joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a2f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004148a5

Function at 0x419060
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418bb3

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7f6c1071
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7dfb7155
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x409e20
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x409ecb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e244
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e23c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x409eb5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x4022e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, 0xa
xor edi, edi
pop esi
mov dword [0x4041a8], esi
push edi
dec ecx
jne 0x40230f
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x4041a8]
mov dword [ebp - 0x3c], edx
lea ecx, str.contents
mov dword [ebp - 0x28], ecx
lea eax, section..text
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor eax, eax
push eax
push dword [0x4041a8]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4041b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4023c3
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x40]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4023aa
pop ebp
ret 0x10

Function at 0x43b641
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop eax
push esi
pop ebx
and ebx, ebx
call fcn.0043b668
or ebx, esi
xor dword [ecx], eax
or ebx, esi
dec ebx
inc ecx
and esi, ebx
sub ebx, ebx
cmp ecx, edi
jne fcn.0043b641
inc esi
add ebx, ebx
ret
Function at 0x402798
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027a6
call dword [0x4a001c]
or eax, eax
je 0x4027a7
ret
mov al, 1
jmp fcn.00402824

Function at 0x4027b0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027be
call dword [0x4a0020]
or eax, eax
jne 0x4027bf
ret
mov al, 2
jmp fcn.00402824

Function at 0x4027c8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402800
test edx, edx
je 0x4027ea
push eax
mov eax, ecx
call dword [0x4a0024]
pop ecx
or eax, eax
je 0x4027f9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402824
mov dword [eax], edx
mov eax, ecx
call dword [0x4a0020]
or eax, eax
jne 0x4027e3
ret
mov al, 1
jmp fcn.00402824
test edx, edx
je 0x402814
push eax
mov eax, edx
call dword [0x4a001c]
pop ecx
or eax, eax
je 0x4027f9
mov dword [ecx], eax
ret

Function at 0x402824
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x4a3004]
test ecx, ecx
je 0x402834
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40284d]
jns 0x402848
call fcn.00406f38
mov eax, dword [eax + 4]
jmp fcn.00403b3c

Function at 0x402868
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00406f38
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x40287d
ret
xor eax, eax
jmp fcn.00402824

Function at 0x4029ac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029db
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cb0
jmp 0x4029f9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402934
mov edi, eax
test ebx, ebx
je 0x4029f9
cmp dword [esi], 0
je 0x4029f9
dec ebx
jmp 0x4029e2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402dcc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e64
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e44
xor eax, eax
push ebp
push 0x402e3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e80
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030e4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4030fe
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4030fe
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030ea
mov al, 0xa
jmp fcn.00402824
ret
Function at 0x403130
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4a301c], 0
je 0x402a4f
call dword [0x4a301c]
mov eax, 0xd2
jmp fcn.00403b3c
push eax
push ecx
mov eax, dword [eax]
call fcn.00403100
pop ecx
pop eax
je 0x40313f
jmp ebx
pop ecx
jmp 0x402a40

Function at 0x403148
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00403100
mov eax, ebx
pop ebx
jne 0x40315d
pop ecx
jmp 0x402a40
ret

Function at 0x403a18
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4a34a4
mov esi, 0x4a3038
mov edi, 0x4a303c
cmp byte [ebx + 0x24], 0
jne 0x403a47
cmp dword [edi], 0
je 0x403a47
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403a36
cmp dword [0x4a3040], 0
je 0x403a8e
call fcn.00403994
cmp byte [0x4a3048], 0
je 0x403a74
mov edx, 0x4a002c
mov eax, 0x4a321c
call fcn.004067d4
call fcn.00406757
jmp 0x403a87
push 0
push 0x4a004c
push 0x4a002c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x4a3040], eax
cmp byte [ebx + 0x24], 2
jne 0x403a9e
cmp dword [esi], 0
jne 0x403a9e
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403868
cmp byte [ebx + 0x24], 1
jbe 0x403aae
cmp dword [esi], 0
je 0x403acb
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403acb
call fcn.004061ac
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403acb
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403840
cmp byte [ebx + 0x24], 1
jne 0x403ad9
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403ae4
call fcn.004039e4
cmp dword [ebx], 0
jne 0x403af1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403a8e

