joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59c960
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x40
push ebp
mov ebp, ecx
mov ecx, dword [eax]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x4c]
mov al, byte [esp + 0x50]
cmp ecx, 1
mov dword [ebp + 0xc], edx
mov byte [ebp + 0x1058], al
jae 0x59c99c
xor al, al
pop ebp
add esp, 0x40
ret 0x10
cmp ecx, 0x38
jbe 0x59c9aa
mov ecx, 0x38
mov dword [esp + 0x4c], ecx
push ebx
push esi
mov esi, dword [esp + 0x50]
mov edx, ecx
push edi
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp + 0x10]
and ecx, 3
mov dword [esp + 0x54], 0x12
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x5d862c
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x58]
mov ecx, 0x400
mov esi, 0x5d8674
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
xor esi, esi
mov edi, edx
mov bl, byte [ebp + 0x1058]
xor eax, eax
mov byte [esp + 0x5c], bl
mov dword [esp + 0x60], 4
mov bl, byte [esp + 0x5c]
test bl, bl
je 0x59ca1b
xor ebx, ebx
mov bl, byte [ecx]
shl eax, 8
or eax, ebx
inc ecx
jmp 0x59ca25
xor ebx, ebx
mov bl, byte [ecx]
or eax, ebx
inc ecx
shl eax, 8
mov ebx, dword [esp + 0x58]
inc esi
cmp esi, ebx
jne 0x59ca34
xor esi, esi
lea ecx, [esp + 0x18]
mov ebx, dword [esp + 0x60]
dec ebx
mov dword [esp + 0x60], ebx
jne 0x59ca07
mov ebx, dword [edi]
add edi, 4
xor ebx, eax
mov eax, dword [esp + 0x54]
mov dword [edi - 4], ebx
dec eax
mov dword [esp + 0x54], eax
jne 0x59c9f3
xor edi, edi
mov esi, edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0059cae0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x12
jb 0x59ca60
lea ebx, [ebp + 0x58]
mov dword [esp + 0x5c], 4
xor edi, edi
mov esi, ebx
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0059cae0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x100
jl 0x59ca94
mov eax, dword [esp + 0x5c]
add ebx, 0x400
dec eax
mov dword [esp + 0x5c], eax
jne 0x59ca90
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
add esp, 0x40
ret 0x10

Function at 0x59d900
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jle 0x59d92b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor dl, bl
mov byte [esi + eax], dl
inc eax
dec edi
jne 0x59d91b
pop esi
pop ebx
pop edi
ret

Function at 0x59daa0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401943
push esp
mov dword [ebp - 0x24], 0x401660
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019e2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019c3
pop ebp
ret 0x10
Function at 0x73addf
Capabilities:
Encode data using xor

Disassembly:
lea edx, [eax + edx]
lea edx, [edi + ebp]
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x73ae18
mov ecx, dword [esi]
sub esp, 3
jmp 0x73ae9d
lea esp, [esp + 3]
js 0x73adc2
jns 0x73adc2
mov edx, edi
jmp 0x73ae3a
pop edx
mov ecx, 0x3f39797b
mov dx, word [esp]
mov edx, dword [esp]
mov dx, di
add esi, 4
bsf eax, esi
jl 0x73ae49
jge 0x73ae76
mov edx, 0x39caaf3f
dec eax
jne 0x73ae09
retf 0x4839
imul ecx, dword [esi], 0xfffffffd
in eax, dx
push cs
xchg esp, eax
adc dword [ebp + 0x7d526e67], ebx
int3
push edx
jge 0x73ade7
jl 0x73ade7
mov ecx, 0x3f39797b
mov dx, word [esp]
mov edx, dword [esp]
jmp 0x73ae44
lea edx, [eax + edx]
mov dword [edx], ecx
js 0x73adeb
pop edx
jmp 0x73ae1d
mov dx, di
jmp 0x73adfc
mov al, byte [esp]
mov cx, di
mov eax, 0x2bfd3a66
jmp 0x738a3d
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x73ae18
mov al, byte [esp]
mov cx, di
and al, 0x66
mov ecx, edi
mov eax, 0x2bfd3a66
call fcn.0073aed0
xchg ebp, eax
adc byte [esi - 0xfccef1f], al
jp 0x73ae78
invalid
js 0x73ad9e
lea edx, [eax + edx]
lea edx, [edi + ebp]
jmp 0x73ae6c

Function at 0x73d55d
Capabilities:
Encode data using xor

Disassembly:
push 0
jmp 0x73ce5a
call fcn.0073ceb1
call 0x73ce5f
pop eax
sub eax, 0x94e87a7
jmp 0x73d0bb
push 0
jmp 0x73d09f
call 0x73d0a4
pop eax
sub eax, 0x9cbd8c11
jmp 0x73d42f
call dword [eax + 0x94cd537]
jmp 0x73d0df
call 0x73d0d2
pop edi
ja 0x73d12e
jae 0x73d13b
imul esp, dword [ebx + 0x6d], 0xe9500070
rol dword [eax], 0
add cl, bl
pop esi
int3
test eax, eax
je 0x73ce26
jne 0x73d0c3
call 0x73d0ee
pop ecx
jmp 0x73d3b0
mov dword [eax - 0x3d], esp
sbb eax, 0x2444819c
add al, 0x41
sub ebx, esp
dec ebx
call fcn.0073d0b9
lea esp, [esp + 4]
popfd
ret
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
jmp 0x73d38c
call 0x73d1cb
pop eax
jmp 0x73d47f
pushal
mov byte [esp + 5], bh
lea esp, [esp + 0x20]
popfd
ret
add dword [esp + 8], 1
jmp 0x73d766
sub ecx, 0x10015fdc
mov dword [ecx + 0x10016468], eax
mov dword [ecx + 0x1001646d], 0x82444ff
mov word [ecx + 0x10016471], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x447c70a9
jmp 0x73d40b
call 0x73d400
inc edi
je 0x73d43e
outsd dx, dword [esi]
jne 0x73d461
inc esi
imul ebp, dword [ebp + 0x4e], 0x57656d61
add byte [eax - 0x18], dl
pop edi
invalid
cmp ebx, 0x447c7175
je 0x73d46f
jne 0x73d15d
call 0x73d41e
pop ecx
jmp 0x73d6d1
call dword [eax - 0x634428a4]
jmp 0x73d471
and al, 0x20
pushal
jmp 0x73d1c6
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
push es
fstp st(2)
pop es
fiadd dword [edi]
test eax, eax
je 0x73d053
jne 0x73d3e8
sub eax, 0xcf4d97f0
jmp 0x73d54b
call 0x73d55d
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
adc al, 0xe2
dec ebx
iretd
mov edi, dword [0x3ea66fee]
lea esp, [esp - 4]
ret
mov dword [ecx + 0x10016486], 0xfffffdfb
popal
jmp 0x73d397
sub ecx, 0x1001630c
mov byte [ecx + 0x10016485], 0xe9
jmp 0x73d6b0
popfd
lea esp, [esp + 4]
push dword [esp]
lea esp, [esp + 8]
jmp 0x73d67e
Function at 0x7586e3
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
push edi
lea esp, [esp + 4]
jmp 0x72a306
Function at 0x40270c
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40271a
call dword [0x48401c]
or eax, eax
je 0x40271b
ret
mov al, 1
jmp fcn.00402798

Function at 0x402724
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402732
call dword [0x484020]
or eax, eax
jne 0x402733
ret
mov al, 2
jmp fcn.00402798

Function at 0x40273c
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402774
test edx, edx
je 0x40275e
push eax
mov eax, ecx
call dword [0x484024]
pop ecx
or eax, eax
je 0x40276d
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402798
mov dword [eax], edx
mov eax, ecx
call dword [0x484020]
or eax, eax
jne 0x402757
ret
mov al, 1
jmp fcn.00402798
test edx, edx
je 0x402788
push eax
mov eax, edx
call dword [0x48401c]
pop ecx
or eax, eax
je 0x40276d
mov dword [ecx], eax
ret

Function at 0x402798
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x486004]
test ecx, ecx
je 0x4027a8
pop edx
call ecx
dec eax
mov al, byte [eax + 0x4027c1]
jns 0x4027bc
call fcn.0040641c
mov eax, dword [eax + 4]
jmp fcn.004039e8

Function at 0x4027dc
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.0040641c
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4027f1
ret
xor eax, eax
jmp fcn.00402798

Function at 0x402ba4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c3c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c1c
xor eax, eax
push ebp
push 0x402c15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c58
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c1c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402ebc
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402ed6
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402ed6
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402ec2
mov al, 0xa
jmp fcn.00402798
ret

Function at 0x402f08
Capabilities:
Terminate process

Disassembly:
cmp dword [0x486018], 0
je 0x4028c7
call dword [0x486018]
mov eax, 0xd2
jmp fcn.004039e8
push eax
push ecx
mov eax, dword [eax]
call fcn.00402ed8
pop ecx
pop eax
je 0x402f17
jmp ebx
pop ecx
jmp 0x4028b8

Function at 0x402f20
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402ed8
mov eax, ebx
pop ebx
jne 0x402f35
pop ecx
jmp 0x4028b8
ret

Function at 0x404088
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.0040404c
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.0040404c
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x404034
ret
Function at 0x404130
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402798
test ecx, ecx
je fcn.0040404c
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404034
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404208
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x404247
cmp al, 0xb
je 0x404247
cmp al, 0xc
je 0x404251
cmp al, 0xd
je 0x404264
cmp al, 0xe
je 0x404282
cmp al, 0xf
je 0x404247
cmp al, 0x11
je 0x404247
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402798
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x404247
jmp 0x404296
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404251
jmp 0x404296
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404208
dec edi
jg 0x404267
pop ebp
jmp 0x404296
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004041dc
dec edi
jg 0x404285
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40429c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404208

Function at 0x4042d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x4043ba
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404324
cmp al, 0xb
je 0x40433e
cmp al, 0xc
je 0x404355
cmp al, 0xd
je 0x404364
cmp al, 0xe
je 0x404382
cmp al, 0xf
je 0x404398
cmp al, 0x11
je 0x4043a7
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402798
cmp ecx, 1
mov eax, ebx
jg 0x404335
call fcn.004039f4
jmp 0x4043b6
mov edx, ecx
call fcn.00403a18
jmp 0x4043b6
cmp ecx, 1
mov eax, ebx
jg 0x40434c
call fcn.0040404c
jmp 0x4043b6
mov edx, ecx
call fcn.00404064
jmp 0x4043b6
mov eax, ebx
add ebx, 0x10
call fcn.00404f10
dec edi
jg 0x404355
jmp 0x4043b6
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004042d4
dec edi
jg 0x404367
pop ebp
jmp 0x4043b6
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004042a8
dec edi
jg 0x404385
pop ebp
jmp 0x4043b6
mov eax, ebx
add ebx, 4
call fcn.00405768
dec edi
jg 0x404398
jmp 0x4043b6
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00405134
dec edi
jg 0x4043a7
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4043bc
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004042d4
Function at 0x4043c8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4043f4
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402824
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404433
cmp cl, 0xb
je 0x404444
cmp cl, 0xc
je 0x404455
cmp cl, 0xd
je 0x404466
cmp cl, 0xe
je 0x404486
cmp cl, 0xf
je 0x40449f
cmp cl, 0x11
je 0x4044b0
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402798
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403a48
mov eax, 4
jmp 0x4044c1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404088
mov eax, 4
jmp 0x4044c1
lea edx, [esi + eax]
add eax, ebx
call fcn.00404784
mov eax, 0x10
jmp 0x4044c1
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004044e4
pop eax
jmp 0x4044c1
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004043c8
pop eax
jmp 0x4044c1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405780
mov eax, 4
jmp 0x4044c1
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405170
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4043e2
pop ecx
sub ecx, eax
jle 0x4044dd
lea edx, [ebx + eax]
add eax, esi
call fcn.00402824
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4044e4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x40452a
cmp cl, 0xb
je 0x404541
cmp cl, 0xc
je 0x404555
cmp cl, 0xd
je 0x404569
cmp cl, 0xe
je 0x40458a
cmp cl, 0xf
je 0x4045a7
cmp cl, 0x11
je 0x4045bb
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402798
mov eax, ebx
mov edx, dword [esi]
call fcn.00403a48
add ebx, 4
add esi, 4
dec ebp
jne 0x40452a
jmp 0x4045cf
mov eax, ebx
mov edx, dword [esi]
call fcn.00404088
add ebx, 4
add esi, 4
dec ebp
jne 0x404541
jmp 0x4045cf
mov eax, ebx
mov edx, esi
call fcn.00404784
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404555
jmp 0x4045cf
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004044e4
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404572
jmp 0x4045cf
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004043c8
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x40458a
jmp 0x4045cf
mov eax, ebx
mov edx, dword [esi]
call fcn.00405780
add ebx, 4
add esi, 4
dec ebp
jne 0x4045a7
jmp 0x4045cf
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405170
add ebx, 4
add esi, 4
dec ebp
jne 0x4045bb
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x404784
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402798
cmp eax, edx
je 0x40481c
cmp word [eax], 8
jb 0x4047bc
push eax
push edx
cmp word [eax], 0x100
je 0x4047b2
cmp word [eax], 0x101
je 0x4047aa
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4047ba
call dword [0x4863e4]
jmp 0x4047ba
add eax, 8
call fcn.004039f4
pop edx
pop eax
cmp word [edx], 8
jae 0x4047d3
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x4047ee
cmp word [edx], 0x101
jne 0x404808
push eax
call 0x4047c2
pop eax
jmp dword [0x4863ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x4047ff
mov ecx, dword [edx - 8]
inc ecx
jle 0x4047ff
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404738
ret

Function at 0x404c20
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404c2e
mov edx, dword [edx + 8]
jmp fcn.00404088
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404998
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.0040403c
add esp, 0x10
pop ebx
ret

Function at 0x404e00
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x404e26
cmp eax, 0x100
jne 0x404e55
mov eax, 8
cmp edx, 0x11
jbe 0x404e38
cmp edx, 0x100
jne case.default.0x404e4c
mov edx, 8
mov al, byte [eax + 0x484064]
mov dl, byte [edx + 0x484064]
movzx ecx, byte [edx + eax*8 + 0x484078]
jmp dword [ecx*4 + 0x404e67]
mov eax, edx
cmp eax, 0x101
jne case.0x404e4c.0
pop edi
pop esi
call fcn.00404d64
push eax
popf
ret
pop edi
pop esi
jmp 0x404738
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404a8c
xchg edi, eax
call fcn.00404a8c
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404b2c
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404b2c
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404b88
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404b88
fld xword [esp]
add esp, 0xc
jmp 0x404ebf
mov eax, edi
mov edx, esi
call fcn.00404cfc
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404af8
xchg edi, eax
call fcn.00404af8
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x4053a8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405564
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405409
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405580
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40547b
xor eax, eax
push ebp
push 0x405474
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00405200
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40545d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4055a0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40547b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40555c
cmp byte [ebp - 0xd], 0
jne 0x4054bd
cmp byte [ebp - 0x12], 0
je 0x40555c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4054d6
dec ebx
cmp byte [ebx], 0x2e
je 0x4054e5
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4054d5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40555c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405512
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40555c
cmp byte [ebp - 0xd], 0
je 0x40555c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40555c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408800
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403adc
add esp, 0x104
pop ebx
ret
Function at 0x40acbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40acf5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403adc
jmp 0x40acfe
mov eax, ebx
mov edx, esi
call fcn.00403a48
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad08
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ad29
mov al, byte [esp]
jmp 0x40ad2b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4191bc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4191c2
ret

Function at 0x41b71c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41b76d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41b754
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41b744
jmp 0x41b76d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41b755
pop ebx
mov esp, ebp
pop ebp
ret