joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40489c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4048a4
push ecx
push ebx
push esi
mov eax, 0x404864
call fcn.004045d4
mov ebx, 0x4064e4
xor eax, eax
push ebp
push 0x404a82
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402650
cmp eax, 4
jle 0x40492a
lea edx, [ebp - 0x10]
mov eax, 3
call fcn.004026b0
mov eax, dword [ebp - 0x10]
mov edx, 0x4064e0
call fcn.00403370
mov esi, eax
cmp dword [0x4064e0], 0
jne 0x40492a
push 1
call sub.user32.dll_GetDesktopWindow
push eax
push 0x4cc
push esi
call sub.user32.dll_SendMessageA
push 0
call sub.user32.dll_GetDesktopWindow
push eax
push 0x4cc
push esi
call sub.user32.dll_SendMessageA
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004026b0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004047a8
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x404834
call fcn.00403a74
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00403090
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00403cd6
mov eax, ebx
call fcn.00403f57
call fcn.00402568
jmp 0x404a47
mov edx, 0x4064dc
mov eax, ebx
call fcn.004032a8
mov eax, ebx
call fcn.00403ef4
call fcn.00402568
mov edx, dword [0x4064dc]
mov eax, 0x404a98
call fcn.004031fc
test eax, eax
jle 0x404a47
lea eax, [ebp - 0x24]
push eax
mov edx, dword [0x4064dc]
mov eax, 0x404a98
call fcn.004031fc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x4064dc]
call fcn.004031bc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004047dc
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.004026b0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00404770
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004047dc
mov edx, dword [ebp - 0x28]
pop eax
call fcn.004030d4
jne 0x404a47
push 5
push 0
push 0
lea eax, [ebp - 0x34]
push eax
mov edx, dword [0x4064dc]
mov eax, 0x404a98
call fcn.004031fc
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [0x4064dc]
call fcn.004031bc
mov eax, dword [ebp - 0x34]
call fcn.00403178
push eax
push 0x404a9c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x404a5b
mov eax, ebx
call fcn.00403db4
call fcn.00402568
test al, al
je 0x404974
mov eax, ebx
call fcn.00403d78
call fcn.00402568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404a89
lea eax, [ebp - 0x34]
mov edx, 0xa
call fcn.00402f74
ret
Function at 0x4e4934
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4e4962
mov eax, ebx
call fcn.004e53e8
cmp dword [ebx + 0x40], 0
je 0x4e495b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4e49d3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4e49c5
cmp dword [ebx + 8], 0
je 0x4e4984
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4e4996
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e49c5
cmp dword [ebx + 8], 0
je 0x4e4977
cmp eax, 3
je 0x4e49a9
dec eax
jne 0x4e4977
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e4977
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4e4977
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4e49f1
cmp dword [ebx + 0x14], 0xcc
je 0x4e49f1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e49fc
pop ebx
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x40f958
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
mov esp, 0x9e9e6b8c
in al, dx
retf
inc eax
xchg edi, eax
sbb byte [ebp + 0x4cbd75fb], ch
sti
jne 0x40f91c
dec esp
salc
add ebp, ebp
pop ebp
xor edi, dword [ebp - 0x3c473d2c]
pushal
push esp
scasd eax, dword es:[edi]
jno 0x40f95c
out 0x3b, eax
test dword [edx + 0x6ff8dbab], ecx
retf

Function at 0x410bf0
Capabilities:
Check for software breakpoints

Disassembly:
mov ebx, 0x4d0d09de
adc bl, byte [edi + eax - 0x4b614545]
div ebp
sar byte [ecx], 0x80
invalid

Function at 0x41465c
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ebp + 0x657fd91c], 1
push ebp
aas
f2xm1
cld
xor eax, 0x4b10976c
invalid
jbe 0x4145de
jecxz 0x414625
rol byte [edx - 0x149e92b9], cl
push ss
bnd call 0xa7fe9cf1
fstp dword [edx - 0x7d]
pop ebp
xchg edi, eax
add bl, byte [ecx - 0x31]
sbb eax, dword [ebp + 0x15]
inc edi
xchg dword [ecx], ebx
retf 0x1a7a

Function at 0x415e84
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x812592c4
xor ebx, ecx
out 0xa6, eax
out 4, eax
jp 0x415e90
jnp 0x415e9f
push 0x3c
mov bl, 0x7b
sar byte ss:[esi], 0x2c
cmp al, 0xb3
jnp 0x415e6f
sar byte [esi], 0x2c
or al, 0x55
out 0x29, eax
jmp 0x415e4f
movsd dword es:[edi], dword [esi]
sal dword [esi], 0xbe
jns 0x415e26
mov esp, 0x32826a10
dec esi
lodsd eax, dword [esi]
xor byte [edx], ch
xchg esi, eax
push edi
mov eax, dword [0x9324946f]
xchg ebx, eax
loope 0x415eae
inc edi
xor esp, dword [esi]
imul edx, esi, 0xbef9a646
bound ebx, qword [edx + ebx]
mov edi, 0xd3d1bea1
pop ebp
and cl, byte [ebx + 0x77e103a4]
aaa
add byte [ebx + 0x2e511ed6], bh
das
xor byte [edx + 0x1d4f790], ah
pushal
push esp
push ecx
or byte [ecx], cl
nop
jp 0x415e66
jae 0x415ef2
mov word [esi + 0x6d], es
mov al, byte [0x5d5260b4]
pop ebp
aaa
jecxz 0x415ea4
cmp eax, 0x62b6d8f5
loope 0x415ede
cmc
fdiv dword [esi - 0x5acb1e9e]
movsd dword es:[edi], dword [esi]
jbe 0x415e77
nop
adc eax, 0x427dca7a
mov ebp, 0x91bbcc10
popfd
shl byte [ebx - 0x27], 1
cwde
jg 0x415e64
mov ebx, 0x474447a9
and al, 0xf
pop esi
mov al, 0xe0
sahf
mov bl, 0x4d
mov eax, 0xd8397350
lodsb al, byte [esi]
dec esi
push esp
push edi
fld qword [0xa2565f9f]
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
hlt
invalid
Function at 0x417238
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x39
fscale
lds eax, [ebx - 0x64f527ff]
rol byte [edx], 1
push esi
iretd
cmp byte [eax], dl
neg dword [ebx]
push es
pop edx
add dword [edi + 0x67], 0x4ff24627
push es
cmp byte [eax + eax], al
sbb bh, bl
ret
adc eax, 0xf3fccf17
or dword [esp + ebx], 0x1e
push ebp
pop esi
mov dh, byte [0xa17681e2]
sbb eax, dword [ebx - 0x8203f07]
popfd
out 1, eax
fiadd word [eax + 0x1be2c693]
insb byte es:[edi], dx
xor dword [edi], eax
add esi, ebx
adc byte [ebx + 0x6c1be2c6], 0x31
pop es
inc ecx
mov al, byte [0xa9680f21]
push ebx
test eax, 0x6a13f5c
loope 0x41725b
fst dword [eax + 0x23]
jbe 0x4171cb
and byte [ebx + esi - 0x27c5d128], 0xed
push ds
adc bl, 0xb6
jnp 0x417226
sbb al, byte [ecx - 0x3183718b]
invalid
imul eax, esi, 0x67
je 0x4171bc
or eax, 0x3591d3fc
xor eax, dword [ebx]
lcall 0xdad5, 0xee4cf96a
pop ebp
jnp 0x417235
inc ecx
dec ecx
xlatb
std
je 0x417261
fcompp
loopne 0x4171fc
xor byte [esi + 0x6ac2be2b], dl
aad 0x3e
and al, 0x4f
add byte [ebx], al
jo 0x4171e3
jne 0x41729a
sub ch, byte [edx*8 + 0x49c17044]
pop ecx
adc byte [eax - 0x75], ah
cli
invalid
xchg esp, eax
mov cs, word [esi]
out 0x96, al
sbb eax, 0x84f72a71
xchg edi, eax
sub al, 0x70
cmp eax, 0x560aae05
cli
pop ds
mov eax, dword [0x80f4d130]
lahf
pop edx
lodsb al, byte [esi]
test eax, 0xb6a14776
sbb bh, cl
xor eax, 0xff76dc88
invalid

Function at 0x4220e0
Capabilities:
Encode data using xor

Disassembly:
cmc
inc dx
invalid
pushfd
mul dword [ecx + 0x5eb959f5]
push cs
sbb edx, dword [0x9b97cb18]
jnp 0x42213c
jb 0x422076
adc al, 0x57
salc
add byte [ebp + 0xc], 0xb9
push edi
movsd dword es:[edi], dword [esi]
sahf
pop ebp
loope 0x4220fe
jl 0x42214a
and al, 0x77
sbb eax, 0xefc7547c
movsd dword es:[edi], dword [esi]
js 0x4220a4
jl 0x422154
push esp
invalid
pop ebp
popal
imul edi, dword [edx - 0x2be8b94c], 0xc56ae4ae
lds ecx, [ebx + 0x72af8b5a]
invalid
push cs
retf 0x6707
adc eax, 0x8dcfa380
xchg esi, eax
outsb dx, byte [esi]
inc eax
mov byte [esp + edi*8], dl
mov es, esi
out dx, al
inc edx
fild dword [eax]
sub al, 0x4a
xchg byte [edx], bl
pop ecx
popal
sub eax, 0xbc85ffb5
xor dl, bl
aam 0xa4
xor dl, byte [ecx + 0x2e]
arpl word es:[eax + edx + 0x53], dx

Function at 0x428940
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x9a
sti
cmp ah, byte [edx + 0x1b]
scasd eax, dword es:[edi]
imul ecx, dword [edx - 0x4343b327], 0xffffffa9
mov bl, cl
dec esp
invalid
invalid
invalid
test eax, 0x96dea0ae
cmp byte [0xa381e5b5], ch
rcr al, 0xf6
invalid
scasb al, byte es:[edi]
mov al, byte [0x2d3896de]
mov ch, 0xe5
invalid
mov dword [0x32f6d8c0], eax
Function at 0x4294c8
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x13
xor al, 0x18
jb 0x429408
xchg word [ebx - 0x24635616], bp
test edx, edi
adc esi, ebx
ret 0x26ad
lds ebp, [edi + 0x27da875b]
inc ebp
inc esp
invalid
in eax, dx
mov bl, 0x26
invalid
jno 0x429470
cwde
adc dl, byte [edx + 0x518b2eae]
xchg edx, eax
scasb al, byte es:[edi]
mov edx, dword cs:[ecx - 0x33]
std
jae 0x42944f
dec eax
and eax, dword [ebp + esi*4 - 0x2c6f5a15]
push ss
inc ebp
jnp 0x4293ef
jge 0x429402
in al, dx
or byte gs:[edx], dh
add al, 0x77
inc ecx
push ss
idiv byte [edx + 0x36]
pop ecx
in eax, dx
push 0xd8ae0f05
push ebx
xchg ecx, eax
push 0x5f4bf0f6
fnstcw word [edx]
inc esi
sub al, 0x17
mov ch, 0xab
cmp edx, dword [ecx + 0x475cb0fa]
mov ebp, 0x45d1afe
cld
test dword [ecx - 0x6f6a2771], 0xa9130116
mov ebx, 0x1e356d72
push ds
jmp 0x4294a1
das
sub dword [esi + 0x5db1c9c6], 0xffffffb1
xchg ecx, eax
les eax, [ebx - 0x49503d7f]
movsd dword es:[edi], dword [esi]
pop eax
add edx, 0x58a5b6af
jecxz 0x42951c
mov eax, 0x7ea39c0e
mov byte [0x84468e03], al
in al, 0x37
out 0x5b, al
add eax, 0x41dab467
and al, 0xcf
dec eax
xchg ecx, eax
xor eax, 0x90b98693
xor eax, 0xae7f385d
jg 0x429478
and al, 0x20
and eax, 0x15fe0c7
test byte [edx - 0x70], ah
inc ebx
jbe 0x4294be
dec ecx
add byte [ebx], cl
pop esp
jnp 0x42949e
add byte [ecx + 0x5d], 0x16
add al, 0x8a
mov bh, 0xe
push cs
mov byte [0x89e7a00], al
insb byte es:[edi], dx
sbb byte [eax - 0x24], bh
insd dword es:[edi], dx
or al, 0x16
adc byte [edi - 0x46], 0x10
cmp al, 0xfb
xchg edi, eax
js 0x429483
fcmovne st(0), st(0)
inc esi
and eax, 0xe0c28750
mov dword [0x42f9846d], eax
invalid
xchg edi, eax
and edi, dword [edi]
xchg byte [eax + 0xa], cl
jge 0x4294d8
mov edx, esi
outsd dx, dword [esi]
mov dword [edi - 0x73864b68], ecx
pop ebx
adc ebp, dword [edx + edx*4 - 0x26]
wait
pop ebx
adc dword [ebx - 0x3d], ecx
sub esi, dword [ebp - 0x395e68a8]
loopne 0x429540
mov edi, 0x6334e318
sbb bl, ah
xor al, 0x63
lodsb al, byte [esi]
add dword [ebx - 0x62029105], 0x6355cc5f
mov al, 0x7c
xchg esi, eax
mov edi, 0xf6ff2f18
mov edi, 0x78397d9e
dec esi
lahf
sub dh, al
ret

Function at 0x42bd1c
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
insb byte es:[edi], dx
cwde
dec esi
in ax, 0xea
test al, 0x21
xor dword [edx + 0x456f0cf6], 0x6f
xor cl, byte [eax]
rcr dword [eax - 0x24], cl
sti
dec edi
or al, 0x41
aas
dec esp
outsb dx, byte [esi]
cmp al, 0xd1
imul edx, dword [0x86d09029], 0x3c
xor byte [ecx + 0x232cebac], al
fsubr qword [edi - 0xf62d842]
add al, 0xb4
cwde
adc eax, 0x311ca9d6
pop ebx
mov ecx, 0x9ade96f0
dec esi
loope 0x42bd23
and dh, byte [eax + 0x6c]
stosb byte es:[edi], al
mov edi, 0x17d93e05
in eax, 0x31
adc esp, dword [ecx - 0x74a9dc6b]
fdiv dword [edx]
push eax
sbb eax, 0x5f1f14a2
add al, 0x32
int 0xb9
jp 0x42bd8d
xchg esi, eax
xchg esp, eax
invalid
out 0x8c, eax
adc byte [edi], dh
retf 0xe6d8
Function at 0x43414c
Capabilities:
Encode data using xor

Disassembly:
fdiv qword [ecx]
aad 0x3a
dec esi
lcall 0x971b, 0x5c655c13
push edx
wait
inc ebp
invalid
sti
imul esp, dword [ecx - 0x5cb9acb2], 0x7199f08f
inc eax
jle 0x4340b1
inc esp
or byte [ebx], dl
mov dword [edi + 0x91e9ccb], esi
dec ecx
xor byte [eax + 0x7e4a9956], dh
nop
adc ecx, dword [ecx + 0x1e9ccbb7]
or dword [ecx + 0x30], ecx
mov al, 0x56
cdq
dec edx
jle 0x434050
retf
xchg edi, eax
sti
leave
dec ecx
ror ebx, 0x74
or eax, 0x19cf2e4e
cmpsd dword [esi], dword es:[edi]
xor eax, 0x4fda666c
dec edx
cmc
mov esp, 0x8b279f5e
adc ah, byte [eax + eax - 0x5c]
js 0x4340a1
pop ds
loopne 0x434146
jge 0x43413f
adc byte [esp + ebx*4], dh
invalid
out 0x72, eax
jp 0x4340f3
push es
push ebp
in eax, dx
bound ebx, qword [edx + 0x69b2f1e6]
rol dword [edx], 1
add byte [ecx - 0xd], 0xf3
mov dl, 0xb7
jne 0x4340b4
inc esp
mov edx, 0xe6262240
or bl, byte [ecx + 0x77928024]
popfd
lahf
loopne 0x4340c0
push edx
jle 0x434145
jbe 0x434123
sub eax, 0x366fbbd9
jbe 0x434151
jbe 0x4340e9
lds edx, [ecx + 0x5c]
push ecx
pop esp
ret 0xfec0
pushal
cmp byte [eax - 0x54fd2a1e], ch
push cs
mov byte [esi - 9], dh
sbb edi, dword [edx]
mov ebx, dword [edi + 0x81840cc]
mov edi, 0xbbb51303
cmp cl, byte [ebx + 0x1840cc9f]
or byte [edi - 0x444aecfd], bh
xor dword [edx + 0x60], 0xffffffd0
xchg byte [eax + 0x2f], bl
clc
and al, 9
jns 0x43415d
xor esp, 0x16
shl dword [edx], cl
int1
loopne 0x4340fd
rcr dword [eax - 0x36755033], 1
add esi, dword [edx]
cmp dword [esi], eax
cmc
dec ebp
add edx, ebx
sbb al, 0xb3
push esi
pop edx
invalid
xchg ecx, eax
dec ebp

Function at 0x43bdc8
Capabilities:
Encode data using xor

Disassembly:
out dx, al
invalid
inc ebp
dec esi
movsd dword es:[edi], dword ss:[esi]
add al, 0x91
sub ebx, dword [ebx + eax*2 + 0x6425f01]
add dword [edi + 0x42], ebx
push es
fisub dword [edx + 0x4e]
shl byte [ecx + 0x44], cl
xor bh, al
push ecx
sub cl, cl
pop edx
clc
inc ebp
and esi, dword [ebp + 0x26]
test al, 0xf
jbe 0x43bdce
pop eax
jnp 0x43bd9b
mov dword [0xc1eb5dfb], eax
and dword [edx + 0x26b4a87d], ebp
insd dword es:[edi], dx
xor ebp, dword [esi]
in al, 0xb9
sbb eax, 0x11dae329
fld xword [ebx + 0x44]
inc edi
xor ecx, esi
xor al, 0xdd
mov esi, dword [ecx + edi*2 + 0x12]
fmul st(5)
add al, 0xff
or dword [ebx - 0x19], esi
lahf
inc ecx
cmp eax, 0x3c2b7f9e
cmp dl, byte [edi]
sub esp, dword [eax]
adc eax, 0x5b69f8f7
or al, 0x2d
cmp eax, 0x34392036
xlatb
bound ebx, qword [ecx]
nop
push edi
jge 0x43bdd1
or edi, dword [eax + edx*4 + 0x4cc4f0ec]
add eax, 0x42768520
cdq
invalid
Function at 0x43c994
Capabilities:
Encode data using xor

Disassembly:
sbb bh, byte [ebp + 0x15]
lahf
je 0x43ca0a
popal
imul ecx, esp, 0x1c511fb
xchg ebp, ebp
xchg ebp, eax
ffree st(7)
mov dh, 0x5d
in al, 0xeb
push esp
cmovnp edx, dword [esi + 0x32408d93]
sbb eax, 0xaf96a33b
xor bl, byte [0xaf96a33b]
xchg dword [esi + 0x58], ebx
xor esi, eax
lcall 0x2c5d, 0x267cf323
push esi
sbb byte [edi + 0x7a], bh
adc ah, byte [ebx + 0x16]
dec esi
xchg esi, eax
jge 0x43ca0c
cmp eax, 0xa9e0e327
push esp
daa
jecxz 0x43c9b2
test eax, 0xe785f254
test edi, esp
mov dh, 0xba
invalid
and edi, ebp
jne 0x43c9d4
mov edx, 0x23302f4f
xlatb
pop eax
add edx, dword [ecx]
sbb bh, byte [edi]
inc eax
mov al, byte [0xeb4d9dfd]
jae 0x43ca70
xchg byte [ebx], dl
enter 0x613f, 0xffffffffffffffad
push edi
fcomp dword [edx]
invalid
hlt
loopne 0x43c9ce
mov word [ebp - 0xd], ds
adc byte [ecx], ch
shl dword [ebx + 0x66], 0xb3
inc edi
mov ebp, 0x3c967c26
pop esi
lodsd eax, dword [esi]
enter 0xfffffffffffffddd, 0x17
push ecx
cmp ah, byte [ecx - 0x25f423cd]
jl 0x43c9e3
test eax, 0xf1221d08
cmp esi, edx
ja 0x43ca13
movsd dword es:[edi], dword [esi]
aam 0x8e
sbb esi, ebx
pop edi
dec ecx
arpl word [ebx], bp
test dword [ebp - 0x31], eax
invalid
daa
nop
xor al, byte [ebp + 0x7f]
and byte [edi - 0x304dcd3e], bh
invalid

Function at 0x440014
Capabilities:
Encode data using xor

Disassembly:
leave
test byte [ebx], bl
sub cl, byte [esi + ecx*2]
or al, cl
jo 0x440095
sal dword [eax + 0x77], 0x4e
dec esi
xor dword [edi], ecx
insd dword es:[edi], dx
std
cmc
insb byte es:[edi], dx
jo 0x44001f
fsub dword [edx - 0x12]
test al, 0x69
stc
bts dword [edi - 0x2aba2228], ebp
mov edx, esp
pushal
dec esi
jg 0x44001b
ror eax, 0xd6
rol byte [eax], 1
bound edx, qword [esi]
stosb byte es:[edi], al
or ch, byte [ebx]
hlt
mov eax, dword [0xe429c8dc]
cld
test eax, 0xf40e460b
jle 0x4400d2
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
sbb ah, dl
mov al, byte [0xbccaa0c5]
invalid
sbb eax, 0x1c6e6459
ret

Function at 0x4403c0
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
jbe 0x440409
pop edi
loopne 0x4403c5
push es
xchg byte [eax], bl
inc eax
loop 0x4403cd
push edx
cmp eax, 0x8e832837
dec edi
test dword [edx + 0x137002c4], ecx
iretd
cmpsd dword [esi], dword es:[edi]
jp 0x4403a2
invalid
lodsb al, byte [esi]
invalid
mov dh, 0x84
invalid
mov dh, 0x84
Function at 0x52a2de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x52a2fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x52a2ec
add dl, dl
jne 0x52a306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x52a352
xor eax, eax
add dl, dl
jne 0x52a313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x52a3ef
add dl, dl
jne 0x52a322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x52a32d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x52a338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x52a343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x52a34d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x52a2f2
mov eax, 1
add dl, dl
jne 0x52a360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x52a36b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x52a357
sub eax, 2
jne 0x52a39a
mov ecx, 1
add dl, dl
jne 0x52a380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x52a38b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x52a377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x52a2f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x52a3b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x52a3bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x52a3a8
cmp eax, 0x7d00
jae 0x52a3df
cmp eax, 0x500
jb 0x52a3da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x52a2f2
cmp eax, 0x7f
ja 0x52a3e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x52a2f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x52a40b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x52a2f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x402b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40a00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c08
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402be8
xor eax, eax
push ebp
push 0x402be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c24
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402be8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
ret
mov ax, word [0x40a00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40a00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403270
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40b034], 0
je 0x4032d1
cmp word [0x40b208], 0xd7b2
jne 0x403299
cmp dword [0x40b210], 0
jbe 0x403299
mov eax, 0x40b204
call dword [fcn.0040b220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40a054
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4032f8
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x40a018], 0
jne 0x4032ed
push 0
push 0x40a04c
push 0x40a054
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret

Function at 0x403774
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4037da
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403524
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a64
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4037c4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4037e1
lea eax, [ebp - 0x10]
call fcn.004033f4
ret
Function at 0x406c06
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
call sub.USER32.dll_GetWindowRect
push dword [ebx]
call sub.USER32.dll_GetWindowDC
mov dword [ebx + 4], eax
push dword [ebx + 4]
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebx + 8], eax
push 1
push dword [ebx + 8]
call sub.GDI32.dll_SetBkMode
cmp dword [ebx + 0x10], 0
je 0x406c4d
push dword [ebx + 0x10]
push dword [ebx + 8]
call sub.GDI32.dll_SelectObject
jmp 0x406c6f
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
push dword [ebx + 4]
call sub.GDI32.dll_CreateCompatibleBitmap
push eax
push dword [ebx + 8]
call sub.GDI32.dll_SelectObject
mov dword [ebx + 0x10], eax
cmp dword [ebx + 0xc], 1
jne 0x406c9b
push 0xcc0020
push 0
push 0
push dword [ebx + 4]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
push 0
push 0
push dword [ebx + 8]
call sub.GDI32.dll_BitBlt
mov eax, dword [ebx + 8]
pop ebx
mov esp, ebp
pop ebp
ret 4