joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x432e09
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x440e88]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x38]
mov esi, eax
mov eax, dword [edx]
sub eax, 0x10
push eax
call fcn.00402190
lea ecx, [eax + 0x10]
mov eax, dword [esp + 0x30]
add esp, 4
mov dword [eax], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 1
test esi, esi
jne 0x40dffa
push 0x208
call fcn.0040f308
push 0x104
mov esi, eax
push 0
push esi
call fcn.0041cf20
mov eax, dword [ebp]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x10
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
mov dword [esp + 0x48], 0x208
call edi
test eax, eax
je 0x40dfbf
cmp eax, 0xea
jne 0x40dfd4
test esi, esi
je 0x40df77
push esi
call fcn.0040f2fd
add esp, 4
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040f308
mov esi, eax
mov eax, dword [esp + 0x34]
push eax
push 0
push esi
call fcn.0041cf20
mov eax, dword [ebp]
add esp, 0x10
lea ecx, [esp + 0x30]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
push 0
push eax
mov eax, dword [esp + 0x24]
push eax
call edi
test eax, eax
jne 0x40df63
mov ecx, dword [esp + 0x2c]
push esi
push 0x438e40
push ecx
call fcn.00403960
add esp, 0xc
jmp 0x40dfe2
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
push edx
call fcn.0040e500
push esi
call fcn.0040f2fd
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret

Function at 0x40e010
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [eax]
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e072
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e067
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x40f060
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x440e88]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.0041cf20
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x40f0c3
jne 0x40f0ac
cmp dword [esp + 8], 0
je 0x40f0c3
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.0041ac20
add esp, 0x118
ret

Function at 0x40f0e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x440e88]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push 0x114
xor esi, esi
lea eax, [esp + 8]
push esi
push eax
call fcn.0041cf20
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x40f29a
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40f19c
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40f154
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 0xa
jne 0x40f176
mov esi, 2
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 0x5a
jne 0x40f29a
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 3
jne 0x40f1c9
cmp dword [esp + 0xc], 0x33
jne 0x40f29a
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 5
jne 0x40f21e
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40f1f3
mov esi, 6
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 1
je 0x40f201
cmp eax, 2
jne 0x40f29a
mov esi, 7
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 6
jne 0x40f28c
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40f248
mov esi, 8
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 1
jne 0x40f26a
mov esi, 9
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
cmp eax, 2
jne 0x40f29a
mov esi, 0xa
mov eax, esi
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
jbe 0x40f29a
cmp dword [esp + 0xc], 2
jbe 0x40f29a
mov esi, 0xc
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041ac20
add esp, 0x118
ret
Function at 0x40f873
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x440e88]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x40f90b
push 0x4348ec
push 4
push eax
call fcn.0041b514
push eax
call fcn.004024c0
add esp, 0x10
push ebx
push edi
call fcn.0041ced6
mov edi, dword [eax]
call fcn.0041ced6
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0041ce73
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0041ced6
cmp dword [eax], ebx
je 0x40f922
call fcn.0041ced6
push dword [eax]
call fcn.0040f7ee
pop ecx
jmp 0x40f929
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40f8b6
jmp 0x40f9b0
call fcn.0041ced6
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x40f9ac
cmp dword [ebp - 0x234], esi
jae 0x40f9ac
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0041cf20
add esp, 0xc
push 0x43464c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40f99b
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40f99b
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x40f99b
push ebx
push ebx
push esi
jmp 0x40f9a4
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40f9ae
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041ac20
leave
ret

Function at 0x41ac20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440e88]
jne 0x41ac2a
repz ret
jmp fcn.0041f0bf

Function at 0x41bbc1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41bbf2
call fcn.0041cee9
mov dword [eax], esi
call fcn.0041ced6
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041b31b
add esp, 0x14
push 0x16
pop eax
jmp 0x41bc47
test dword [ebp + 0xc], 0xfffffff9
jne 0x41bbce
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41bc1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041cefc
pop ecx
call fcn.0041ced6
mov eax, dword [eax]
jmp 0x41bc47
test al, 0x10
jne 0x41bc45
test al, 1
je 0x41bc45
test byte [ebp + 0xc], 2
je 0x41bc45
call fcn.0041cee9
mov dword [eax], 5
call fcn.0041ced6
mov dword [eax], 0xd
jmp 0x41bc16
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42d670
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041f237
and dword [ebp - 4], 0
cmp dword [0x444f34], 0
mov ebx, eax
jne 0x42d721
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42d7d2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42d7d2
push eax
call fcn.0041f1c5
mov dword [esp], 0x43865c
push edi
mov dword [0x444f34], eax
call esi
push eax
call fcn.0041f1c5
mov dword [esp], 0x438648
push edi
mov dword [0x444f38], eax
call esi
push eax
call fcn.0041f1c5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444f3c], eax
call esi
push eax
call fcn.0041f1c5
pop ecx
mov dword [0x444f44], eax
test eax, eax
je 0x42d721
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f1c5
pop ecx
mov dword [0x444f40], eax
mov eax, dword [0x444f40]
cmp eax, ebx
je 0x42d779
cmp dword [0x444f44], ebx
je 0x42d779
push eax
call fcn.0041f240
push dword [0x444f44]
mov esi, eax
call fcn.0041f240
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42d779
test edi, edi
je 0x42d779
call esi
test eax, eax
je 0x42d770
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42d770
test byte [ebp - 0xc], 1
jne 0x42d779
or dword [ebp + 0x10], 0x200000
jmp 0x42d7b2
mov eax, dword [0x444f38]
cmp eax, ebx
je 0x42d7b2
push eax
call fcn.0041f240
pop ecx
test eax, eax
je 0x42d7b2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42d7b2
mov eax, dword [0x444f3c]
cmp eax, ebx
je 0x42d7b2
push eax
call fcn.0041f240
pop ecx
test eax, eax
je 0x42d7b2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444f34]
call fcn.0041f240
pop ecx
test eax, eax
je 0x42d7d2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42d7d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xb0
mov al, byte [0x65e049]
mov cl, byte [0x65e048]
xor cl, al
push esi
mov byte [0x65e048], cl
mov cl, byte [0x65e043]
or cl, 8
mov esi, dword [esp + 0xb8]
shr cl, 3
and ecx, 0xff
push 5
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x661960]
fadd qword [0x65e050]
fstp qword [0x661950]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b87e
or dword [esi], 0x4000000
mov al, byte [0x65e046]
mov dl, byte [0x65e045]
xor al, dl
mov byte [0x65e046], al
or al, 0x30
shr al, 4
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x6619c0]
fstp qword [0x661950]
fld qword [0x65e050]
fadd qword [0x661960]
fstp qword [0x661960]
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, esi
pop esi
add esp, 0xb0
ret
Function at 0x455789
Capabilities:
Encode data using xor

Disassembly:
neg byte [edi + 0x4b]
je 0x45577d
xor al, 0xe
sti
arpl word [ebp + 0x2f], ax
jle 0x4557db
push ecx
push ecx
jns 0x4557a0
xor dword [0x322c2810], ebp
aas
mov eax, 0xa111e99f
jge 0x45577d
or al, dl
and dword [esp + esi*2 + 0x7a], 0x29
rcl cl, cl
or byte [esp - 0x4c], dl
and byte [edx], ah
dec ebx
xchg dword [ecx - 0x182801a0], esp
sub edx, edx
ror dword [eax], 1
push esp
mov ah, 0x20
and cl, byte [ebx - 0x79]
mov eax, dword [0xe7d7fe60]
out 0xf4, eax
mov ebp, 0xd9b4a6bd
mov al, byte [0x88e3b1aa]
add al, 0x4d
rol dword [ebx*2 + 0x1c44e0d5], 3
add eax, 0x6e044f5
xor byte [ebp + 0x6d], bh
adc dl, ah
loopne 0x4557e8
adc dword [esi + edx*8 - 0x5f], 0xa528cead
enter 0xffffffffffff8f16, 0xffffffffffffff80
in eax, dx
pop ds
pop ebp
add al, 0xb4
daa
inc ebp
and eax, 0x28370226
stc
add dh, byte es:[edi]
sub cl, bh
sahf
jns 0x455856
out 0xd4, eax
movsd dword es:[edi], dword [esi]
hlt
invalid
and al, 0xa5
mov eax, dword [ebp + 0x14]
mov ah, 0xe5
imul esp, esp, 0x95f50461
push edx
mov dh, 0xa4
dec ecx
movsb byte es:[edi], byte ss:[esi]
jle 0x455883
add dword [eax], ebx
and eax, 0x5481c524
cwde
pop edi
loope 0x455845
mov esi, dword [ecx - 0x56]
movsb byte es:[edi], byte [esi]
cli
cmpsd dword [esi], dword es:[edi]
adc eax, 0x586850
push esi
aad 0xa
xor esi, ebp
and eax, 0xe56c7935
jl 0x45588d
sbb al, 0xad
in eax, dx
in eax, 0x15
mov cl, 0xc5
jmp 0x45590d
push esp
or dh, ah
cwde
inc edx
xchg ebp, eax
faddp st(4)
test byte [ebp + 0x64], dl
pop ebp
xor al, 0x42
push ecx
sbb eax, 0xd59cf343
push esi
push ss
out dx, al
test dword [esi + esi*8], ebx
hlt
push eax
sbb esp, dword [ebp + 0x72]
aad 0x4c
and al, 0xc3
push edx
stc
cwde
jecxz 0x45598e
mov edx, 0xeeb747a0
sub al, 0x65
salc
fst qword [esp + eax*4 - 0x512c3b50]
push ds
mov eax, 0x1573adb5
cmp bl, dh
cmp byte [ebp + eax - 0x6a4bfe04], bh
aam 0x84
clc
ror dword [eax + 0x60], 0xa5
je 0x4558d7
mov edi, 0x24bd61df
and al, 0x9d
jo 0x455978
dec esp
inc ebp
mov ch, pe_nt_image_headers32
pop ecx
inc esp
xor dword [ebp + ecx + 0x44], 0x2d
neg byte [edx + 0x7d]
adc esi, dword [ecx - 0x79db5a29]
and eax, 0xcfbe3fe9
int3
or dword [ebp + esi + 0x4c], edx
dec edi
cmp esi, edi
or al, 0xb3
nop
lds edi, [edx]
mov ecx, 0x699c4525
sub ch, byte [eax]
invalid
imul ebp, dword [edx], 0x61edc428
and eax, 0xbc8596ec
inc ebx
cmpsd dword [esi], dword es:[edi]
imul edx, dword [ebx], 0x69
jl 0x4559a0
mov dword [0x50157c69], eax
push eax
adc esp, dword [edi - 0x63187102]
je 0x455968
dec byte [esi - 0x2b8b6319]
call 0x2eef6028
ficomp word [eax + 0x1e7d8d86]
int1
jbe 0x455987
in al, dx
scasb al, byte es:[edi]
xor al, 0xde
movsd dword es:[edi], dword [esi]
push ebp
mov al, 0x76
xchg esp, eax
or al, dh
sbb al, 0x64
cmpsd dword [esi], dword es:[edi]
dec esi
jne 0x4559a4
dec esi
mov ch, 0x45
xchg ebx, eax
out dx, al
jne 0x455950
invalid
Function at 0x489700
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
daa
add dword [ecx + 0x6c19d331], edi
inc esi
call 0x97ddbaaf
xchg dword [esi], eax
xchg edx, eax
sbb bl, al
push ebp
push cs
mov ch, 0x4d
inc esp
push ebp
invalid
inc edi
cmp bl, byte [eax + 0x51b594e9]
movsd dword es:[edi], dword [esi]
jbe 0x48972f
popfd
call 0x264587d4
sbb eax, 0xbbed9914
adc eax, 0xfcbb3f98
je 0x489664
xor al, 0x39
int3
loope 0x4896b3
ror cl, 0x8e
les ebx, [ebx - 0x4389a381]
test al, 0x37
aaa
cmc
popfd
inc esp
in al, 0xc5
jo 0x4896b3
xchg dword [eax], edx
salc
add ebp, eax
push 0x1a5450ad
cmp eax, 0x9cbfb8bd
scasd eax, dword es:[edi]
cmp bl, ah
movsb byte es:[edi], byte [esi]
push eax
cmp ebp, dword [di - 0x52]
jne 0x4896f0
push ebx
push edx
mov byte [0xdde4aeec], al
sahf
push cs
jg 0x489730
push ebp
sbb al, 0x4b
lds ecx, [edx - 0x560a9339]
cmpsb byte [si], byte es:[di]
rcr dword [ebx - 0x1298e14b], cl
mov al, bh
insb byte es:[edi], dx
cmc
test eax, 0x9bd3a667
mov ch, 0x1e
in eax, dx
invalid
sbb al, 0x47
sbb dword [edx - 8], ebp
stosd dword es:[edi], eax
add esi, dword [0x7a04f4dd]
wait
sar byte [ecx + 0x55], cl
jl 0x489783
loopne 0x4897b2
and al, 0x98
ret 0xa081
add ch, dh
invalid
push edx
invalid
Function at 0x4a2ca5
Capabilities:
Encode data using xor

Disassembly:
jp 0x4a2ba1
or dl, bh
mov edx, 0xd1acadc8
aad 0xcf
call 0x6178e26
sbb dword [ecx], eax
or edx, 0xef250be4
mov eax, 0x177e3b31
mov dl, 0x17
add bl, byte [ebx - 0x49b7216a]
cmpsb byte [esi], byte es:[edi]
invalid
rcl ebp, 1
iretd
sub dl, byte [ecx - 0x52]
xor edx, dword [eax]
mov ah, 0x6a
cmp byte [ebx - 0x7c], 0xe7
shr esi, 0x90
push 0xffffffffffffff80
jnp 0x4a2b99
out 0xc1, eax
out dx, al
nop
lahf
inc edi
cmp cl, 0x1a
rcr byte [ecx + 0x245a676f], 0xb0
ficomp dword [ebx - 4]
add eax, 0x410c36c7
in al, 0x35
add al, 0x67
fmul qword [ecx - 0x3a60886]
rcl bh, cl
test al, 0x85
dec esp
and byte [ebx + 0x6ee15182], ch
fisttp dword [edx - 0x25]
wait
push es
add dword [0x3ca4455f], eax
xor edx, dword [esi + edx*8]
inc edx
popfd
inc eax
xor al, byte [eax]
push cs
pop esp
test dword [ebx], ebp
mov al, 0x29
test al, 0x60
push es
jbe 0x4a2c11
jecxz 0x4a2c0b
sub dword [eax - 0x4f89f9a0], ebp
and dword [edi + 0x407290ee], ecx
aad 0x19
test al, 0xa0
shr byte [ecx], cl
dec eax
pop es
wait
fistp dword [edi]
in al, 0x4a
mov dl, 0xca
outsb dx, byte [esi]
dec eax
xchg ebx, eax
in al, 0xf0
stosb byte es:[edi], al
test al, 0xcf
rol dword [esi + 0x60], 0xd7
push edx
js 0x4a2c2f
or dh, byte [eax + 0x6e]
cdq
test byte [esp + 0x68], dh
or dl, dl
sbb ebp, dword [esi]
invalid
jecxz 0x4a2c59
lodsd eax, dword [esi]
enter 0x5a96, 0xffffffffffffffa2
and eax, 0xc1a6a08c
or eax, 0x4469aac1
sub esp, ecx
wait
test eax, 0xa2af10b3
xor bh, byte ds:[ecx + 0x309d36d8]
push ds
mov ebx, 0x28e99cda
rcr byte [edi + 0x4d], 0x2e
sub esi, 0x2be2ac88
pushal
or byte [edx + 0x12], bl
daa
sbb esp, dword [eax + 0x54c15f2a]
add al, cl
fisub dword [esi + 0x2c]
mov byte [0x69f0a772], al
inc ecx
pop es
and eax, 0xe9d1d1bc
fcmovbe st(0), st(0)
mov edx, 0x2a86e5c2
aaa
mov byte [edx + 0x2138b2a7], ah
inc ecx
fcom qword [edx - 0x1c]
push 0xffffffffffffff8a
pushfd
push cs
sub ah, byte [eax + 0x28a137d0]
cmp cl, byte [ebp - 0x1980ad4e]
fild dword [eax]
inc edi
xor dh, byte [eax]
mov bh, 0x97
or eax, 0x46a18d6a
cmp eax, 0xdfe973f8
nop
scasb al, byte es:[edi]
dec ecx
daa
push eax
ret 0x3ee0
Function at 0x657ded
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65e398
cmp edx, dword [eax]
je 0x657e0f
add eax, 8
inc ecx
cmp eax, 0x65e428
jl 0x657e00
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65e398]
jne 0x657f3d
mov eax, dword [0xa5ad74]
cmp eax, 1
je 0x657f17
test eax, eax
jne 0x657e40
cmp dword [0x65e2c4], 1
je 0x657f17
cmp edx, 0xfc
je 0x657f3d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657e77
lea eax, [ebp - 0x1a4]
push 0x65d508
push eax
call fcn.006587d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658c60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657eba
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658c60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65d504
push edi
call fcn.0065ab30
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65d4e8
push eax
call fcn.006587d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006587e0
lea eax, [ebp - 0xa0]
push 0x65d4e4
push eax
call fcn.006587e0
push dword [esi + 0x65e39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.006587e0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65d4bc
push eax
call fcn.0065aaa4
add esp, 0x2c
pop edi
jmp 0x657f3d
lea eax, [ebp + 8]
lea esi, [esi + 0x65e39c]
push 0
push eax
push dword [esi]
call fcn.00658c60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402b18
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a28
test esi, esi
jne 0x402b4e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b18
jmp 0x402b6c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a2c
mov edi, eax
test esi, esi
je 0x402b6c
cmp dword [ebx], 0
je 0x402b6c
dec esi
jmp 0x402b55
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403aa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x51e00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403b40
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403b20
xor eax, eax
push ebp
push 0x403b19
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403b5c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x51e00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x51e00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404828
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52204c], 0
je 0x404889
cmp word [0x522220], 0xd7b2
jne 0x404851
cmp dword [0x522228], 0
jbe 0x404851
mov eax, 0x52221c
call dword [0x522238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x51e054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4048b0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51e01c], 0
jne 0x4048a5
push 0
push 0x51e074
push 0x51e054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4049dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027f0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x52204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4049a4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc