joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eb3a0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x100eb483
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x100eb41d
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
jmp 0x100eb46e
shl edx, 0x10
cmp edi, 2
jne 0x100eb42d
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x100eb45a
lea edx, [edi + 0x3c]
jmp 0x100eb467
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x100eb3c0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret

Function at 0x100f1ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100f41f8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1014f644]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.10071aee
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
xor ebx, ebx
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push ebx
add edi, 0x14
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov dword [esp + 0x28], ebx
mov byte [ecx], bl
call fcn.10006dc0
mov dword [esi + 0x30], vtable.boost::exception.0
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x100f1c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100f4260
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1014f644]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10071aee
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push 0
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.10006dc0
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 1
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x100f1cf4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x100f21a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100f43c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1014f644]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1014f644]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [0x1015192c]
cmp eax, 0xffffffff
jne 0x100f21e0
xor esi, esi
jmp 0x100f21e9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x18], esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x58], 0
test esi, esi
je 0x100f223d
nop
cmp dword [esi + 0x14], 0
jne 0x100f228a
cmp dword [esi + 0x10], 0
jne 0x100f2290
push 0x100f12b0
push 0x1015a4b8
call fcn.100f14e0
mov eax, dword [0x1015192c]
add esp, 8
cmp eax, 0xffffffff
je 0x100f2341
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x58], 0xffffffff
test esi, esi
je 0x100f226b
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x100f226b
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100719c1
add esp, 0x48
ret
cmp dword [esi + 0x10], 0
je 0x100f22d2
mov ebp, dword [esi + 0x10]
mov eax, dword [ebp + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp]
test ecx, ecx
je 0x100f22c0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x10], 0
jne 0x100f2290
cmp dword [esi + 0x14], 0
je 0x100f220a
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100f22f7
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x100f232a
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100f232a
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
lea ecx, [ebp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100f232a
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x14], 0
jne 0x100f22dc
jmp 0x100f2200
call fcn.10070bb0
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov edi, 0xb
mov dword [esp + 0x18], str.boost::thread_resource_error
call fcn.10071a69
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
mov dword [esp + 0x1c], vtable.boost::thread_resource_error.0
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x5c], 1
call fcn.100f2130
int3
jmp 0x100f21a0
Function at 0x100f23a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100f43c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1014f644]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1014f644]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [0x1015192c]
cmp eax, 0xffffffff
jne 0x100f21e0
xor esi, esi
jmp 0x100f21e9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x18], esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x58], 0
test esi, esi
je 0x100f223d
nop
cmp dword [esi + 0x14], 0
jne 0x100f228a
cmp dword [esi + 0x10], 0
jne 0x100f2290
push 0x100f12b0
push 0x1015a4b8
call fcn.100f14e0
mov eax, dword [0x1015192c]
add esp, 8
cmp eax, 0xffffffff
je 0x100f2341
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x58], 0xffffffff
test esi, esi
je 0x100f226b
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x100f226b
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100719c1
add esp, 0x48
ret
cmp dword [esi + 0x10], 0
je 0x100f22d2
mov ebp, dword [esi + 0x10]
mov eax, dword [ebp + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp]
test ecx, ecx
je 0x100f22c0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x10], 0
jne 0x100f2290
cmp dword [esi + 0x14], 0
je 0x100f220a
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100f22f7
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x100f232a
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100f232a
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
lea ecx, [ebp + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x100f232a
mov eax, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, ebp
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
cmp dword [esi + 0x14], 0
jne 0x100f22dc
jmp 0x100f2200
call fcn.10070bb0
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov edi, 0xb
mov dword [esp + 0x18], str.boost::thread_resource_error
call fcn.10071a69
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
mov dword [esp + 0x1c], vtable.boost::thread_resource_error.0
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x5c], 1
call fcn.100f2130
int3
jmp 0x100f21a0
Function at 0x401e60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x401f47
test edx, edx
je 0x401f47
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x401eaf
xor edi, edi
mov esi, 0x1505
nop dword [eax + eax]
movzx ecx, byte [edx + edi]
test ecx, ecx
je 0x401eb4
mov ebx, esi
shl ebx, 5
add ebx, esi
mov esi, ebx
and esi, ecx
xor ebx, ecx
lea esi, [ebx + esi*2]
inc edi
cmp ebp, edi
jne 0x401e90
jmp 0x401eb4
mov esi, 0x1505
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x401f47
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x401ee4
inc ebx
dec ebp
je 0x401f45
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401f45
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401ee0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00417b20
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401ee0
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00417b50
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401ee0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401f47
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4023a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4024a6
test edx, edx
je 0x4024a6
mov dword [esp], edx
cmp dword [esp + 0x2c], 0
je 0x4024a6
mov ebx, ecx
mov edi, dword [esp]
push edi
call fcn.00417b20
add esp, 4
mov dword [esp + 4], eax
test eax, eax
je 0x402411
xor eax, eax
mov ebp, 0x1505
nop word [eax + eax]
movzx ecx, byte [edi + eax]
test ecx, ecx
je 0x402416
mov edx, ebp
shl edx, 5
add edx, ebp
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebp, [edx + esi*2]
inc eax
cmp dword [esp + 4], eax
jne 0x4023f0
jmp 0x402416
mov ebp, 0x1505
mov edi, dword [ebx + 0x20]
lea esi, [edi - 1]
mov edx, edi
sub edx, 1
jae 0x4024ae
mov eax, 0xffffffff
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x1c]
mov edi, dword [esp + 0x2c]
jb 0x402470
mov ecx, ebx
call fcn.004025e0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x4024a6
mov esi, ebx
mov ebx, dword [esp]
push ebx
call fcn.00417b20
add esp, 4
mov ecx, esi
mov edx, ebx
mov ebx, esi
lea esi, [esp + 0x14]
push esi
push ebp
push eax
call fcn.00402530
add esp, 0xc
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
mov esi, dword [esp]
mov dword [edx + ecx*4], esi
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x18]
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x18]
mov dword [ecx + edx*4], edi
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
mov dword [ecx + edx*4], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x18]
mov dword [eax + ecx*4], ebp
inc dword [ebx + 0x18]
mov eax, dword [ebx]
mov dword [edi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and esi, ebp
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
jmp 0x4024c8
inc esi
dec edi
je 0x402427
mov eax, esi
and eax, edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + eax*4]
cmp ecx, 0xffffffff
je 0x40242c
mov eax, ebx
mov eax, dword [ebx + 8]
cmp dword [eax + ecx*4], ebp
jne 0x4024c0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00417b20
mov edx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4024c0
push dword [esp + 4]
push dword [esp + 0x10]
push dword [esp + 8]
call fcn.00417b50
mov edx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x4024c0
mov eax, 0xffffffff
jmp 0x4024a6
Function at 0x402da0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402f56
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
movzx edi, si
shr esi, 0x10
test eax, eax
je 0x402f4f
mov ecx, 0x5e6ea9af
mov ebx, eax
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ebx, eax
jmp 0x402e2c
add ebp, dword [esp + 0xc]
mov eax, esi
mov ecx, 0x80078071
mul ecx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mul ecx
imul eax, ebx, 0xfff1
sub esi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 4]
mov ebx, 0x15b0
je 0x402f4f
xor eax, eax
cmp ebx, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 4], ebx
jb 0x402eb6
mov eax, ebx
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop word [eax + eax]
movzx ecx, byte [ebp]
movzx eax, byte [ebp + 1]
mov ebx, edi
xor ebx, ecx
and edi, ecx
movzx ecx, byte [ebp + 2]
lea ebx, [ebx + edi*2]
movzx edi, byte [ebp + 3]
add esi, ebx
add eax, ebx
mov ebx, esi
xor ebx, eax
and esi, eax
add eax, ecx
add edi, eax
add eax, ebx
lea eax, [eax + esi*2]
add eax, edi
movzx ecx, byte [ebp + 4]
add ecx, edi
mov esi, eax
and esi, ecx
xor eax, ecx
movzx ebx, byte [ebp + 5]
add ebx, ecx
movzx ecx, byte [ebp + 6]
add ecx, ebx
movzx edi, byte [ebp + 7]
add edi, ecx
add ecx, ebx
mov ebx, dword [esp + 4]
add ecx, eax
add ecx, edi
lea esi, [ecx + esi*2]
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x402e50
mov eax, dword [esp]
mov ecx, ebx
sub ecx, eax
jbe 0x402df4
mov dword [esp], eax
not eax
add eax, ebx
mov edx, ebx
and edx, 3
mov dword [esp + 0xc], ecx
je 0x402f01
mov dword [esp + 8], eax
neg edx
xor eax, eax
mov ebx, ebp
nop dword [eax]
movzx ecx, byte [ebx]
inc ebx
add edi, ecx
add esi, edi
dec eax
cmp edx, eax
jne 0x402ee0
mov ecx, dword [esp]
sub ecx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x402df0
jmp 0x402f0f
mov ebx, ebp
mov ecx, dword [esp]
cmp eax, 3
jb 0x402df0
mov eax, dword [esp + 4]
sub eax, ecx
xor edx, edx
nop word [eax + eax]
movzx ecx, byte [ebx + edx]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [ebx + edx + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 3]
add edi, ecx
add esi, edi
add edx, 4
cmp eax, edx
jne 0x402f20
jmp 0x402df0
shl esi, 0x10
or esi, edi
jmp 0x402f5b
mov esi, 1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418450
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0x41856e
lea eax, [edi + 2]
xor ebx, ebx
mov ecx, 1
nop word [eax + eax]
movzx esi, dx
xor edx, edx
cmp esi, 0x800
setb dl
xor edx, 3
cmp esi, 0x80
cmovb edx, ecx
add ebx, edx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x418480
lea ebp, [ebx + 1]
push ebp
call fcn.0044bbd0
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x41857c
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x4184e8
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x41857e
movzx edx, word [edi]
test dx, dx
je 0x41857e
cmp dx, 0x7f
jbe 0x4184d0
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ebp, 0x7ff
ja 0x418530
xor ebp, ebp
cmp ecx, 2
jb 0x4184d7
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x4184d7
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x4184d7
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x4184d7
push 1
call fcn.0044bbd0
add esp, 4
mov esi, eax
jmp 0x41857e
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4185a7
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [esi + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x4185a2
test ebx, ebx
jne 0x4185a0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.0040ec20
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x402a24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404640
test esi, esi
jne 0x402a5a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404730
jmp 0x402a78
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402938
mov edi, eax
test esi, esi
je 0x402a78
cmp dword [ebx], 0
je 0x402a78
dec esi
jmp 0x402a61
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403768
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x455020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403800
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4037e0
xor eax, eax
push ebp
push 0x4037d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40381c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4037e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x455020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x455020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044c4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x457048], 0
je 0x404525
cmp word [0x45721c], 0xd7b2
jne 0x4044ed
cmp dword [0x457224], 0
jbe 0x4044ed
mov eax, 0x457218
call dword [0x457234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x455070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40454c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x455030], 0
jne 0x404541
push 0
push 0x455068
push 0x455070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405924
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405b54
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4059a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405b54
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4059a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405b70
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405a30
xor eax, eax
push ebp
push 0x405a29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040576c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a0e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405b90
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a0e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405b4a
cmp byte [ebp - 0xd], 0
jne 0x405a77
cmp byte [ebp - 0x12], 0
je 0x405b4a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405a90
dec ebx
cmp byte [ebx], 0x2e
je 0x405a9f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405a8f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405b4a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405adc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405b4a
cmp byte [ebp - 0xd], 0
je 0x405b4a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405b4a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret