pop edi
pop esi
ret

Function at 0x405230
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
jmp loc.0041561a

Function at 0x405244
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov ebx, ecx
mov esi, eax
cmp ebx, 0x1f
jle fcn.00405257
jmp loc.00417615

Function at 0x4055f8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004032f4
push eax
push edi
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
lea eax, [ebp - 0x1002]
mov edx, 0x1001
call fcn.004052a8
mov ebx, eax
cmp ebx, 0x1001
jne fcn.00405641
mov eax, 0xffa7
jmp loc.00417341

Function at 0x40565c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405695
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40569e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4056a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4056c9
mov al, byte [esp]
jmp 0x4056cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x405ce0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
test dl, dl
je fcn.00405cef
add esp, 0xfffffff0
jmp loc.00415890

Function at 0x405d14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x405d28
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405d6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.004055e4
jmp loc.004157bb

Function at 0x4060f8
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 0xff87
mov dl, 1
mov eax, 0x404b3c
call fcn.00405d90
jmp loc.00416390
Function at 0x406144
Capabilities:
Packed with generic packer

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je fcn.00406164
mov eax, dword [esp + 0x10]
jmp loc.00416c0d

Function at 0x4066c4
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [ebp - 0x28], 0
je fcn.004066e5
jl 0x4066d8
jmp loc.004182f0
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
jle 0x4066f5
jmp fcn.00406726

Function at 0x40672a
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a
push edi
push esi
push ebx
mov ebx, eax
mov esi, edx
cmp cl, 0
je 0x406743
jmp loc.0041879a
call fcn.00406751
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x406751
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ax, word [esi + 8]
mov edx, eax
and eax, 0x7fff
je 0x40676e
cmp eax, 0x7fff
jne 0x406779
cmp word [esi + 6], 0x8000
je 0x406770
inc eax
xor edx, edx
mov byte [ebx + 3], 0
jmp 0x40683b
fld xword [esi]
sub eax, 0x3fff
imul eax, eax, 0x4d10
sar eax, 0x10
inc eax
mov dword [ebp - 8], eax
mov eax, 0x12
sub eax, dword [ebp - 8]
fabs
call fcn.00404014
frndint
fld xword [0x40617c]
fcomp st(1)
wait
fnstsw word [ebp - 4]
wait
test word [ebp - 4], 0x4100
je 0x4067bc
fidiv dword [0x40616c]
inc dword [ebp - 8]
fbstp tbyte [ebp - 0x1a]
lea edi, [ebx + 3]
mov edx, 9
wait
mov al, byte [ebp + edx - 0x1b]
mov ah, al
shr al, 4
and ah, 0xf
add ax, 0x3030
stosw word es:[edi], ax
dec edx
jne 0x4067c8
xor al, al
stosb byte es:[edi], al
mov edi, dword [ebp - 8]
add edi, dword [ebp + 8]
jns 0x4067ec
xor eax, eax
jmp 0x40676e
cmp edi, dword [ebp + 0xc]
jb 0x4067f4
mov edi, dword [ebp + 0xc]
cmp edi, 0x12
jae 0x406820
jmp 0x4169a9
jmp 0x416bc9
shr dx, 0xf
mov word [ebx], ax
mov byte [ebx + 2], dl
ret

Function at 0x406ad0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov al, byte [ebx + esi - 1]
push eax
call sub.kernel32.dll_IsDBCSLeadByte
test eax, eax
je 0x406af7
mov eax, ebx
call fcn.004032f4
cmp esi, eax
jge 0x406af7
mov eax, 2
pop esi
pop ebx
ret
jmp loc.00416975

Function at 0x406b10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406b84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406d34
mov ebx, eax
test ebx, ebx
jne 0x406b4e
mov eax, dword [ebp - 4]
mov ecx, edi
mov edx, esi
call fcn.00403340
jmp fcn.00406b6e
lea eax, [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, esi
call fcn.00403454
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, edi
jmp loc.00418856
Function at 0x406cd8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov edi, edx
mov esi, eax
push esp
lea eax, [esp + 8]
push eax
push 0x1000
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_GetFullPathNameA
mov ebx, eax
test ebx, ebx
jle 0x406d1e
cmp ebx, 0x1000
jge 0x406d1e
lea edx, [esp + 4]
mov eax, edi
mov ecx, ebx
call fcn.00403278
jmp fcn.00406d27
mov eax, edi
mov edx, esi
jmp loc.00416fbd

Function at 0x406dc8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov dl, 1
mov eax, esi
call fcn.00406b94
mov edi, eax
mov eax, esi
call fcn.004032f4
mov ebx, eax
jmp 0x406de7
dec ebx
cmp edi, ebx
jge 0x406e00
lea edx, [esi + ebx]
mov eax, esi
call fcn.00406dc0
mov al, byte [eax]
call fcn.00406b00
test al, al
jne 0x406de6
mov eax, esi
call fcn.004032f4
cmp ebx, eax
jne 0x406e16
mov eax, ebp
mov edx, esi
jmp 0x4180fb
push ebp
mov ecx, ebx
mov edx, 1
mov eax, esi
call fcn.00403454
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406e2c
Capabilities:
Get file attributes
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406e74
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406dc8
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
jmp loc.004171df

Function at 0x407020
Capabilities:
Accept command line arguments
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40706b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
lea edx, [ebp - 4]
call fcn.00406f40
xor ebx, ebx
jmp fcn.00407050

Function at 0x40707c
Capabilities:
Accept command line arguments
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40710a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4070c7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x4070f4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x4070db
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x4070ea
lea edx, [ebp - 4]
call fcn.00406f40
test ebx, ebx
je 0x4070ea
dec ebx
jmp 0x4070cc
jmp loc.004161b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407111
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x407118
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, 0x104
pop ebx
ret

Function at 0x407144
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, 0x104
pop ebx
ret
Function at 0x40728c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4073c4
jmp loc.0041788b

Function at 0x4072a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4073c4
jmp loc.0041788b

Function at 0x40741c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push edx
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40748e
push dword fs:[eax]
mov dword fs:[eax], esp
fnstcw word [ebp - 2]
xor eax, eax
push ebp
push 0x407470
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403414
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407477
jmp loc.00417a36

Function at 0x40764c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.0040322c
cmp dword [ebx], 0
je fcn.00407678
mov eax, dword [ebx]
call fcn.00406da0
cmp byte [eax], 0x2e
jbe fcn.00407678
mov eax, ebx
mov edx, 0x407684
jmp loc.00415836

Function at 0x40795c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je fcn.0040796e
add esp, 0xfffffff0
jmp loc.00417d0b

Function at 0x407d40
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40d55c], 0
jne 0x407d63
jmp loc.00415de3
mov eax, edi
test esi, esi
je 0x407d8e
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40d560]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407d69
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4080d8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov esi, eax
xor eax, eax
mov dword [esp], eax
mov ebp, edx
test edi, edi
jle 0x40812b

Function at 0x408260
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp], ebx
mov byte [esp + 4], 0xb
push esp
push 0
jmp loc.0041634b

Function at 0x408580
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov eax, dword [esp]
xor ebp, ebp
mov edi, edx
test edi, edi
mov ebx, dword [eax + 8]
mov eax, dword [esp]
mov esi, dword [eax + 0xc]
je 0x4085cc
Function at 0x408604
Capabilities:
Packed with generic packer

Disassembly:
imul edx, ecx
cmp edx, dword [ebx + 0xc]
jbe 0x40862f
mov dword [ebx + 8], edx
mov ecx, 0x800
movzx edx, word [eax]
sub ecx, edx
sar ecx, 5
add word [eax], cx
jmp loc.004162bc
sub dword [ebx + 8], edx
sub dword [ebx + 0xc], edx
movzx edx, word [eax]
sar edx, 5
sub word [eax], dx
cmp dword [ebx + 8], 0x1000000
jae 0x408661
mov eax, ebx
call fcn.00408500
mov ecx, dword [ebx + 0xc]
xor edx, edx
shl ecx, 8
mov dl, al
or edx, ecx
mov dword [ebx + 0xc], edx
shl dword [ebx + 8], 8
mov eax, 1
pop ebx
ret

Function at 0x4086f0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
jmp loc.00419066

Function at 0x40871c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], cl
mov edi, edx
mov esi, eax
mov ebx, 1
movzx ebp, byte [esp]
sar ebp, 7
mov edx, ebx
and ebp, 1
add edx, edx
mov eax, ebp
shl byte [esp], 1
shl eax, 8
add eax, eax
add eax, esi
add eax, edx
mov edx, edi
add eax, 0x200
call fcn.004085e0
add ebx, ebx
or ebx, eax
cmp eax, ebp
je 0x40877f
jmp loc.004177e8
cmp ebx, 0x100
jl 0x40872d
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408f24
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], ecx
mov ebx, eax
cmp edx, 0x50
je 0x408f3a
jmp loc.0041656a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408808
test eax, eax
jne 0x408f6c
mov ecx, dword [ebx]
mov edx, 0x300
add ecx, dword [ebx + 4]
shl edx, cl
mov ecx, dword [ebp + 0xc]
add edx, 0x736
add edx, edx
mov dword [ecx], edx
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
mov dword [edx], ecx
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408f84
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40907b
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x408ffe
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, edi
call fcn.00408134
mov edx, dword [ebp - 0xc]
test edx, edx
sar edx, 0
lea eax, [ebp - 0x10]
call fcn.004034f0
cmp dword [ebp - 0xc], 0
je 0x408fee
lea eax, [ebp - 0x10]
jmp loc.00416f24
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004031e8
add esi, 4
dec ebx
jne 0x408fb5
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x409049
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, edi
call fcn.00408134
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004034f0
cmp dword [ebp - 0xc], 0
je 0x409039
lea eax, [ebp - 0x14]
call fcn.00403420
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, edi
call fcn.00408134
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.004031e8
add esi, 4
dec ebx
jne 0x409005
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
shl eax, 2
mov ecx, dword [ebp - 8]
sub ecx, eax
mov edx, esi
mov eax, edi
call fcn.00408134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409082
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409224
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
xor eax, eax
mov al, bl
jmp loc.00416708

Function at 0x409304
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
cmp edi, 0x50
jle 0x40931d
mov eax, esi
mov edx, 0x40c1c8
mov ecx, 0x40
call fcn.0040270c
je 0x409322
call fcn.00409294
mov eax, esi
add eax, 0x40
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
not edx
cmp eax, edx
jne 0x409341
cmp edi, eax
jne 0x409341
cmp dword [ebx], 0xdd
je 0x409346
call fcn.00409294
mov eax, ebx
add eax, 0x10
mov ebp, eax
add esi, dword [ebx + 4]
mov dword [esp], esi
mov eax, dword [esp]
sub eax, ebp
mov edx, eax
mov eax, ebp
call fcn.00407d94
cmp eax, dword [ebx + 0xc]
jne 0x40936f
mov eax, dword [esp]
cmp byte [eax - 1], 0
je 0x409374
call fcn.00409294
mov bl, 0xdd
jmp 0x4184b1

Function at 0x409438
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004093ec
test al, al
jne 0x409459
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4094a5
xor eax, eax
push ebp
push 0x409495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40949c
lea eax, [ebp - 0xc]
call fcn.00409428
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4094b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004093ec
test al, al
jne 0x4094d0
mov byte [ebp - 1], 0
jmp 0x409516
xor eax, eax
push ebp
push 0x409506
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406e98
mov byte [ebp - 1], al
call sub.kernel32.dll_GetLastError_1
jmp loc.00417917
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409650
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4096b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403198
jmp loc.00416c56

Function at 0x4097d0
Capabilities:
Create directory
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4098bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00407170
mov edx, dword [ebp - 8]
mov ecx, 0x4098d8
xor eax, eax
jmp loc.004184f2

Function at 0x4099dc
Capabilities:
Encrypt data using rc4 prga
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409a29
xor ebx, ebx
jmp 0x409a1e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00405090
test eax, eax
jne 0x409a1d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409ad9
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4099ff
mov al, byte [ebp - 1]
sub al, 1
jb 0x409a34
je 0x409a3d
jmp 0x409a46
jmp 0x41832e
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409a48
xor edi, edi
test di, di
jmp 0x418042
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x409b9c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x409bfb
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00405afc
mov edx, 0x404b00
call fcn.0040296c
test al, al
jne fcn.00409be5
push 0x10
mov eax, dword [0x40da8c]
push eax
lea eax, [ebp - 4]
call fcn.00407688
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
jmp loc.00416803

Function at 0x409d6c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
jl 0x409db4
jmp loc.00417ee0
pop esi
pop ebx
ret

Function at 0x409e8c
Capabilities:
Create process on windows
Create process suspended
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f5f
jmp loc.00417759
Function at 0x40a018
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je fcn.0040a0cc
jmp 0x40a0c1

Function at 0x40a0d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push 0xa
push 0x2b67
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x40a0ee
call fcn.00409f88
push ebx
push 0
call sub.kernel32.dll_SizeofResource
cmp eax, 0x2c
je 0x40a100
call fcn.00409f88
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40a113
jmp 0x4167d6
push ebx
call sub.kernel32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x40a124
jmp 0x415854
mov eax, ebx
pop ebx
ret

Function at 0x40a128
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40a178
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x40a190
call fcn.0040322c
push 0x10
push 0x40aa90
mov eax, dword [ebp - 4]
jmp loc.00418bae

Function at 0x415fc5
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, 0x404124
mov eax, eax
pop eax
add ah, dh
dec eax
push 0
leave
popal
popfd
mov dword [esp + 0x194], eax
jmp loc.00405c04

Function at 0x416494
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
jmp loc.00416871
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
jne 0x40a79d
jmp loc.0040a79b

Function at 0x416b68
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
add al, ch
push ebx
push edx
dec ecx
dec ecx
add ch, al
add esp, 8
leave
popal
popfd
call fcn.00403154
jmp loc.00405edf

Function at 0x4181d9
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
push eax
test eax, eax
add esp, 0x10
leave
popal
popfd
mov edx, dword [ebp + 8]
cmp edx, 0x12
jmp loc.0040632f
Function at 0x66f370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x66f38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x698074
push ecx
mov edi, eax
call fcn.00683198
mov esi, eax
add esp, 8
test esi, esi
jne 0x66f3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0068302e
push esi
call fcn.00682fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret