joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100988f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.10255f50
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call fcn.10098260
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x10098961
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x10098959
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x10098963
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x10098963
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x100989a1
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x10098a20
test esi, esi
je 0x10098ab4
push esi
push ecx
push dword [esp + 0x40]
call fcn.10257a40
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x10098974
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x100989e2
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x100989de
dec ecx
test ecx, ecx
jg 0x100989d0
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call fcn.10098260
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x10098974
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x10098a30
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x10098ab3
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x10098a65
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x100b3900
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10255f50
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x100b3980
mov cl, byte [edi]
test cl, cl
je 0x100b3980
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x100b3930
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x100b3a00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10255f50
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x100b3a83
mov cl, byte [edi]
test cl, cl
je 0x100b3a83
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x100b3a30
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x100c3940
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
movzx eax, cl
and eax, 1
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x100c3982
push ebx
add edi, esi
lea ebx, [edx + esi]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x100c3962
pop ebx
pop edi
pop esi
ret
Function at 0x10128080
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10255f50
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x101280c9
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x101280c9
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x101280b0
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x10128164
mov edi, eax
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [edi + 0xc], eax
test edx, edx
jne 0x10128146
mov edx, 0xc
mov eax, 1
nop word [eax + eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x10128130
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x101280e1
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x101281c2
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x1012819d
push eax
call fcn.10128200
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x101281b0
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1015b850
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x1015b88b
cmp esi, edx
jb 0x1015b88b
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x1015b874
pop esi
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop dword [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [esi - 0x40]
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x1015b8a0
pop esi
ret
Function at 0x101bb8a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x101bb94f
push esi
call fcn.101d0ff0
add esp, 4
test al, al
jne 0x101bb94f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x101bb8c7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.101dbde0
add esp, 0xc
test eax, eax
je 0x101bb8fb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.101dbde0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x101bb8fd
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x101bb92e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.101cc2b0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x101bb910
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x101d1f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10349380]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x6c3], 0
je 0x101d2119
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x101d2118
push esi
mov esi, dword [0x102883cc]
lea eax, [esp + 0x34]
push eax
push ebx
push 2
call esi
test eax, eax
jg 0x101d2117
lea eax, [esp + 0x38]
push eax
push ebx
push 0x17
call esi
test eax, eax
jg 0x101d2117
push dword [ebp + 0x14]
cmp byte [ebx], 0
mov eax, str._none_
mov esi, dword [ebp]
mov ebp, dword [esp + 0x14]
cmovne eax, ebx
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.101c7f00
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.101bbee0
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.101bbee0
add esp, 0x20
test esi, esi
je 0x101d208b
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x101d2002
cmp ecx, 2
jne 0x101d2080
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x101d2031
sub ecx, 0x15
jne 0x101d2046
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x101d2041
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call fcn.10256a90
push ebx
call fcn.10097b50
add esp, 4
test eax, eax
je 0x101d2065
push 2
push 0x1033ba9c
push ebx
call fcn.101bbea0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x101d20ab
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.101bbe40
mov edi, eax
add esp, 8
test edi, edi
jne 0x101d20ab
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x101d1ff1
lea eax, [esp + 0x24]
push eax
call fcn.10097b50
add esp, 4
test eax, eax
je 0x101d20bb
lea eax, [esp + 0x24]
push eax
call fcn.1007b420
add esp, 4
jmp 0x101d20c0
push str.too_many_IP__cant_show
push ebp
call fcn.101c7f00
add esp, 8
jmp 0x101d2100
mov eax, str._none_
push eax
push str.IPv6:__s
push ebp
call fcn.101c7f00
lea eax, [esp + 0x20]
push eax
call fcn.10097b50
add esp, 0x10
test eax, eax
je 0x101d20ec
lea eax, [esp + 0x14]
push eax
call fcn.1007b420
add esp, 4
jmp 0x101d20f1
mov eax, str._none_
push eax
push str.IPv4:__s
push ebp
call fcn.101c7f00
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.101bbeb0
lea eax, [esp + 0x28]
push eax
call fcn.101bbeb0
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.10255465
add esp, 0x6c
ret

Function at 0x101dd080
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call fcn.102664ef
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x101dd0a6
cmp ecx, 0xffffffff
cmovne eax, ecx
ret
Function at 0x1024eb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1024ece5
cmp dword [esi + 0x20], 0
je 0x1024ece5
cmp dword [esi + 0x24], 0
je 0x1024ece5
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1024ece5
cmp dword [eax], esi
jne 0x1024ece5
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x1024ebc5
cmp eax, 0x39
je 0x1024ebc5
cmp eax, 0x45
je 0x1024ebc5
cmp eax, 0x49
je 0x1024ebc5
cmp eax, 0x5b
je 0x1024ebc5
cmp eax, 0x67
je 0x1024ebc5
cmp eax, 0x71
je 0x1024ebc5
cmp eax, 0x29a
jne 0x1024ece5
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x1024ebfe
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x1024ec20
call fcn.10251690
jmp 0x1024ec25
call fcn.10251410
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.10251fd0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.10257a40
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x1032e322]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x1032e320]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x1032e324]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x1032e326]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x1026567e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x102881e8]
test eax, eax
je 0x102656bd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x102656bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x102656bd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x102656bd
cmp dword [ecx + 0x74], 0xe
jbe 0x102656bd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x102843f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1028441d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1028441d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10447212
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x106b7602
jmp 0x106a02b0
sub esp, 4
mov dword [esp], ecx
push ebp
push 0x71c2c098
pop ebp
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], ecx
jmp 0x106a02ca
jmp 0x106bc77e
jmp 0x106b76a9
push ebx
push esp
pop ebx
add ebx, 4
push eax
mov eax, 4
sub ebx, eax
mov eax, dword [esp]
add esp, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], ebp
jmp 0x106b772d
jmp 0x106c43b9
jmp fcn.106bc828
jmp 0x106bcdc2
push 0x4493c95c
mov dword [esp], eax
mov eax, 0x14
sub ebx, eax
pop eax
xchg dword [esp], ebx
pop esp
jmp 0x106bcddc
push ebx
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
pop ebx
add ebx, 4
jmp 0x106bcd07
jmp 0x106bfc61
jmp 0x106bfd85
xor edi, dword [esp]
mov esp, dword [esp]
mov dword [esp], edx
mov dword [esp], ebx
jmp 0x106bfd9f
push edi
mov edi, esp
add edi, 4
sub edi, 4
xor edi, dword [esp]
xor dword [esp], edi
jmp 0x106bfcc7
jmp 0x106a01ac
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
push dword [esp]
mov ebp, dword [esp]
jmp 0x106c44d0
add esp, 4
add esp, 4
jmp 0x106c44db
jmp 0x106bccac
Function at 0x402ecc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045a4
test esi, esi
jne 0x402f03
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404694
jmp 0x402f24
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d68
mov dword [esp], eax
test esi, esi
je 0x402f24
cmp dword [ebx], 0
je 0x402f24
dec esi
jmp 0x402f0b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x494020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403698
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403678
xor eax, eax
push ebp
push 0x403671
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403678
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x494020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x494020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40439c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49704c], 0
je 0x4043fd
cmp word [0x497220], 0xd7b2
jne 0x4043c5
cmp dword [0x497228], 0
jbe 0x4043c5
mov eax, 0x49721c
call dword [0x497238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404424
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x494030], 0
jne 0x404419
push 0
push 0x494064
push 0x49406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404558
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402ad0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x49704d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404520
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4064b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40651e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404814
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004031b8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406508
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406525
lea eax, [ebp - 0x10]
call fcn.004045a4
ret

Function at 0x40bb74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bbad
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404694
jmp 0x40bbb6
mov eax, ebx
mov edx, esi
call fcn.004045f8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bbc0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bbe1
mov al, byte [esp]
jmp 0x40bbe3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c278
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c0e0
mov eax, dword [0x496440]
cmp byte [eax], 0
je 0x40c2f4
mov eax, dword [0x49617c]
call fcn.00403024
call fcn.00402c5c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409248
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c33c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c32a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x496110]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x497668]
call fcn.00405908
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cbec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ccc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040463c
lea eax, [ebp - 8]
call fcn.00404ab4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a64
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ccac
mov eax, ebx
call fcn.00402ad0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a64
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cc8f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40ccd4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cc8f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ccac
mov eax, dword [ebp - 0x10]
call fcn.00402b00
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ccc9
lea eax, [ebp - 8]
call fcn.004045a4
ret

Function at 0x40d2e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d34c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404814
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408c98
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d353
lea eax, [ebp - 0xc]
call fcn.004045a4
ret

Function at 0x41e0ec
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041df18
dec esi
jne 0x41e10e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret