joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f0b0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040dce0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40f19f
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40f243
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sym._malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40f1da
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40f1d2
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40f240
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
cmp eax, ebx
mov esi, eax
je 0x40f25a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x40f214
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40f214
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40f214
Function at 0x41a0f0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x41a120
add esp, 0x2e4
mov eax, 0xffffffff
pop ebx
pop esi
ret
lea eax, [esp + 0x14]
mov dword [esp], esi
mov dword [esp + 0x14], 0x10003
mov ebx, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
cmovne ebx, dword [esp + 0xcc]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x41c0d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x492e70]
test ebx, ebx
je 0x41c100
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x492e70]
test eax, eax
je 0x41c125
cmp dword [eax], 0xffffffff
je 0x41c148
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x492e70], eax
jmp 0x41c0de
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41c0ef
call sym._abort
lea esi, [esi]
Function at 0x41c5e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x492e74]
test eax, eax
je 0x41c734
call sym.__pthread_once_raw.constprop.5
mov eax, dword [0x492e70]
test eax, eax
je 0x41c760
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c620
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
test eax, eax
mov ebx, eax
je 0x41c7ac
mov eax, dword [entry3]
test eax, eax
je 0x41c7ac
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41c7b3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x492e70]
test eax, eax
je 0x41c786
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41c7b3
mov eax, ebx
jmp 0x41c618
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e74], eax
jmp 0x41c5f4
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41c606
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41c713
xor eax, eax
jmp 0x41c618
call sym._abort
nop
lea esi, [esi]
Function at 0x41cd20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x41cd40
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x492e70]
test eax, eax
je 0x41ceb0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41cd2c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41cd2c
test byte [eax + 0x20], 0x30
je 0x41ce00
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41cea0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41cdb0
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41cda2
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x41cf06
mov eax, dword [0x492e70]
test eax, eax
je 0x41cee0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x41ce60
test eax, eax
je 0x41ce1a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x41ce90
test byte [ebx + 0x24], 4
je 0x41ce77
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41cda9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x41cda9
test eax, eax
je 0x41ce70
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41cd2c
call sym.__pthread_cleanup_dest.part.3
jmp 0x41ce32
call sym.__pthread_cleanup_dest.part.3
jmp 0x41cd7e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41cd4d
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41cddd
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41cdd0
Function at 0x41e0a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41e11b
test byte [ebx + 0x20], 0x30
je 0x41e122
mov eax, dword [0x492e70]
test eax, eax
je 0x41e1ab
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41e112
cmp dword [eax + 0x14], 0
je 0x41e135
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41e105
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41e17f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x41e0bd
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41e14c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41e1a2
mov eax, dword [0x492e70]
test eax, eax
je 0x41e1d1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41e112
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41e15f
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41e15f
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41e0d0
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41e168
Function at 0x420a50
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040dce0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x420b3f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x420be3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x420b78
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420b70
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x420be0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x420bfa
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x420bb2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x420bb2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x420bb2
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405205
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40520e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405218
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405239
mov al, byte [esp]
jmp 0x40523b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4066d4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406759
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40673c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00406688
mov eax, dword [ebp - 0xc]
call fcn.00403438
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406743
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4067e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
xor eax, eax
mov dl, byte [ebx]
sub dl, 1
jb 0x40680c
sub dl, 0x1f
je 0x406804
sub dl, 2
je 0x406800
jmp 0x406808
xor al, 1
jmp 0x406808
test al, al
je 0x40680c
inc ebx
jmp 0x4067ed
inc ebx
cmp byte [ebx], 0x20
je 0x40680b
mov eax, esi
mov edx, ebx
call fcn.004032b8
pop esi
pop ebx
ret

Function at 0x4069f8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404da0
add esp, 0x104
pop ebx
ret
Function at 0x406b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406be9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406bd3
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406b8c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406bd3
cmp dword [ebp - 0xc], 2
jge 0x406b9e
mov eax, dword [ebp - 4]
call fcn.00403198
mov bl, 1
jmp 0x406bd3
mov edx, dword [ebp - 0xc]
dec edx
lea eax, [ebp - 0x10]
call fcn.00403514
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403444
push eax
push 0
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406bd3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406bf0
lea eax, [ebp - 0x10]
call fcn.00403198
ret

Function at 0x40730c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407328
shr eax, 1
xor eax, 0xedb88320
jmp 0x40732a
shr eax, 1
dec edx
jne 0x40731b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407314
pop esi
ret

Function at 0x407340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [0x40b558], 0
jne 0x40735e
call fcn.0040730c
mov byte [0x40b558], 1
mov eax, edi
test esi, esi
je 0x407389
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407364
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4087a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
cmp edi, 0x50
jle 0x4087c1
mov eax, esi
mov edx, 0x40a1c4
mov ecx, 0x40
call fcn.0040270c
je 0x4087c6
call fcn.00408738
mov eax, esi
add eax, 0x40
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
not edx
cmp eax, edx
jne 0x4087e5
cmp edi, eax
jne 0x4087e5
cmp dword [ebx], 0xcc
je 0x4087ea
call fcn.00408738
mov eax, ebx
add eax, 0x10
mov ebp, eax
add esi, dword [ebx + 4]
mov dword [esp], esi
mov edx, dword [esp]
sub edx, ebp
mov eax, ebp
call fcn.00407390
cmp eax, dword [ebx + 0xc]
jne 0x408811
mov eax, dword [esp]
cmp byte [eax - 1], 0
je 0x408816
call fcn.00408738
mov bl, 0xcc
mov esi, 0x40b95c
cmp ebp, dword [esp]
jb 0x408827
call fcn.00408738
mov eax, ebp
call fcn.00404cd4
mov edi, eax
mov eax, esi
mov ecx, edi
mov edx, ebp
call fcn.00403278
inc edi
add ebp, edi
add esi, 4
dec bl
jne 0x40881d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408a24
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40a07c], 2
jne 0x408a91
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x408a49
call fcn.00408a04
jmp 0x408aa3
lea eax, [esp + 8]
push eax
push 0x408aa8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x408a91
call fcn.00408a04
jmp 0x408aa3
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x408aa3
call fcn.00408a04
add esp, 0x14
ret

Function at 0x408abc
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
dec ebx
test ebx, ebx
jl 0x408b02
inc ebx
xor esi, esi
test esi, esi
je 0x408ad9
push 0xfa
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.00403438
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x408b02
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x408b02
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x408b02
inc esi
dec ebx
jne 0x408acb
pop edi
pop esi
pop ebx
ret

Function at 0x408d40
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov edi, 0x40bd98
cmp dword [0x40bc8c], 0
je 0x408d89
mov esi, dword [0x40bd9c]
dec esi
test esi, esi
jl 0x408d89
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 4
sub eax, ebx
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov eax, dword [0x40bc8c]
call fcn.00404b74
test eax, eax
jne 0x408d85
mov eax, ebx
call fcn.00408cf4
jmp 0x408e1d
inc ebx
dec esi
jne 0x408d5f
mov al, byte [0x40bd8e]
sub al, 1
jb 0x408d96
je 0x408d9d
jmp 0x408da4
call fcn.00406c18
jmp 0x408da6
call sub.kernel32.dll_GetUserDefaultLangID
jmp 0x408da6
xor eax, eax
test ax, ax
je 0x408e16
mov esi, dword [0x40bd9c]
dec esi
test esi, esi
jl 0x408dda
inc esi
xor ebx, ebx
mov edx, ebx
shl edx, 4
sub edx, ebx
mov ecx, dword [edi]
mov edx, dword [ecx + edx*4 + 0x28]
movzx ecx, ax
cmp edx, ecx
jne 0x408dd6
mov eax, ebx
call fcn.00408cf4
jmp 0x408e1d
inc ebx
dec esi
jne 0x408db9
mov esi, dword [0x40bd9c]
dec esi
test esi, esi
jl 0x408e16
inc esi
xor ebx, ebx
mov edx, ebx
shl edx, 4
sub edx, ebx
mov ecx, dword [edi]
mov edx, dword [ecx + edx*4 + 0x28]
and edx, 0x3ff
mov ecx, eax
and cx, 0x3ff
movzx ecx, cx
cmp edx, ecx
jne 0x408e12
mov eax, ebx
call fcn.00408cf4
jmp 0x408e1d
inc ebx
dec esi
jne 0x408de8
xor eax, eax
call fcn.00408cf4
pop edi
pop esi
pop ebx
ret