joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481d30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x481f31
cmp dword [esp + 0x2f8], 0
je 0x481f31
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0043f2b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push 0x49a32c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x481ef8
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x481eeb
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x481eb9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x481eae
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0043f2b0
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.00481c20
add esp, 0x14
test eax, eax
je 0x481eae
cmp byte [esp + 0x24], 0
je 0x481e72
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x481eae
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x481ea1
mov cl, byte [esi + eax]
test cl, cl
je 0x481ea1
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x481e86
jmp 0x481ea5
test edx, edx
jne 0x481ea6
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x481dd0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x481f31
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.00481080
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0043f097
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0043f097
add esp, 0x2ec
ret
Function at 0x4821a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x48231d
cmp ebp, 0x20
jb 0x48231d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.0043f2b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x49a39c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x48231d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x482230
sub eax, edx
cmp eax, 0x40
jne 0x48231d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x48226e
mov cl, byte [esi + eax]
test cl, cl
je 0x48226e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x482256
jmp 0x482272
test edx, edx
jne 0x482273
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x4822ab
mov cl, byte [edx + eax]
test cl, cl
je 0x4822ab
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x482290
jmp 0x4822af
test esi, esi
jne 0x4822b0
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.0043f2b0
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.00481350
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x48231d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.00481080
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0043f097
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0043f097
add esp, 0x50c
ret

Function at 0x482340
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x4a9150]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0043f2b0
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.00481350
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4823ab
mov cl, byte [esi + eax]
test cl, cl
je 0x4823ab
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x482390
jmp 0x4823af
test edx, edx
jne 0x4823b0
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.004811d0
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4823d6
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x49a39c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0043f097
add esp, 0x188
ret
Function at 0x10002dfd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d233
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x10027740]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x10]
call fcn.10001da6
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.10002d9c
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.10002052
mov dword [esi], vtable.std::system_error.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004331
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d527
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10027740]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x10027740]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x1000437f
xor eax, eax
jmp 0x100044fb
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x100043a9
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x100043a9
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x100044fb
cmp dword [esi + 0x50], 0
je 0x100044f9
mov ecx, esi
call fcn.10004ec6
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x100043d6
push dword [esi + 0x50]
push edi
call fcn.10003a87
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x100044f9
mov eax, dword [ebp + 8]
push ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
push 8
mov byte [esp + 0x2c], al
mov dword [esp + 0x44], 0xf
call fcn.100038d2
and dword [esp + 0x50], 0
lea eax, [esi + 0x48]
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x3c]
mov esi, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x2c]
cmp edi, 0x10
lea edx, [esp + 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [esp + 0x2c]
cmovae edx, dword [esp + 0x2c]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
lea eax, [esp + 0x35]
push eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x30]
call dword [edi + 0x1c]
test eax, eax
js 0x100044ec
cmp eax, 1
jg 0x100044cf
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp edi, 0x10
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x14], edx
je 0x1000449c
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [esp + 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.100074e2
mov edx, dword [esp + 0x24]
add esp, 0x10
cmp edx, eax
jne 0x100044ec
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x24]
mov byte [esi + 0x45], 1
cmp dword [esp + 0x20], eax
jne 0x100044ca
test edx, edx
jne 0x10004409
cmp dword [esp + 0x38], 0x20
jae 0x100044ec
push edx
push 8
lea ecx, [esp + 0x30]
call fcn.10003871
jmp 0x10004405
mov ebx, dword [ebp + 8]
jmp 0x100044ec
cmp eax, 3
jne 0x100044ec
mov eax, dword [esp + 0x10]
push dword [eax + 0x50]
push dword [esp + 0x28]
call fcn.10003a87
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10002052
mov eax, ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10005e3f
mov esp, ebp
pop ebp
ret 4
Function at 0x10004d41
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d5bc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10027740]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x10027740]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x10004e7b
cmp byte [ebx + 0x45], 0
je 0x10004e7b
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10004da1
xor al, al
jmp 0x10004e7d
xor eax, eax
mov dword [esp + 0x2c], 0xf
push eax
push 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
call fcn.100038d2
and dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10004e06
dec eax
je 0x10004e0a
dec eax
dec eax
je 0x10004e68
xor bl, bl
jmp 0x10004e6a
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x10004e49
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100074e2
add esp, 0x10
cmp esi, eax
jne 0x10004e02
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebx + 0x45], 0
je 0x10004e68
test esi, esi
jne 0x10004dcc
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.10003871
jmp 0x10004dc4
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10002052
mov al, bl
jmp 0x10004e7d
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10005e3f
mov esp, ebp
pop ebp
ret
Function at 0x100050b1
Capabilities:
Enumerate processes

