joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402ce4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.140232fc
and dword [ebp - 4], 0
cmp dword [0x14045b44], 0
mov ebx, eax
jne 0x1402cefb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1402cfac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1402cfac
push eax
call fcn.1402328a
mov dword [esp], 0x14037f68
push edi
mov dword [0x14045b44], eax
call esi
push eax
call fcn.1402328a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x14045b48], eax
call esi
push eax
call fcn.1402328a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x14045b4c], eax
call esi
push eax
call fcn.1402328a
pop ecx
mov dword [0x14045b54], eax
test eax, eax
je 0x1402cefb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1402328a
pop ecx
mov dword [0x14045b50], eax
mov eax, dword [0x14045b50]
cmp eax, ebx
je 0x1402cf53
cmp dword [0x14045b54], ebx
je 0x1402cf53
push eax
call fcn.14023305
push dword [0x14045b54]
mov esi, eax
call fcn.14023305
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1402cf53
test edi, edi
je 0x1402cf53
call esi
test eax, eax
je 0x1402cf4a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1402cf4a
test byte [ebp - 0xc], 1
jne 0x1402cf53
or dword [ebp + 0x10], 0x200000
jmp 0x1402cf8c
mov eax, dword [0x14045b48]
cmp eax, ebx
je 0x1402cf8c
push eax
call fcn.14023305
pop ecx
test eax, eax
je 0x1402cf8c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1402cf8c
mov eax, dword [0x14045b4c]
cmp eax, ebx
je 0x1402cf8c
push eax
call fcn.14023305
pop ecx
test eax, eax
je 0x1402cf8c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x14045b44]
call fcn.14023305
pop ecx
test eax, eax
je 0x1402cfac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1402cfae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x43b645
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
sub ebx, 0x2548ceee
call fcn.0043b681
add ebx, 0x39e5d9c2
xor dword [eax], esi
add edx, 0x36fad0e6
add ebx, 0x3141b143
inc eax
add ebx, ebx
sub edx, 0xa6b7e6f6
cmp eax, ecx
jne fcn.0043b645
mov edx, 0xc6536202
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x32d4284c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x51884645
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x5b9e60
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
mov eax, dword [0x7c8028]
mov edx, dword [0x7c802c]
mov dword [esp + 4], 0
lea ecx, [eax + eax]
mov eax, dword [0xbc2068]
or ecx, edx
mov dword [esp], ecx
fild qword [esp]
test eax, eax
fadd qword [0x7c8040]
fstp qword [0x7c8040]
jne 0x5b9f14
push esi
push 0
call sub.comdlg32.dll_ChooseColorA
push str.Crypt32.dll
mov dword [0x7c8e2c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CertCloseStore
push eax
mov dword [0xbc2068], eax
call esi
mov edx, dword [0xbc2068]
push str.CertEnumCertificatesInStore
push edx
mov dword [0xbc2064], eax
call esi
mov dword [0xbc2054], eax
mov eax, dword [0xbc2068]
push str.CertFreeCertificateContext
push eax
call esi
mov ecx, dword [0xbc2068]
push str.PFXImportCertStore
push ecx
mov dword [0xbc204c], eax
call esi
mov edx, dword [0xbc2068]
push str.CryptAcquireCertificatePrivateKey
push edx
mov dword [0xbc2060], eax
call esi
mov dword [0xbc2050], eax
pop esi
add esp, 8
ret

Function at 0x64362e
Capabilities:
Encode data using xor

Disassembly:
pop edi
jno 0x6435f9
retf
push ebx
shr byte [ebp - 0xf0b7a90], cl
and al, 0xf9
stc
mov ecx, 0xbad2d765
xchg ecx, eax
and esi, dword [eax + 0x56c530a]
xlatb
sar byte [edx + 0xab02391], cl
push ebx
insb byte es:[edi], dx
add eax, 0x74538282
adc ecx, dword [edx + 1]
add byte [edx + 0x4a137453], 1
js 0x643616
jo 0x64367c
cmp dword [edi], 0xcfb39a83
mov eax, dword [0x73abd6e1]
aam 0x7a
iretd
loope 0x6435f0
stosd dword es:[edi], eax
jae 0x6435f1
jp 0x6435ac
jge 0x643605
cmp byte [ebx], dh
xor byte [ebp - 0x10], bl
pop ss
sti
les ebx, [edi]
mov word [ecx + 0x65], ss
cdq
dec ebp
call 0x4721b8e7
out 0xa0, al
fsub qword [edi - 0x39ec2a4b]
rol byte [edi], cl
inc ebp
and dword [ebp - 0x1969fa8b], ebp
jae 0x6435fb
out 0x73, al
mov ah, 0x80
je 0x64365c
xor byte [edx + edx + 0x4e], 0x46
dec esi
inc esi
jne 0x643693
xor eax, 0xa2819189
mov cl, 0xb4
jae 0x6435f8
sub byte [edi], al
shld dword [ebx + 0x5c], ecx, cl
pop esp
mov al, 0x4c
sub eax, 0xc6832993
cmp dword [ebx - 0x56], edx
je 0x643618
push ecx
das
popfd
rcl dword [edi], cl
add al, 0xe5
xchg ebx, eax
add eax, 0x84719a72
jmp 0x51446ff0
test dword [eax], ebp
lodsd eax, dword [esi]
out dx, al
mov bl, 0x6d
xchg dword [ecx], edx
push cs
sbb dword [edi + edx*2 + 0x12a4f575], ebp
jns 0x643644
dec eax
adc eax, 0x95b53895
cmp byte [ebp + 0x297ae395], dh
movsd dword es:[edi], dword [esi]
cmc
push eax
in al, 0xd7
xchg ebp, eax
jecxz 0x643710
sub dword [ebp - 0x281baf0b], esp
pop esp
clc
xor cl, al
stosd dword es:[edi], eax
xor ah, byte [0x15208508]
inc dword [edi + 0x51506055]
push ecx
sbb eax, 0xe6bdb03e
popal
out 0x61, al
mov byte [0xf9d9929d], al
fucom st(2)
mov dh, 0x23
jne 0x643691
xor dword [edx - 0x73], edx
inc ecx
clc
and byte [ebp + 0x61], al
insd dword es:[edi], dx
cwde
jns 0x6436b2
mov esi, 0xc5668107
xchg ecx, eax
shr byte [esi - 0x4cc9ca16], 0xe7
jmp 0x6436ef
push esi
test dword [ebp + 0x3394816e], eax
fisub dword [esi + 0xf3a7f7]
invalid
aaa
inc esi
movsb byte es:[edi], byte [esi]
pop esi
invalid
Function at 0x643d2e
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec esp
push edx
cmpsb byte [esi], byte es:[edi]
xchg edi, eax
jecxz 0x643da9
add eax, 0xd1bbc5b5
fidiv word [esi - 0x6d2e896e]
out 0x23, al
xchg edx, eax
push esp
add edx, dword [ebp - 0x3f5bcafb]
mov al, 0x75
adc dword [ebx + 0x75], esp
pop esp
and ecx, dword [ebp - 0x66a35f27]
mov eax, dword [0xe6d4c705]
adc eax, 0x80cd87d4
add eax, 0x15e6d4c7
aam 0x87
int 0x80
mov cl, 0xad
xor ebp, esi
jb 0x643d7a
inc ebp
mov byte [0x585c7f1d], al
adc eax, 0x5aace06a
retf
invalid
jge 0x643d56
xor edx, esp
invalid

Function at 0x68e59e
Capabilities:
Encode data using xor

Disassembly:
pop ebp
das
xor byte [edi - 0x5a], dl
push ecx
xchg esp, eax
lahf
push ss
mov edx, edx
outsd dx, dword [esi]
sub byte [esi - 0x78], cl
out dx, al
push esi
std
sbb bh, byte [eax - 0x7d134f0c]
and byte [esi + 0x26163650], bl
loopne 0x68e59c
cdq
wait
insb byte es:[edi], dx
movsb byte es:[edi], byte [esi]
mov ecx, 0xa5fc87f7
cmp ah, ah
out 0x94, al
mov byte [ebp + edi*4 + 0x41f61747], 0x5f
test dl, 0xe2
pop edi
not byte [ecx + 0x46]
mov ecx, 0x12a92056
movsb byte es:[edi], byte [esi]
xchg esi, eax
clc
mov al, 2
cmp dword [ebp + 0x794d652], ebp
loopne 0x68e5f2
aad 0x2a
jg 0x68e626
push esp
test dword [ecx - 0x5227d399], edi
mov ecx, 0xadd82c67
in al, 0xb
xchg esp, eax
adc al, 0x37
jmp 0x5b643b7e
leave
test byte gs:[ebp + 0x78a514c5], dl
invalid
Function at 0x6d9e0e
Capabilities:
Encode data using xor

Disassembly:
lds edx, [edi + 0x6a]
jno 0x6d9d9e
fisttp qword [edx]
xchg ecx, eax
push 0xfffffffffffffff1
push eax
xor dword [edx + eax*2], eax
shr byte [ebp + 0x50c0f075], 0x2d
jno 0x6d9da3
or dword [eax - 0xfb48f47], edx
add eax, ecx
cld
inc edi
push ebx
push ebp
fist dword [edx - 0x4f]
movsd dword es:[edi], dword [esi]
arpl word [eax + 0x28a015c], di
pushfd
and eax, 0x3833b75
or ch, 0x8a
and byte [0xb1475d30], bh
xchg ecx, eax
cmp eax, 0xe09531ca
dec ebx
rcl ebx, 1
push esp
clc
xchg edx, eax
salc
dec edx
xchg ecx, eax
fdiv qword [edx - 0x4b0d5981]
push eax
push ecx
adc byte [ebx + esi*8 + 0x400e3ebf], al
and dword [eax + 1], edx
push ebp
in eax, dx
mov al, 0x3c
inc edx
invalid
jno 0x6d9da1
adc dword [eax + 0x7b7d694d], edx
jge 0x6d9e92
xor dword [eax - 0x4f], eax
push eax
push ecx
cmp byte es:[ecx + 0x30], 0xd4
loopne 0x6d9e4d
out dx, al
cmc
xor ah, cl
pushal
push esp
fadd qword [ecx + 0x50]
mov bh, 0x10
add dword [ecx + 0x51], ebp
adc dword [ebp + 0x23], ecx
jge 0x6d9e67
pushal
dec esp
imul ebx, dword [edx + eax - 0x3b], 0x4f14bd04
rcl dword [eax - 0x436c17ef]
loope 0x6d9e15
xchg ecx, eax
add byte [ecx + 0x2161b090], 2
mov al, 0x61
and dword [edx], eax
and eax, eax
salc
jb 0x6d9ead
xor al, 0x86
inc ebx
sub dword [eax], ebp
js 0x6d9de1
das
nop
int 0xa4
mov dh, 6
push 0xc398a9e2
push ds
shl eax, cl
fdiv dword [eax + 0x51b6e123]
adc esp, dword [edi + 0x73]
push 0x2de2b8e3
rol byte [ebx], 0x78
add al, 0x77
mov al, 0x45
sbb dword [edi - 0x5c0139cc], ecx
invalid
cwde
ret
cmp eax, 0x272332
xchg esp, eax
and dword [0x136c02a2], 0xfffffff2
sub al, byte [ebx]
salc
jmp 0xdd9f6551
mov bh, 0xf5
outsb dx, byte [esi]
adc al, 0x9f
mov ebp, 0xe0139d92
and byte [esi + ecx*8], ah
push eax
sbb dword [eax + 0x6c], ecx
sub edi, edi
rol dword [esi - 0x4dccdf6f], 1
sal dword [ebx + 0x6651d8e0], 0x77
cwde
add byte [edx], 0xd
pop es
and byte [edi], dh
fdivr dword [esi + edi - 0x3da3248d]
jne 0x6d9ede
adc byte [ebx + eax*2 - 0x6832b91a], 0x54
nop
adc ebx, edx
movsb byte es:[edi], byte [esi]
adc esi, dword [ebx + edx*2 + 0x38e2c588]
inc ebp
adc al, 0xb4
xor dword [esi], edi
cmp al, 0xa5
push eax
push ds
movsd dword es:[edi], dword [esi]
std
mov dword [0x7c374301], eax
ficom word [ebx - 0xc]
xchg esi, eax
xchg ecx, eax
mov edi, 0x13a93cee
sbb al, 0xef
and dword [ebp + 0x39511114], eax
invalid
Function at 0x724e9e
Capabilities:
Encode data using xor

Disassembly:
adc dword [eax - 0x5e4ccb13], 0xffffff93
mov ss, word [edx]
add ecx, dword [ebp - 0x259b656f]
sar byte [edx], 0xaa
sbb al, 7
jle 0x724f11
adc bh, byte [ecx + 0x18]
rol byte [esi + 0x73], 0xf9
push eax
or esp, dword [esi + 0x41]
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
enter 0xd37, 0xfffffffffffffff9
mov bl, 0xe8
pop eax
sti
and ebp, 0xffffffac
sal bl, cl
ret
mov dword [0xd409a4a9], eax
cmp eax, 0xda31a209
push eax
pushfd
repne outsb dx, byte [esi]
salc
outsb dx, byte [esi]
bound ebp, qword [ebp - 0x279f8a8d]
loopne 0x724ebc
xchg esp, eax
imul eax, dword [eax + 0x60dfd698], 0x8d2a743
fdivr dword [esi + 0x43d8742e]
je 0x724eeb
inc ebx
enter 0xfffffffffffff80f, 0x14
out 0x60, eax
sbb al, byte [eax]
inc esi
dec ecx
inc eax
movsd dword es:[edi], dword [esi]
push es
shl byte [edi + 0x5949d732], 0xe9
lodsd eax, dword [esi]
xor ecx, dword [edi]
in eax, 0xd8
invalid

Function at 0x76f30e
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x96db8905
in al, dx
sub byte [eax - 0x77ffccb6], bl
fdivr st(3)
mov cl, 0x42
invalid

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x13210f44
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0xf1d30b8
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x47d0b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.DATA
lea edi, [esi - 0x52000]
push edi
or ebp, 0xffffffff
jmp 0x47d0d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47d0d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47d0c8
mov eax, 1
add ebx, ebx
jne 0x47d0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47d0fc
jne 0x47d10c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47d10c
dec eax
add ebx, ebx
jne 0x47d108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47d0e0
xor ecx, ecx
sub eax, 3
jb 0x47d124
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47d196
sar eax, 1
mov ebp, eax
jmp 0x47d12f
add ebx, ebx
jne 0x47d12f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x47d13c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x47d160
inc ecx
add ebx, ebx
jne 0x47d14c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47d141
jne 0x47d15d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47d141
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47d180
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47d171
jmp 0x47d0ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47d180
add edi, ecx
jmp 0x47d0ce
pop esi
mov edi, esi
mov ecx, 0x43
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47d19e
cmp byte [edi], 9
jne 0x47d19e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x47d1a3
lea edi, [esi + 0x7b000]
mov eax, dword [edi]
or eax, eax
je 0x47d21b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7f1f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7f254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47d1d0
mov ecx, edi
jns 0x47d1ff
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7f258]
or eax, eax
je 0x47d215
mov dword [ebx], eax
add ebx, 4
jmp 0x47d1ed
call dword [esi + 0x7f25c]
popal
jmp 0x401540
Function at 0x10004160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkPlatformLocation_Awareness
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100041c3
push 0x380
push dword [ebp + 0xc]
push 3
push eax
push str.LastBackup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
test eax, eax
je 0x100041c9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100049c0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a0
mov eax, dword [0x10018008]
xor eax, esp
mov dword [esp + 0x39c], eax
movaps xmm0, xmmword [str.F147EC_C7F5_F89]
lea eax, [esp + 0x380]
push esi
push edi
push eax
push 1
push 0
movups xmmword [esp + 0x394], xmm0
mov dword [esp + 0x3a4], 0x394a2d41
mov dword [esp + 0x3a8], 0x44353941
mov word [esp + 0x3ac], 0x7d
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test esi, esi
je 0x10004a43
test al, al
je 0x10004a59
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.1000599e
mov esp, ebp
pop ebp
ret
mov ecx, 0xe0
lea edi, [esp + 8]
mov esi, str.SecureTimeClient
xor eax, eax
rep movsd dword es:[edi], dword [esi]
nop dword [eax + eax]
mov cl, byte [esp + eax + 0xc8]
lea eax, [eax + 1]
mov byte [eax + 0x1001b71f], cl
test cl, cl
jne 0x10004a70
push ecx
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.10004160
mov ecx, dword [esp + 0x3b0]
add esp, 0xc
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1000599e
mov esp, ebp
pop ebp
ret

Function at 0x10004cc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
test edi, edi
je 0x10004d2e
cmp dword [0x1001b718], 0
jne 0x10004cef
push 4
call fcn.100059af
add esp, 4
mov dword [0x1001b718], eax
mov dword [eax], 0
mov dword [eax], vtable.PluginProvider.0
push esi
push 4
call fcn.100059af
mov ecx, dword [0x1001b718]
mov esi, eax
push 8
mov dword [esi], ecx
call fcn.100059af
add esp, 8
lea ecx, [ebp - 4]
mov dword [eax + 4], edi
push ecx
push 0
push eax
push 0x10004ca0
push 0
mov dword [eax], esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4041e0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
push 0
push 0x4eb8c4
push 0x500
push eax
call fcn.0048ea20
test eax, eax
je 0x4041ff
xor eax, eax
pop esi
ret
mov eax, dword [0x4eb8c4]
mov ecx, dword [eax]
push 0
push 0x4eb8c8
push 0x4a8a00
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40421e
xor eax, eax
pop esi
ret
mov eax, dword [0x4eb8c8]
mov edx, dword [eax]
push 0x4a8a78
push eax
call dword [edx + 0x2c]
test eax, eax
je 0x404236
xor eax, eax
pop esi
ret
mov eax, dword [0x4eb8c8]
mov esi, dword [esp + 8]
mov ecx, dword [eax]
push 6
push esi
push eax
call dword [ecx + 0x34]
test eax, eax
je 0x404250
xor eax, eax
pop esi
ret
mov eax, dword [0x4eb8c4]
mov edx, dword [eax]
push 0
push 0x4eb8cc
push 0x4a8a10
push eax
call dword [edx + 0xc]
test eax, eax
je 0x40426f
xor eax, eax
pop esi
ret
mov eax, dword [0x4eb8cc]
mov ecx, dword [eax]
push 0x4a8a60
push eax
call dword [ecx + 0x2c]
test eax, eax
je 0x404287
xor eax, eax
pop esi
ret
mov eax, dword [0x4eb8cc]
mov edx, dword [eax]
push 6
push esi
push eax
call dword [edx + 0x34]
test eax, eax
je 0x40429d
xor eax, eax
pop esi
ret
cmp dword [0x4c2228], 2
jne 0x404354
push 0
push 0
push 0
push 0
call dword [0x4a1180]
test eax, eax
mov dword [0x4eb8d0], eax
jne 0x4042c3
pop esi
ret
mov ecx, dword [0x4eb8cc]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x30]
test eax, eax
je 0x4042d8
xor eax, eax
pop esi
ret
mov eax, 0x10
push 0x4eb8b0
mov dword [0x4eb8b4], eax
mov dword [0x4eb8c0], eax
mov eax, dword [0x4eb8cc]
push 1
mov dword [0x4eb8b0], 0x14
mov dword [0x4eb8b8], 0
mov dword [0x4eb8bc], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x40431f
xor eax, eax
pop esi
ret
push 0x4eb8a8
push 0
push 0x4eb8b0
push 0x4040e0
push 0
push 0
call fcn.0044f2cb
add esp, 0x18
test eax, eax
mov dword [0x4eb8d4], eax
jne 0x404347
pop esi
ret
push 0x17
call dword [0x4a13d4]
mov dword [0x4eb8ac], eax
mov eax, dword [0x4eb8c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
mov eax, dword [0x4eb8cc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, 1
pop esi
ret
Function at 0x406760
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0x1f48
push 0x40
call dword [0x4a1194]
mov ebx, eax
test ebx, ebx
jne 0x406788
push str.Global_Alloc_Error
push 0xd09bfc
call dword [0x4a1204]
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [0x8ed8fc]
push edi
mov ecx, 0x3e8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0xd0abf0]
lea edi, [ebx + 0xfa0]
mov ecx, 0x3e8
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebx + 0x1f40]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, dword [0x4c239c]
test eax, eax
je 0x40680c
push ebp
xor esi, esi
call fcn.0044ea0b
and eax, 0x800000ff
jns 0x4067d8
dec eax
or eax, 0xffffff00
inc eax
mov edx, ebx
mov edi, 0x1f40
xor ecx, ecx
mov cl, byte [edx]
mov ebp, ecx
and ebp, 0xff
xor cl, al
xor ebp, 0xd3
xor cl, 0xf4
add esi, ebp
mov byte [edx], cl
inc edx
dec edi
jne 0x4067df
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop ebp
mov edx, dword [esp + 0x10]
push 0x1f48
push ebx
push edx
call fcn.00406090
add esp, 0xc
test eax, eax
pop edi
pop esi
push ebx
jne 0x406830
call dword [0x4a1190]
xor eax, eax
pop ebx
ret
call dword [0x4a1190]
mov eax, 1
pop ebx
ret

Function at 0x406840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0xfa8
push 0x40
call dword [0x4a1194]
mov ebx, eax
test ebx, ebx
jne 0x406868
push str.Global_Alloc_Error
push 0xd09bfc
call dword [0x4a1204]
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [0xd0abec]
push edi
mov ecx, 0x3e8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebx + 0xfa0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, dword [0x4c239c]
test eax, eax
je 0x4068d9
push ebp
xor esi, esi
call fcn.0044ea0b
and eax, 0x800000ff
jns 0x4068a5
dec eax
or eax, 0xffffff00
inc eax
mov edx, ebx
mov edi, 0xfa0
xor ecx, ecx
mov cl, byte [edx]
mov ebp, ecx
and ebp, 0xff
xor cl, al
xor ebp, 0xd3
xor cl, 0xf4
add esi, ebp
mov byte [edx], cl
inc edx
dec edi
jne 0x4068ac
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop ebp
mov edx, dword [esp + 0x10]
push 0xfa8
push ebx
push edx
call fcn.00406090
add esp, 0xc
test eax, eax
pop edi
pop esi
push ebx
jne 0x4068fd
call dword [0x4a1190]
xor eax, eax
pop ebx
ret
call dword [0x4a1190]
mov eax, 1
pop ebx
ret

Function at 0x406910
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push ecx
call fcn.00405940
add esp, 8
test eax, eax
jne 0x406927
ret
cmp dword [esp + 4], 0x1f48
je 0x406944
push str.Not_Flag_file.
push 0xd09bfc
call dword [0x4a1204]
xor eax, eax
ret
mov ecx, dword [0x4c239c]
test ecx, ecx
push esi
push edi
je 0x40697f
push ebx
mov bl, byte [eax + 0x1f40]
xor esi, esi
mov edx, eax
xor bl, 0xb1
mov edi, 0x1f40
mov cl, byte [edx]
xor cl, bl
xor cl, 0xf4
mov byte [edx], cl
and ecx, 0xff
xor ecx, 0xd3
add esi, ecx
inc edx
dec edi
jne 0x406963
pop ebx
mov edi, dword [0x8ed8fc]
mov esi, eax
mov ecx, 0x3e8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0xd0abf0]
lea esi, [eax + 0xfa0]
mov ecx, 0x3e8
push eax
rep movsd dword es:[edi], dword [esi]
call dword [0x4a1190]
pop edi
mov eax, 1
pop esi
ret