Function at 0x403b80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402798
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4a3049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403b48
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404230
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.004041f4
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.004041f4
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x4041dc
ret

Function at 0x4042d8
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402824
test ecx, ecx
je fcn.004041f4
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4041dc
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret
Function at 0x4043b0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4043ef
cmp al, 0xb
je 0x4043ef
cmp al, 0xc
je 0x4043f9
cmp al, 0xd
je 0x40440c
cmp al, 0xe
je 0x40442a
cmp al, 0xf
je 0x4043ef
cmp al, 0x11
je 0x4043ef
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402824
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4043ef
jmp 0x40443e
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4043f9
jmp 0x40443e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004043b0
dec edi
jg 0x40440f
pop ebp
jmp 0x40443e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404384
dec edi
jg 0x40442d
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404444
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004043b0

Function at 0x40447c
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4044c3
cmp al, 0xb
je 0x4044dd
cmp al, 0xc
je 0x4044f4
cmp al, 0xd
je 0x404503
cmp al, 0xe
je 0x404521
cmp al, 0xf
je 0x404537
cmp al, 0x11
je 0x404546
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402824
cmp ecx, 1
mov eax, ebx
jg 0x4044d4
call fcn.00403bcc
jmp 0x404555
mov edx, ecx
call fcn.00403bf0
jmp 0x404555
cmp ecx, 1
mov eax, ebx
jg 0x4044eb
call fcn.004041f4
jmp 0x404555
mov edx, ecx
call fcn.0040420c
jmp 0x404555
mov eax, ebx
add ebx, 0x10
call fcn.00405558
dec edi
jg 0x4044f4
jmp 0x404555
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.0040447c
dec edi
jg 0x404506
pop ebp
jmp 0x404555
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404450
dec edi
jg 0x404524
pop ebp
jmp 0x404555
mov eax, ebx
add ebx, 4
call fcn.00406274
dec edi
jg 0x404537
jmp 0x404555
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00405e08
dec edi
jg 0x404546
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x40455c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.0040447c
Function at 0x404568
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404594
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004028f4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x4045d3
cmp cl, 0xb
je 0x4045e4
cmp cl, 0xc
je 0x4045f5
cmp cl, 0xd
je 0x404606
cmp cl, 0xe
je 0x404626
cmp cl, 0xf
je 0x40463f
cmp cl, 0x11
je 0x404650
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402824
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403c20
mov eax, 4
jmp 0x404661
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404230
mov eax, 4
jmp 0x404661
lea edx, [esi + eax]
add eax, ebx
call fcn.00404934
mov eax, 0x10
jmp 0x404661
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404684
pop eax
jmp 0x404661
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404568
pop eax
jmp 0x404661
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040628c
mov eax, 4
jmp 0x404661
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405e44
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404582
pop ecx
sub ecx, eax
jle 0x40467d
lea edx, [ebx + eax]
add eax, esi
call fcn.004028f4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404684
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x4046ca
cmp cl, 0xb
je 0x4046e1
cmp cl, 0xc
je 0x4046f5
cmp cl, 0xd
je 0x404709
cmp cl, 0xe
je 0x40472a
cmp cl, 0xf
je 0x404747
cmp cl, 0x11
je 0x40475b
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402824
mov eax, ebx
mov edx, dword [esi]
call fcn.00403c20
add ebx, 4
add esi, 4
dec ebp
jne 0x4046ca
jmp 0x40476f
mov eax, ebx
mov edx, dword [esi]
call fcn.00404230
add ebx, 4
add esi, 4
dec ebp
jne 0x4046e1
jmp 0x40476f
mov eax, ebx
mov edx, esi
call fcn.00404934
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4046f5
jmp 0x40476f
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404684
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404712
jmp 0x40476f
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404568
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x40472a
jmp 0x40476f
mov eax, ebx
mov edx, dword [esi]
call fcn.0040628c
add ebx, 4
add esi, 4
dec ebp
jne 0x404747
jmp 0x40476f
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405e44
add ebx, 4
add esi, 4
dec ebp
jne 0x40475b
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x404934
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402824
cmp eax, edx
je 0x4049cb
cmp word [eax], 8
jb 0x40496c
push eax
push edx
cmp word [eax], 0x100
je 0x404962
cmp word [eax], 0x101
je 0x40495a
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x40496a
call dword [0x4a33e8]
jmp 0x40496a
add eax, 8
call fcn.00403bcc
pop edx
pop eax
cmp word [edx], 8
jae 0x404983
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40499e
cmp word [edx], 0x101
jne 0x4049b7
push eax
call 0x404972
pop eax
jmp dword [0x4a33f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x4049ae
mov ecx, dword [edx - 8]
inc ecx
jle 0x4049ae
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x4048e8
ret

Function at 0x404dcc
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404dda
mov edx, dword [edx + 8]
jmp fcn.00404230
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404b44
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.004041e4
add esp, 0x10
pop ebx
ret

Function at 0x404f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00405560
xor eax, eax
push ebp
push 0x404f72
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x4a33ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.00404f80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f79
lea eax, [ebp - 0x10]
call fcn.00405558
ret
cmp word [edx], 0x101
je 0x404f1c
cmp word [edx], 0x100
jne fcn.00404934
cmp word [eax], 8
jb 0x404fa5
push eax
push edx
call fcn.004048f0
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.004042fc

Function at 0x4050b0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x4050d9
cmp eax, 0x100
jne 0x40510c
mov eax, 8
cmp edx, 0x11
jbe 0x4050eb
cmp edx, 0x100
jne 0x40510a
mov edx, 8
mov al, byte [eax + 0x4a0064]
mov dl, byte [edx + 0x4a0064]
movzx ecx, byte [edx + eax*8 + 0x4a0078]
call dword [ecx*4 + 0x40511b]
pop edi
pop esi
pop ebx
ret
mov eax, edx
cmp eax, 0x101
jne 0x40513c
pop edi
pop esi
pop ebx
jmp fcn.0040502c
pop edi
pop esi
pop ebx
jmp 0x4048e8

Function at 0x405310
Capabilities:
Terminate process

Disassembly:
mov ecx, 0
jmp fcn.004050b0
Function at 0x405448
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x40546e
cmp eax, 0x100
jne 0x40549d
mov eax, 8
cmp edx, 0x11
jbe 0x405480
cmp edx, 0x100
jne case.default.0x405494
mov edx, 8
mov al, byte [eax + 0x4a0064]
mov dl, byte [edx + 0x4a0064]
movzx ecx, byte [edx + eax*8 + 0x4a0078]
jmp dword [ecx*4 + 0x4054af]
mov eax, edx
cmp eax, 0x101
jne case.0x405494.0
pop edi
pop esi
call fcn.004053b4
push eax
popf
ret
pop edi
pop esi
jmp 0x4048e8
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404c38
xchg edi, eax
call fcn.00404c38
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404cd8
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404cd8
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404d34
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404d34
fld xword [esp]
add esp, 0xc
jmp 0x405507
mov eax, edi
mov edx, esi
call fcn.0040534c
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404ca4
xchg edi, eax
call fcn.00404ca4
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x405ec8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406080
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405f29
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40609c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405f96
xor eax, eax
push ebp
push 0x405f8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f78
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4060bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f96
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406077
cmp byte [ebp - 0xd], 0
jne 0x405fd8
cmp byte [ebp - 0x12], 0
je 0x406077
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ff1
dec ebx
cmp byte [ebx], 0x2e
je 0x406000
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ff0
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406077
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40602d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406077
cmp byte [ebp - 0xd], 0
je 0x406077
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406077
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4062a8
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00406274
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x4062c2
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x4062d1
mov al, 0x17
jmp fcn.00402824
ret
Function at 0x40b870
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b8a9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403cb0
jmp 0x40b8b2
mov eax, ebx
mov edx, esi
call fcn.00403c64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b8bc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b8dd
mov al, byte [esp]
jmp 0x40b8df
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4180b8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4180cd
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x41a010
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41a016
ret

Function at 0x41c718
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41c769
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41c750
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41c740
jmp 0x41c769
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41c751
pop ebx
mov esp, ebp
pop ebp
ret