Disassembly:
push 0x27c
mov eax, 0x1001d604
call fcn.10008624
mov edi, ecx
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
mov eax, dword [edi]
mov dword [edi + 4], eax
call fcn.1000507c
test al, al
jne 0x100051a3
lea edx, [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.100030cc
push 0
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x288], 0x22c
lea eax, [ebp - 0x288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10005190
lea edx, [ebp - 0x264]
lea ecx, [ebp - 0x58]
call fcn.10003065
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.100030cc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x40]
call fcn.10004bcb
test eax, eax
jne 0x10005160
lea eax, [ebp - 0x280]
mov ecx, edi
push eax
call fcn.1000524c
lea eax, [ebp - 0x288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
push 0
push 1
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10002052
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.10002052
test esi, esi
jne 0x10005112
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10002052
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10002052
call fcn.100085e2
ret

Function at 0x100051b5
Capabilities:
Terminate process

Disassembly:
push esi
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x24f82598
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, str._B
mov ebx, 0x42f314
nop
nop
mov ecx, 0x2dd1185e
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40336c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404cd4
test esi, esi
jne 0x4033a2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404dc4
jmp 0x4033c0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403210
mov edi, eax
test esi, esi
je 0x4033c0
cmp dword [ebx], 0
je 0x4033c0
dec esi
jmp 0x4033a9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403b0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x485020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ba4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403b84
xor eax, eax
push ebp
push 0x403b7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403bc0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x485020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x485020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404aa0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48804c], 0
je 0x404b01
cmp word [0x488220], 0xd7b2
jne 0x404ac9
cmp dword [0x488228], 0
jbe 0x404ac9
mov eax, 0x48821c
call dword [0x488238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404b28
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48502c], 0
jne 0x404b1d
push 0
push 0x485758
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404c58
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x485030], 0
je 0x404c7e
mov edx, esi
mov eax, ebx
call dword [0x485030]
jmp 0x404c8d
mov eax, 8
call fcn.00402f20
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x48804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404c20
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408f48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408f9a
test eax, edx
je 0x408f9d
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408f5d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408f83
add ecx, 4
js 0x408f73
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408f80
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408fa9
test edx, edx
jne 0x408f50
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4099c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405164
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4099e6
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x409a07
cmp ebx, 3
je 0x409a07
cmp ebx, 0x7b
je 0x409a07
mov eax, esi
call fcn.00409988
test al, al
jne 0x409a0b
xor eax, eax
jmp 0x409a0d
mov al, 1
pop esi
pop ebx
ret

Function at 0x40c660
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c699
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404dc4
jmp 0x40c6a2
mov eax, ebx
mov edx, esi
call fcn.00404d28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c6ac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c6ce
movzx eax, byte [esp]
jmp 0x40c6d0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cd60
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cbd8
mov eax, dword [0x487438]
cmp byte [eax], 0
je 0x40cddc
mov eax, dword [0x4871a8]
call fcn.00403484
call fcn.0040307c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
add byte [ebp + 0x50042444], cl
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x487140]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48a7f8]
call fcn.004063d0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
Function at 0x40d6e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d7ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404d6c
lea eax, [ebp - 4]
call fcn.004051bc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405164
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d7a4
mov eax, ebx
call fcn.00402f20
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d79d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405164
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d787
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d7cc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d787
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d7a4
mov eax, dword [ebp - 0x10]
call fcn.00402f3c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d7c1
lea eax, [ebp - 4]
call fcn.00404cd4
ret

Function at 0x42430c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x42435a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00424048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x424373
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42437c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00424048
dec esi
jne 0x42439e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret