joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5de67d
Capabilities:
Encode data using xor

Disassembly:
and byte [ebp + ecx*4 + 0x1a], bh
outsb dx, byte [esi]
or bl, 0x60
inc ebx
cmc
out dx, al
inc edx
xor ah, byte [ebx - 0x70]
fnstsw word [ebx]
pop ebx
sub ebx, dword [ecx - 7]
test eax, 0x1b7b9c62
shl byte [edx - 0x6c], 1
jecxz 0x5de51e
sbb edx, eax
bound edx, qword [ebx - 0x4cafc706]
cmp byte [eax - 0x4d], dl
lcall 0xcd74, 0x6b6e0aa2
loop 0x5de530
cdq
insd dword es:[edi], dx
pop edi
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
mov bh, 0x2a
push ds
dec ebx
jge 0x5de565
cld
rep stosd dword es:[edi], eax
div dword [esi - 0x1a]
andnps xmm5, xmm7
out dx, eax
inc eax
cmpsb byte [esi], byte es:[edi]
test byte [edi + 0x1aecfb13], ah
scasd eax, dword es:[edi]
sti
xor eax, 0x482b024a
xor byte [ebp - 0x53], dh
jne 0x5de505
jecxz 0x5de545
and edi, ecx
sbb dword [ebx], ebx
ret 0x8f02
xchg edx, eax
mov byte [ebp + 5], dl
outsb dx, byte [esi]
add esp, dword [eax - 2]
invalid
push 0xdbbb7025
mov byte [edx + 0x3eda1f2], al
jbe 0x5de60c
jns 0x5de556
nop
xor al, 0x4e
xor eax, 0x43c74b01
and eax, 0xd351e77b
pop ecx
retf
pushfd
pop es
xchg ebp, eax
sub edi, dword [eax + ebx]
pushal
push ebp
add ebp, dword [eax + 0x41]
push 0x25cca547
clc
adc al, 0xa0
stc
cmpsd dword [esi], dword es:[edi]
loopne 0x5de5c2
and al, 0x35
xor ebp, dword [edx - 0x3d]
sbb dword [edx - 0x6414e055], edx
das
sbb byte [ecx], ch
loope 0x5de5c7
inc edx
cmp ebx, dword [ebx - 0x41]
cld
add edi, dword [ebx]
dec ebx
xchg ebp, eax
test byte [ecx + 0x6b], dl
jmp 0x5de6a4
jge 0x5de622
pop esp
add eax, ecx
adc eax, 0x413a2348
aam 0x41
jmp 0x801920df
ror dword [ecx - 0x27a75d33], 1
add dword [edx], ebx
into
fdivr dword [ecx + esi*4 + 0x21]
aas
sbb dword [edi], esi
and cl, byte [ebx + 0x73]
mov al, bl
wait
imul eax, dword cs:[0xa3410ce1], 0xffffffa8
clc
or al, 0x68
dec edi
fsub dword [ecx - 0x37e71f58]
fsub st(3), st(0)
wait
push esp
inc edx
mov ecx, 0x3bb746ee
pop ebx
retf 0xf966
Function at 0x60691d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639e0d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606a40
push ecx
lea ecx, [esi + 0x18]
call fcn.0062613d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606a57
push ecx
lea ecx, [esi + 0x24]
call fcn.0062604d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x60bf6e
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
adc dword [esi], ecx
out 0xe3, eax
dec edi
adc dword [edx - 0x55a1dcf9], ebp
cld
adc dword [edi - 0x2e], 0x2fd2adb9
inc ebx
pop esi
outsb dx, byte [esi]
mov eax, 0x3f82669f
fidiv word [ebx + edx*4 - 0x47d269f7]
cmc
daa
xlatb
sub dword [edi], 0x2ee863a4
loopne 0x60bfa7
pop edx
sahf
and dword cs:[edi + 0x54], edi
or al, 0x54
or al, dl
jnp 0x60c010
ret 0x667b
sub ebx, dword [edi + ebx*2]
xchg esp, eax
lahf
aas
sbb esp, dword [edx + 0xfb215b8]
adc cl, al
scasd eax, dword es:[edi]
mov ah, 0x18
mov eax, 0x120fb215
enter 0xffffffffffffb4af, 0x18
aaa
mov bh, dl
inc edx
fld xword [ebx - 0x30]
retf
or al, 9
mov byte [0xca02aba1], al
mov ecx, 0xe66e4cdd
mov esi, 0x5fa4fe90
mov eax, 0xa616849e
xor eax, 0xafcdf6da
adc al, byte [esi + eax]
pushfd
stosb byte es:[edi], al
inc ebp
push eax
arpl word [esi + 0x2b557b37], di
cwde
retf 0x4b79
or ecx, dword [eax + 0xed67e4d]
fisubr dword [ecx + 0x2e]
jle 0x60bfd6
jbe 0x60c03b
pop edi
cmp al, 7
das
shl byte [ebp + 0x4f4049b5], 0x6b
dec esi
loopne 0x60bfe2
imul ecx, dword [esi - 0x20], 0xffffffb7
loop 0x60bfb2
salc
xor dword [ebx - 0x69aae4be], 0xffffffca
sbb edx, dword [ebp - 0x6a]
retf 0xdc67
invalid
invalid
stosd dword es:[edi], eax
push cs
salc
xor al, 0xa7
pop dword [edi - 0xf]
lcall 0xa7eb, 0x14bf152
pop ecx
xor bh, byte [edi - 0x5330b5bd]
pop eax
in al, dx
xchg ah, ah
pop ecx
adc esp, ecx
sar byte [edi], 0x5f
jnp 0x60c0b0
jo 0x60c02b
pop esi
out dx, al
push es
dec ecx
nop
imul ebx, dword [esi + ecx*2 + 0x50ea3305], 0xd
dec esi
add eax, 0xd50ea33
out 0xc5, al
xchg dword [esi], edi
nop
movsd dword es:[edi], dword [esi]
xor edx, ebx
and byte [ebx], 0xf8
loopne 0x60c066
pop esi
inc edi
into
xchg edi, eax
pushfd
pop esp
dec eax
bound esi, qword [edx - 0x17]
xchg esp, eax
rcr dword [edx + ecx - 0x56b7c40e], 1
or al, 0x1d
stc
lodsd eax, dword [esi]
dec ebx
in eax, 0xe
nop
xchg ebp, eax
in al, 0x5d
jl 0x60c027
adc cl, byte [esi]
and ecx, ebp
and si, word [eax - 0x7ebe8806]
stc
nop
aas
stosd dword es:[edi], eax
nop
push dword [ebx]
outsd dx, dword [esi]
cli
fcmove st(0), st(0)
sub al, 0x2d
cmp dh, dl
enter 0x2d2c, 0x38
salc
or dh, 0xbb
sar byte [ebp - 0x398955bf], 0x3b
je 0x60c12f
push esi
jp 0x60c108
rcr dword cs:[ebx - 0x64], 0x26
and al, 0x36
mov bh, 0x5f
adc al, 0x71
mov byte [0x17ad83bf], al
cmp dh, byte [ebx - 0x25]
adc eax, 0x4b9ca602
push ds
cmpsb byte [esi], byte es:[edi]
cld
dec esi
fiadd word [esi + 0x673d465c]
push edi
test dword [esi], 0xc9e09a06
xchg byte [eax], ah
xchg dh, ch
mov eax, dword [0x4709b3ae]
into
cmpsb byte [esi], byte es:[edi]
mov byte [0xa7437f5e], al
bound esp, qword [ecx + esi*4 - 0x4f830a97]
sub eax, 0x590aa2e6
pop ecx
cmpsb byte [esi], byte es:[edi]
push ds
into
pop ecx
int3
push edi
shr byte [edi + 0x65c824d3], 1
rcl dword [ebp + ebp*2 + 0x6b690e1e], cl
invalid
Function at 0x630a4d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [0xca664066], eax
add eax, 0x7652a2df
xor dword [ebp - 0x93d27ad], esi
insd dword es:[edi], dx
imul ebp, dword [esi], 0x1ec95e02
leave
push ds
leave
push ds
mov dh, 0x8c
inc ecx
fscale
and al, 0xc6
sub ecx, dword [esi - 0x53919370]
mov ecx, 0xe752f94b
cmp dl, byte [ebx + 0x7e5e935b]
adc byte ss:[ebx + 0x2fb30eea], dh
and dword [edi], eax
aas
xor ch, byte [eax + 0xf]
pop ebx
push 0xaecade16
jnp 0x630a38
adc ebp, dword [edx - 0x80]
xor ecx, eax
or al, 0x3c
push edi
adc dword [ebp + 0x40], eax
out 0x91, eax
aaa
pop ds
ror byte [ebx], 0xb
mov edi, 0xbf749b9d
xchg dl, cl
xor dword [esi + 0x51abbe9b], esi
or byte [edi + 0x52], 0xb9
lcall 0x96ac, 0x15e33af
das
xor esi, esp
imul ebp, dword [edx - 0x1a], 0xffffffb9
jbe 0x630a80
dec ebx
aaa
fcomp dword [ecx - 0x42]
push cs
lahf
in eax, 0xdd
sbb dl, byte [edx]
test al, 0x72
sub dword [ebp - 0x6dce179], edi
adc al, 0x51
clc
push 0xd102b5d7
movsb byte es:[edi], byte [esi]
ljmp 0xf96e

Function at 0x64d9bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6563a8
cmp edx, dword [eax]
je 0x64d9df
add eax, 8
inc ecx
cmp eax, 0x656438
jl 0x64d9d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6563a8]
jne 0x64db0d
mov eax, dword [0xa59d00]
cmp eax, 1
je 0x64dae7
test eax, eax
jne 0x64da10
cmp dword [0x6562d4], 1
je 0x64dae7
cmp edx, 0xfc
je 0x64db0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64da47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e3a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e830
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64da8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e830
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652b44
push edi
call fcn.00650700
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e3a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e3b0
lea eax, [ebp - 0xa0]
push 0x652b24
push eax
call fcn.0064e3b0
push dword [esi + 0x6563ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e3b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650674
add esp, 0x2c
pop edi
jmp 0x64db0d
lea eax, [ebp + 8]
lea esi, [esi + 0x6563ac]
push 0
push eax
push dword [esi]
call fcn.0064e830
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x415a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x4042fb
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x40434f
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404340
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x40433e
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
jmp 0x40434f
jmp 0x4042fb
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004063d6
mov esp, ebp
pop ebp
ret

Function at 0x4070d4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407113
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407113
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407113
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407113
cmp dword [ecx + 0x74], 0xe
jbe 0x407113
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401de5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x40fe9e
call fcn.0040fe6c
sub esp, 0x1c
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x10], ebx
call fcn.00401d9b
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.00401a05
push eax
mov ecx, ebx
call fcn.004022f7
lea ecx, [ebp - 0x28]
call fcn.00401a05
test eax, eax
je 0x401e71
push edi
mov ecx, dword [ebp + 8]
call fcn.00401a05
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.004022a7
push esi
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.004022a7
push dword [ebp - 0x10]
mov ecx, ebx
mov esi, eax
call fcn.004022a7
mov cl, byte [edi]
xor cl, byte [esi]
mov esi, dword [ebp - 0x10]
mov byte [eax], cl
inc esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], esi
call fcn.00401a05
cmp esi, eax
jb 0x401e27
pop edi
lea ecx, [ebp - 0x28]
call fcn.00401a1a
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4021f7
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0x10], ecx
push edi
mov eax, esi
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x402209
mov ebp, esi
mov edi, esi
mov esi, edx
xor edx, edx
mov bl, byte [esp + edi + 0x18]
mov eax, edi
div esi
movsx eax, byte [edx + ecx]
add eax, ebp
movzx ecx, bl
add ecx, eax
movzx ebp, cl
mov ecx, dword [esp + 0x14]
mov al, byte [esp + ebp + 0x18]
mov byte [esp + edi + 0x18], al
inc edi
mov byte [esp + ebp + 0x18], bl
cmp edi, 0x100
jb 0x40221b
xor esi, esi
mov ebx, esi
mov edi, esi
cmp dword [esp + 0x120], ebx
jbe 0x40229c
mov ebp, dword [esp + 0x11c]
lea eax, [ebx + 1]
movzx ebx, al
mov cl, byte [esp + ebx + 0x18]
movzx edx, cl
lea eax, [edx + esi]
movzx esi, al
mov al, byte [esp + esi + 0x18]
mov byte [esp + ebx + 0x18], al
mov byte [esp + esi + 0x18], cl
movzx eax, byte [esp + ebx + 0x18]
add eax, edx
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [edi + ebp], al
inc edi
cmp edi, dword [esp + 0x120]
jb 0x402262
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x403464
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.0040641c
test esi, esi
jne 0x40349c
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406558
jmp 0x4034ba
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004033a8
mov edi, eax
test esi, esi
je 0x4034ba
cmp dword [ebx], 0
je 0x4034ba
dec esi
jmp 0x4034a3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4034ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x590008], 0x8088405
inc edx
mov dword [ebx + 0x590008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40421c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x590024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4042b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x404294
xor eax, eax
push ebp
push 0x40428d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4042ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404294
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x590024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x590024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405494
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x59b054], 0
je 0x4054f5
cmp word [0x59b330], 0xd7b2
jne 0x4054bd
cmp dword [0x59b338], 0
jbe 0x4054bd
mov eax, 0x59b32c
call dword [0x59b348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405520
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x590030], 0
jne 0x405511
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4056c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x590038], 0
je 0x4056e6
mov edx, esi
mov eax, ebx
call dword [0x590038]
jmp 0x4056f5
mov eax, 8
call fcn.004030f0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x59b055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405688
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x406f7c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x406fbe
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x406fde
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040661c
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x40ad80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x59db60
push 0xa
push 0x40ae14
mov eax, dword [0x59db50]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40ada4
call fcn.004145e8
push ebx
mov eax, dword [0x59db50]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40adbb
call fcn.004145e8
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40adcd
call fcn.004145e8
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x59db64], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x59db68], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x59db6c], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x59db70], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x59db74], ecx
add edx, dword [eax + 0x14]
mov dword [0x59db78], edx
pop esi
pop ebx
ret

Function at 0x40c4c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c571
test eax, edx
je 0x40c574
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40c4f1
push edx
mov edx, eax
mov eax, esp
call fcn.00406638
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40c507
push eax
lea eax, [esp + 8]
call fcn.00406638
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40c516
movzx eax, word [eax]
sub eax, ecx
jmp 0x40c53d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c557
add ecx, 4
js 0x40c52e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40c554
push eax
mov eax, ecx
mov edx, 2
call fcn.00405760
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40c53b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40c53d
xor eax, eax
ret
test eax, eax
je 0x40c584
test edx, edx
jne 0x40c4d8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40d6cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004064a8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40d6ea
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40d70b
cmp ebx, 3
je 0x40d70b
cmp ebx, 0x7b
je 0x40d70b
mov eax, esi
call fcn.0040d68c
test al, al
jne 0x40d70f
xor eax, eax
jmp 0x40d711
mov al, 1
pop esi
pop ebx
ret

Function at 0x40d714
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004064a8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40d72d
test al, 0x10
jne 0x40d731
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x411bfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x411c35
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406558
jmp 0x411c3e
mov eax, ebx
mov edx, esi
call fcn.0040641c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411c48
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x411c6a
movzx eax, word [esp]
jmp 0x411c6c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4123f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x412519
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00412208
mov esi, eax
mov eax, dword [0x599f2c]
cmp byte [eax], 0
je 0x4124c1
mov eax, dword [0x599a94]
call fcn.00403968
call fcn.00403258
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4123d0]
call fcn.00408090
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x412534
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4124fd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x599a00]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x59db50]
call fcn.00408298
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412520
lea eax, [ebp - 4]
mov edx, dword [0x4123d0]
call fcn.004081b0
ret