joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455dc0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455f6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x455f4c
mov dl, 1
mov eax, dword [0x412718]
call fcn.0040365c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404484
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x455f3b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00443848
test al, al
je 0x455f2e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x455f7c
lea eax, [ebp - 0x254]
call fcn.004092b4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x455f2e
xor eax, eax
push ebp
push 0x455f27
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x455fb4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x455f10
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004046f4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x455f10
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004046f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455f2e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x455e31
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416da8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455f72
lea eax, [ebp - 0x260]
call fcn.00404484
ret

Function at 0x4568b4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x470bbc]
cmp byte [eax + 0xa5], 0
jne 0x456925
cmp dword [0x470bd4], 0
jne 0x4568e6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x456870
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x470bd4], eax
cmp dword [0x470bd0], 0
jne 0x456901
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x470bd0], eax
cmp dword [0x470bd8], 0
jne 0x456925
push esp
push 0
push 0
push 0x456814
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x470bd8], eax
pop edx
ret
Function at 0x456fb8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x470bbc]
cmp dword [eax + 0x30], 0
je 0x457062
cmp dword [ebx + 0x94], 0
jne 0x45705c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x456f48
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45705c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x457022
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45705c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414984
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x457031
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457bc0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x457bf5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404574
jmp 0x457c02
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044d8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x458d24
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x458d65
mov eax, esi
call fcn.0043edec
test al, al
je 0x458d65
mov eax, dword [ebx + 0x84]
call fcn.0043eae8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x458d65
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043eae8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x410cb9
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040ae5a
mov dword [ebp - 0x14], eax
cmp dword [0x420540], esi
jne 0x410dac
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x410d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410e8c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x410e8c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410e8c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x420540], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x420544], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x420548], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x420550], eax
test eax, eax
je 0x410da9
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42054c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410dd1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410dc4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x410de6
push 4
pop eax
jmp 0x410e8e
cmp dword [ebp - 0x14], esi
je 0x410de6
push dword [0x420540]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410dcb
mov eax, dword [0x42054c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x410e44
cmp dword [0x420550], edi
je 0x410e44
push eax
call ebx
push dword [0x420550]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410e44
test eax, eax
je 0x410e44
call ecx
test eax, eax
je 0x410e39
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x410e39
test byte [ebp - 8], 1
jne 0x410e44
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410e74
mov eax, dword [0x420544]
cmp eax, edi
je 0x410e71
push eax
call ebx
test eax, eax
je 0x410e71
call eax
mov esi, eax
test esi, esi
je 0x410e71
mov eax, dword [0x420548]
cmp eax, edi
je 0x410e71
push eax
call ebx
test eax, eax
je 0x410e71
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x420540]
call ebx
test eax, eax
je 0x410e8c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x410e8e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403920
mov esp, ebp
pop ebp
ret
Function at 0x405b60
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x418878
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 3
push 0
push 0
push accept
push 0x418aa8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x405c85
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405c7b
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x405c71
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x405c67
cmp dword [ebp - 0x10], 0x100
jae 0x405bfe
jmp 0x405c67
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040cdb0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x405c15
jmp 0x405c67
mov edx, dword [ebp - 0x10]
sub edx, 0x100
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0xc]
jae 0x405c3a
mov edx, dword [ebp - 0x18]
push edx
call fcn.0040a740
add esp, 4
jmp 0x405c67
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
add ecx, 0x100
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00405c90
add esp, 0x10
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
sub edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
jmp 0x405bed
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4062c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x41c], ecx
cmp dword [ebp - 0x41c], 2
jb 0x406335
cmp dword [ebp - 0x41c], 3
jbe 0x4062fc
cmp dword [ebp - 0x41c], 6
je 0x4062fc
jmp 0x406335
push 0x208
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x406335
push 4
push 0x410eb8
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x406335
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x406340
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], reloc.WS2_32.dll_bind
mov dword [ebp - 4], reloc.WS2_32.dll_accept
mov dword [ebp - 0x14], 0
jmp 0x406376
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jae 0x4063e6
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + edx*4 - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4063e4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 4
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.NoDrives
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4063da
cmp dword [ebp - 0x1c], 0
je 0x4063da
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40636d
mov eax, dword [ebp - 0xc]
not eax
and eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x40b110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x4192f8], 0
jne 0x40b124
jmp 0x40b1fc
mov eax, dword [0x4192f8]
shl eax, 3
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040a530
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b1fc
mov dword [ebp - 0x10], 0
jmp 0x40b15a
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x4192f8]
jae 0x40b194
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx*4 + 0x419300]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + 4]
mov dword [ecx + eax*8], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*4 + 0x419300]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [ecx + 8]
mov dword [eax + edx*8 + 4], ecx
jmp 0x40b151
push 0
push 2
push 2
push 0
push 0
push 0x40000000
push 0x4190c8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40b1e3
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3d
push 0x417ca0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [ebp - 4]
push edx
call fcn.0040a740
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x40b360
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov byte [ebp - 0x101], 0
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40b3f7
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x40b3f7
mov dword [ebp - 0x10c], 0
jmp 0x40b3be
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x10c]
cmp dword [ecx + edx*4], 0
je 0x40b3f7
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x10c]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax]
cmp ecx, dword [ebp + 8]
jne 0x40b3f5
mov byte [ebp - 0x101], 1
jmp 0x40b3f7
jmp 0x40b3af
mov al, byte [ebp - 0x101]
mov esp, ebp
pop ebp
ret
Function at 0x40b850
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x4192e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 8], 0
jmp 0x40b873
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x200
jae 0x40b899
push 0
call fcn.0040da30
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x417ca8]
push edx
call fcn.0040b430
add esp, 0xc
jmp 0x40b86a
push 0
push 0
push 3
push 0
push 0
push accept
push 0x4190c8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40b982
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b978
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b96e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x40b92d
mov eax, dword [ebp - 0x18]
add eax, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
jae 0x40b964
cmp dword [ebp - 0x1c], 0x200
jae 0x40b964
push 0
call fcn.0040da30
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
sub eax, dword [edx + ecx*8 + 4]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*8]
push edx
call fcn.0040b430
add esp, 0xc
jmp 0x40b91b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040b0f0
push 0
push 0
push 0
push 0x40b9b0
push 0
mov eax, dword [0x419b04]
push eax
call fcn.0040d6f0
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x40ecc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xa
lea eax, [ebp - 0xc]
push eax
push 7
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x412818
lea ecx, [ebp - 0xc]
push ecx
call sub.ntdll.dll_strcmp
add esp, 8
test eax, eax
jne 0x40ecf2
mov al, 1
jmp 0x40ecf4
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x40ed00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 1
push accept
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40ed48
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40f669
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40f69a
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x40f6a1
cmp ebx, dword [ebp + 8]
jae 0x40f6a1
xor eax, eax
jmp 0x40f887
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40f6b2
xor eax, eax
inc eax
jmp 0x40f886
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40f6c4
cmp ecx, edx
jae 0x40f728
cmp dword [eax + 4], 0
je 0x40f6cd
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40f6b9
cmp dword [ebp + 8], 0
je 0x40f6e7
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40f728
cmp eax, esi
jae 0x40f728
mov ecx, dword [0x419b28]
mov esi, ebx
and esi, 0xfffff000
xor eax, eax
test ecx, ecx
jle 0x40f709
cmp dword [eax*4 + 0x419b30], esi
je 0x40f72f
inc eax
cmp eax, ecx
jl 0x40f6fb
lea eax, [ebp + 8]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
or edi, 0xffffffff
push edi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
jl 0x40f79f
mov eax, dword [ebp + 8]
jmp 0x40f7a1
xor eax, eax
jmp 0x40f886
test eax, eax
jle 0x40f6aa
xor edx, edx
mov ebx, 0x419b70
inc edx
mov edi, ebx
xchg dword [edi], edx
test edx, edx
jne 0x40f6aa
cmp dword [eax*4 + 0x419b30], esi
je 0x40f77e
lea eax, [ecx - 1]
test eax, eax
jl 0x40f76b
cmp dword [eax*4 + 0x419b30], esi
je 0x40f767
dec eax
jns 0x40f75b
test eax, eax
jge 0x40f77c
cmp ecx, 0x10
jge 0x40f777
inc ecx
mov dword [0x419b28], ecx
lea eax, [ecx - 1]
jmp 0x40f77e
je 0x40f796
xor edx, edx
test eax, eax
jl 0x40f796
lea ecx, [edx*4 + 0x419b30]
mov edi, dword [ecx]
inc edx
cmp edx, eax
mov dword [ecx], esi
mov esi, edi
jle 0x40f784
xor eax, eax
xchg dword [ebx], eax
jmp 0x40f6aa
xor eax, eax
test eax, eax
je 0x40f884
cmp dword [ebp - 8], 0x1000000
jne 0x40f884
test byte [ebp - 0xc], 0xcc
je 0x40f816
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40f884
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40f884
cmp word [eax + 0x18], 0x10b
jne 0x40f884
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40f884
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40f816
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40f816
test byte [ecx + 0x27], 0x80
jne 0x40f728
xor eax, eax
inc eax
mov ecx, eax
mov edx, 0x419b70
xchg dword [edx], ecx
test ecx, ecx
jne 0x40f886
mov ecx, dword [0x419b28]
test ecx, ecx
mov edx, ecx
jle 0x40f845
lea eax, [ecx*4 + 0x419b2c]
cmp dword [eax], esi
je 0x40f845
dec edx
sub eax, 4
test edx, edx
jg 0x40f839
test edx, edx
jne 0x40f876
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40f852
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40f86a
lea eax, [edx*4 + 0x419b30]
mov edi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], esi
mov esi, edi
jle 0x40f858
cmp ecx, 0x10
jge 0x40f876
inc ecx
mov dword [0x419b28], ecx
xor eax, eax
mov ecx, 0x419b70
xchg dword [ecx], eax
jmp 0x40f6aa
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x459cf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x51c368]
xor edx, edx
cmp eax, edx
jne 0x459d16
xor eax, eax
mov byte [eax + 0x51c268], al
inc eax
cmp eax, 0x100
jl 0x459cfe
mov dword [0x51c368], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x51c268
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x459da7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x459d7a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x459d48
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x459e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x459e73
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x459e5a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret