joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100af628
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], eax
push 0xc799b6df
push 0x909045aa
lea esp, [esp + 0x20]
call fcn.1003bcd0
cmc
jmp 0x10094bf7
jmp 0x1007c946
movss xmm0, dword [ebp - 0x60]
pushal
mov byte [esp + 4], ah
lea esp, [esp + 0x20]
movss dword [ebp - 0x180], xmm0
shr cl, 4
mov ecx, dword [ebp - 0x1c8]
cmc
shrd dx, ax, 2
cwde
adc dl, ch
add ecx, 0xe0
push 0x96127b1b
pop edx
mov dword [ebp - 0x2fc], ecx
cwde
cwde
lea eax, [edi - 0x126a2278]
mov dword [ebp - 0x54], 0
mov dh, bl
push 4
setb al
bswap ax
lea edx, [ebp - 0x54]
call fcn.100a1258
pop eax
lea eax, [ecx*4 + 0xc4cf50]
bswap eax
mov dword [esp + 0x1c], edx
lea eax, [esi - 0x3904d900]
lahf
cwde
mov eax, dword [ebp - 0x2f4]
jmp 0x10085f31
add esp, 0xc
jmp 0x10089093
clc
jmp 0x10094baf
lea esp, [esp + 0x48]
call fcn.1003bcd0
test bl, 0x54
aam 0x75
add esp, 0xc
cmp ah, 0x33
btr ax, bp
shrd cx, bx, cl
rcl cl, 4
mov eax, dword [ebp - 0x34]
sar cx, cl
neg cl
mov dword [ebp - 0x1c8], eax
neg ecx
pushfd
mov ecx, dword [ebp - 0x1c8]
xadd eax, edx
xchg ah, dh
add ecx, 0xdc
rdtsc
lea edx, [esp + 0x624b733f]
cdq
mov dword [ebp - 0x2f4], ecx
lahf
pushal
mov dword [ebp - 0x60], 0
rdtsc
lahf
pushfd
cdq
mov dword [esp + 0x24], 4
cdq
lea edx, [ebp - 0x60]
jmp 0x1008b9ed

Function at 0x100b1482
Capabilities:
Execute anti-debugging instructions

Disassembly:
lahf
mov eax, dword [ebp - 0x28]
pushfd
jmp 0x100a6ef6
pushal
mov dword [esp + 0x24], eax
pushal
lea esp, [esp + 0x44]
call fcn.1003bcd0
bswap edx
sal ax, 5
add esp, 0xc
call fcn.100978d0
cdq
movsx cx, dl
mov ecx, dword [ebp - 8]
pop eax
mov dword [ebp - 0x28], ecx
cdq
not dx
push esp
mov dword [ebp - 0xc], 0
pushal
movsx ax, cl
mov dword [esp + 0x20], 4
setno ah
lea edx, [ebp - 0xc]
lea esp, [esp + 0x20]
jo 0x1007ad5b
push 0x206efa25
mov dword [esp], edx
pushfd
jmp 0x10077cdf

Function at 0x100b1def
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], dh
lea esp, [esp + 0x50]
call fcn.10038f80
pushfd
pushfd
lea esp, [esp + 8]
jmp loc.10053eab

Function at 0x100b2b97
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.100afa10
pushal
mov dword [esp + 0x24], edx
push edx
mov dword [esp + 8], 0xdd6dcffd
push 0xd3c7f5f0
lea esp, [esp + 0x2c]
call fcn.1003bcd0
cmp ecx, esi
rcr ax, cl
aaa
add esp, 0xc
setge ah
pushal
push esp
mov eax, dword [0x10074c54]
jmp 0x1008c9f8
Function at 0x1014aec7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014a9a8
jmp 0x1014ae79
push eax
push edx
jg 0x1014ae8d
push eax
push edx
rdtsc
pop edx
pop eax
push eax
push edx
rdtsc
pop edx
pop eax
push eax
push eax
push edx
rdtsc
pop edx
pop eax
pop eax
rdtsc
push edi
push edx
pop edx
pop edi
push eax
push edx
push edx
pop edx
push edi
pop edi
rdtsc
pushal
popal
pushal
popal
pop edx
pop eax
pop edx
pop eax
jbe 0x1014aec6
push esi
jnp 0x1014aeb8
jmp 0x1014aec5
pop esi
pushfd
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
mov dword [esp], ebx
mov dword [esp], 0xd4
push edi
mov dword [esp], 0x33fdce18
or dword [esp], 0x7fffef94
add dword [esp], 0x58db73b1
push edx
mov edx, 0x68ff8bbc
sub dword [esp + 4], edx
pop edx
add dword [esp], 0x7eb23a0f
not dword [esp]
sub dword [esp], 0x9358e796
and dword [esp], 0x7dff7052
neg dword [esp]
dec dword [esp]
and dword [esp], 0x77fd50cf
not dword [esp]
add dword [esp], 0x3f8fa3d
push edx
push esp
pop edx
add edx, 4
sub edx, 4
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
pop esp
mov dword [esp], ebp
mov dword [esp], eax
push ebx
push esp
mov ebx, dword [esp]
add esp, 4
add ebx, 4
sub ebx, 4
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
push dword [esp]
pop eax
add esp, 4
add esp, 4
push dword [esp + 8]
push dword [esp]
pop ebx
push ebx
mov dword [esp], esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
push dword [esp]
pop ebx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
add esp, 4
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
jmp 0x10148d5b
Function at 0x1014bc72
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014b657
jmp 0x1014bb2e
jmp 0x1014bb3f
push edx
pushal
jmp 0x1014bb57
pushal
popal
popal
pop edx
pushfd
sub esp, 4
mov dword [esp], edx
push ebx
mov dword [esp], eax
mov eax, 0x3f7f00c8
mov dword [esp + 4], eax
pop eax
inc dword [esp]
xor dword [esp], 0x3f7f001d
push 0x396eb0c6
mov dword [esp], edx
push 0x3837004a
mov dword [esp], eax
mov eax, 0x5ffa2914
mov dword [esp + 4], eax
pop eax
xor dword [esp], 0x77dbea0d
xor dword [esp], 0x28357545
sub esp, 4
mov dword [esp], edx
mov dword [esp], 0x3ee72c01
not dword [esp]
or dword [esp], 0x77f1c36f
xchg dword [esp], ebx
not ebx
xchg dword [esp], ebx
and dword [esp], 0x3dbee3fc
sub dword [esp], 0xf6a56975
mov dword [esp], eax
push esi
mov esi, esp
add esi, 4
push ecx
mov ecx, 4
sub esi, 0x7eb18c19
sub esi, ecx
add esi, 0x7eb18c19
mov ecx, dword [esp]
add esp, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push ecx
mov ecx, esp
push ebp
mov ebp, 4
add ecx, ebp
pop ebp
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp + 8]
mov ebx, dword [esp]
push eax
push esp
pop eax
add eax, 4
add eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
pop ebx
push 0x5b138b21
mov dword [esp], esi
mov esi, esp
push edx
mov edx, 0x675a797a
xor edx, 0x7ff8fef8
sub edx, 0x18a2877e
add esi, edx
pop edx
add esi, 4
xchg dword [esp], esi
pop esp
push dword [esp]
pop eax
push ebp
mov ebp, esp
push edx
push edi
mov edi, 0x6f638489
xor edi, 0x751bf14d
inc edi
xor edi, 0x1a7875c1
mov edx, edi
pop edi
add ebp, edx
pop edx
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x10148d5b
Function at 0x1014cf1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014c9b0
jmp 0x1014ce8f
push eax
push edx
pushal
push eax
push edx
rdtsc
pop edx
pop eax
pushal
popal
pushal
popal
popal
push eax
push edx
push ebx
pop ebx
rdtsc
jmp 0x1014ceb7
push eax
push edx
rdtsc
pop edx
pop eax
pop edx
pop eax
rdtsc
pushal
push eax
push edx
rdtsc
pop edx
pop eax
jne 0x1014cece
push ecx
pop ecx
popal
push eax
push edx
jns 0x1014ced9
rdtsc
push ecx
pop ecx
pop edx
pop eax
pop edx
pop eax
jmp 0x1014ceeb
pushfd
push edi
mov dword [esp], 0x6bff8e52
and dword [esp], 0x7f63f6d3
inc dword [esp]
shl dword [esp], 1
add dword [esp], 0xa7367696
sub dword [esp], 0xff3db800
push edx
mov edx, 0x7ebfcbe8
xor dword [esp + 4], edx
pop edx
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ebx
mov dword [esp], 0x45ff087b
sub dword [esp], 1
neg dword [esp]
xor dword [esp], 0xba143e33
sub esp, 4
mov dword [esp], ecx
mov dword [esp], 0x6df28cf2
inc dword [esp]
or dword [esp], 0x7df54c01
inc dword [esp]
neg dword [esp]
push esi
mov esi, 0x936fa227
add dword [esp + 4], esi
pop esi
mov dword [esp], eax
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], esi
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
push ebx
push eax
push 0x7fbf0000
pop eax
add eax, 0x80410004
mov ebx, eax
pop eax
add edx, ebx
pop ebx
xchg dword [esp], edx
pop esp
push dword [esp + 8]
mov ebx, dword [esp]
push esi
mov esi, esp
add esi, 4
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
push ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
add esp, 4
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
push edx
mov edx, 4
add edi, edx
mov edx, dword [esp]
add esp, 4
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
pop esp
jmp 0x10148d5b
Function at 0x1014d606
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014d06b
jmp 0x1014d542
jmp 0x1014d559
pushfd
push ebx
mov dword [esp], 0x3f8a3d00
mov dword [esp], ebp
mov dword [esp], 0x71bfa512
add dword [esp], 0xffffffff
xor dword [esp], 0x676b8551
inc dword [esp]
xor dword [esp], 0x67e6e332
sub dword [esp], 0x77bfda68
xor dword [esp], 0xf972e9df
push ebx
mov dword [esp], ecx
mov dword [esp], 0x7fef48f2
push esi
mov esi, 0xb33cb68f
add dword [esp + 4], esi
pop esi
sub dword [esp], 0x7dffe5b7
sub dword [esp], 0xb517495a
push 0x4375699d
mov dword [esp], esi
mov dword [esp], ebp
mov dword [esp], 0x39f5ba5f
and dword [esp], 0x1fef68ca
shl dword [esp], 1
add dword [esp], 0x1ed7c5fa
add dword [esp], 0x1e95c2e5
mov dword [esp], eax
push esi
push ebp
mov ebp, 0x15215cad
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], edi
mov dword [esp], ecx
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
mov eax, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp + 8]
push dword [esp]
mov ebx, dword [esp]
add esp, 4
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], eax
push esp
pop eax
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
push dword [esp]
pop eax
push eax
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
push ecx
mov ecx, 4
add ebp, ecx
pop ecx
xchg dword [esp], ebp
pop esp
jmp 0x10148d5b
Function at 0x1014dcb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014d6a0
jmp 0x1014db7b
pushal
push esi
jmp 0x1014db8b
pop esi
jle 0x1014db9f
jmp 0x1014db9f
push eax
push edx
jmp 0x1014dbb4
pushal
popal
rdtsc
jmp 0x1014dbc5
pop edx
pop eax
popal
pushfd
push edx
mov dword [esp], ecx
mov dword [esp], ebx
mov dword [esp], ebp
mov dword [esp], 0x7bdfb179
and dword [esp], 0x6de5b568
dec dword [esp]
shl dword [esp], 1
inc dword [esp]
sub dword [esp], 0x4e6e23f2
add dword [esp], 0x7ae2c1f7
push ecx
mov dword [esp], 0x6ffff3ec
not dword [esp]
xchg dword [esp], eax
dec eax
xchg dword [esp], eax
xchg dword [esp], ecx
not ecx
xchg dword [esp], ecx
shr dword [esp], 1
add dword [esp], 0xc814dcaf
push edx
mov dword [esp], 0x6fdd5e20
push ebx
mov ebx, 0x5bfd198f
xor dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
mov dword [esp], eax
push ecx
mov dword [esp], 0x7f3f26ce
shr dword [esp], 4
sub dword [esp], 0x7f052fe3
not dword [esp]
and dword [esp], 0x5fcefa31
xor dword [esp], 0x20e5118a
xor dword [esp], 0x5f51fcf3
sub dword [esp], 0xbd5b7f88
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
sub esp, 4
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1dbf6624
neg ecx
or ecx, 0x7bfd7416
not ecx
shr ecx, 2
inc ecx
push esi
mov esi, 0xfeff7f7b
add ecx, esi
pop esi
add ebp, ecx
pop ecx
add ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
push dword [esp]
pop eax
push ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
jmp 0x10148d5b
Function at 0x1014e8d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014e376
jmp 0x1014e848
jmp 0x1014e858
pushfd
push edi
mov dword [esp], 0x7f1d7fe5
xor dword [esp], 0x7bff1ca1
dec dword [esp]
push ecx
mov ecx, 0x45d7b971
xor dword [esp + 4], ecx
pop ecx
add dword [esp], 0x7def281d
add dword [esp], 0xaaba2c98
push ebp
mov ebp, 0x9620d1ed
add dword [esp + 4], ebp
pop ebp
push ecx
push esp
pop ecx
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edx
mov dword [esp], 0x7f2f6189
neg dword [esp]
or dword [esp], 0x775fdf8f
xor dword [esp], 0xf7cb3c84
sub esp, 4
mov dword [esp], ecx
push esp
pop ecx
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
mov dword [esp], eax
push ebp
mov ebp, esp
add ebp, 4
push edi
push ebx
mov ebx, 0x5677a09e
mov edi, 0x5677a0a2
sub edi, ebx
pop ebx
sub ebp, edi
mov edi, dword [esp]
add esp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push edi
mov edi, esp
push esi
mov esi, 0x6db298c1
neg esi
neg esi
xor esi, 0x3e7f9831
shr esi, 1
add esi, 0xd6197f8c
add edi, esi
pop esi
push edx
mov edx, 4
add edi, edx
pop edx
xchg dword [esp], edi
pop esp
push dword [esp + 8]
mov ebx, dword [esp]
push esi
mov esi, esp
add esi, 4
push eax
mov eax, 0x3eff6f3d
shr eax, 7
neg eax
sub eax, 1
or eax, 0x6e7feac7
sub eax, 0x7f5b822f
xor eax, 0x80a469bc
add esi, eax
pop eax
xchg dword [esp], esi
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
pop ebx
push eax
push esp
pop eax
add eax, 4
push ebp
mov ebp, 4
add eax, ebp
pop ebp
xchg dword [esp], eax
pop esp
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
push ebx
mov dword [esp], eax
mov eax, 0x6f7f25be
xor eax, 0x6f7f25ba
add edi, eax
pop eax
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
jmp 0x10148d5b
Function at 0x10150259
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x1014fd06
jmp 0x101501de
push eax
push edx
pushal
pushal
popal
push eax
pop eax
push eax
push edx
rdtsc
pop edx
pop eax
popal
jl 0x101501f4
pushal
popal
rdtsc
jl 0x10150204
push eax
push edx
rdtsc
pop edx
pop eax
pushal
popal
pop edx
pop eax
jmp 0x1015021c
pushfd
push edx
mov dword [esp], 0x16f7ff1f
mov dword [esp], ebp
mov dword [esp], 0x3bf9a045
xor dword [esp], 0x7eb48f32
sub dword [esp], 0x6aba89c6
xor dword [esp], 0x779f6f13
neg dword [esp]
add dword [esp], 0x7bff26ce
push ebp
mov ebp, 0x310ea4a8
add dword [esp + 4], ebp
pop ebp
push ebp
mov ebp, esp
push ebx
mov ebx, 4
add ebp, ebx
pop ebx
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ecx
mov dword [esp], ebp
mov dword [esp], 0x14fd0b
push ebx
mov ebx, esp
push ecx
mov ecx, 0x7b7f6f1a
sub ecx, 0x65fde981
dec ecx
add ecx, 0x5688de50
add ecx, 0x93f59c1c
add ebx, ecx
pop ecx
push ebp
mov ebp, 4
add ebx, 0x4ff9c6ac
sub ebx, ebp
sub ebx, 0x4ff9c6ac
pop ebp
xchg dword [esp], ebx
pop esp
mov dword [esp], eax
push 0x22ce23de
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edi
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push edx
mov edx, esp
push eax
mov eax, 0x5f7e1ed7
dec eax
push edx
mov edx, 0x5f7e1ed2
xor eax, edx
pop edx
add edx, eax
pop eax
add edx, 4
xchg dword [esp], edx
pop esp
push dword [esp + 8]
mov ebx, dword [esp]
push edx
mov edx, esp
push eax
mov eax, 4
add edx, eax
pop eax
push edi
mov edi, 0x7d73f994
or edi, 0x5f9d7e50
or edi, 0x3efe1815
and edi, 0x33bfeb49
xor edi, 0x33bfeb45
add edx, edi
pop edi
xchg dword [esp], edx
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push eax
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
pop eax
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
push dword [esp]
mov eax, dword [esp]
add esp, 4
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
jmp 0x10148d5b
Function at 0x10150fd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x10150a0c
jmp 0x10150ef3
jbe 0x10150f12
push ebx
jmp 0x10150f0b
push eax
push edx
rdtsc
pop edx
pop eax
pop ebx
pushfd
push 0x5655a6fa
mov dword [esp], eax
mov dword [esp], 0x76bebbab
dec dword [esp]
xchg dword [esp], eax
not eax
xchg dword [esp], eax
and dword [esp], 0x6757cdbc
xor dword [esp], 0x14144c0
push edi
mov dword [esp], eax
mov dword [esp], ebx
mov dword [esp], edi
push edx
mov edx, 0x150a11
mov dword [esp + 4], edx
pop edx
push 0x7df05fab
mov dword [esp], edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
mov dword [esp], ecx
mov dword [esp], eax
sub esp, 4
mov dword [esp], ebp
mov dword [esp], edx
push esp
pop edx
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push esi
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push edi
mov edi, esp
add edi, 4
push ebx
mov ebx, 4
add edi, ebx
pop ebx
xchg dword [esp], edi
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
push dword [esp]
pop ebx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
add esp, 4
push dword [esp]
pop eax
push esi
mov esi, esp
push ecx
mov ecx, 0x6ff6bcbe
dec ecx
shr ecx, 5
add ecx, 0xfc804a1f
add esi, ecx
pop ecx
push eax
mov eax, 4
add esi, eax
pop eax
xchg dword [esp], esi
pop esp
jmp 0x10148d5b
Function at 0x401000
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 8], 0
je 0x401018
cmp dword [ebp + 0xc], 0
je 0x401018
cmp dword [ebp + 0x10], 0
jg 0x40101f
xor eax, eax
jmp 0x40111e
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, 2
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov ax, word [edx]
mov word [ebp - 0x26], ax
add dword [ebp - 0x20], 2
cmp word [ebp - 0x26], 0
jne 0x401035
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
sar ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
call fcn.0040419e
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00405360
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4010e2
jmp 0x401103
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x40111b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004041a9
add esp, 4
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x402120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x40213c
cmp dword [ebp + 0xc], 0
jg 0x402143
xor eax, eax
jmp 0x402259
xor eax, eax
mov word [ebp - 0x30], ax
xor ecx, ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov dword [ebp - 0x22], ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], cx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push 0x413de0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402219
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x28
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0
push str.Version
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4021fa
cmp dword [ebp - 0x38], 1
jne 0x4021fa
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
add edx, 2
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
mov cx, word [eax]
mov word [ebp - 0x42], cx
add dword [ebp - 0x3c], 2
cmp word [ebp - 0x42], 0
jne 0x4021d8
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x40]
sar edx, 1
mov dword [ebp - 0x48], edx
jne 0x40220d
push 0x413e18
push 0x14
lea eax, [ebp - 0x30]
push eax
call fcn.004041b4
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40222c
push str.0.0.0.0
push 0x14
lea edx, [ebp - 0x30]
push edx
call fcn.004041b4
add esp, 0xc
mov eax, dword [ebp + 0xc]
shl eax, 1
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405360
add esp, 0xc
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004041b4
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret
Function at 0x402270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x40228c
cmp dword [ebp + 0xc], 0
jg 0x402293
xor eax, eax
jmp 0x40239a
xor eax, eax
mov word [ebp - 0x1c], ax
xor ecx, ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov dword [ebp - 0x12], ecx
mov dword [ebp - 0xe], ecx
mov word [ebp - 0xa], cx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.SoftwareKuGameBox
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40235a
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x14
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push str.Dist
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40233b
cmp dword [ebp - 0x20], 1
jne 0x40233b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
add edx, 2
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x28]
mov cx, word [eax]
mov word [ebp - 0x2e], cx
add dword [ebp - 0x28], 2
cmp word [ebp - 0x2e], 0
jne 0x402319
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x2c]
sar edx, 1
mov dword [ebp - 0x34], edx
jne 0x40234e
push 0x413e60
push 0xa
lea eax, [ebp - 0x1c]
push eax
call fcn.004041b4
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40236d
push 0x413e68
push 0xa
lea edx, [ebp - 0x1c]
push edx
call fcn.004041b4
add esp, 0xc
mov eax, dword [ebp + 0xc]
shl eax, 1
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405360
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004041b4
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040418f
mov esp, ebp
pop ebp
ret

Function at 0x402490
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.KUGAMEUPDATE_E2D602DA3A9C4A39BC77C2B860D84ED2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret