joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61c06b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
mov dword [esp + 9], ebp
lea esp, [esp + 0x20]
jmp 0x61c094

Function at 0x71caa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf si, ax
mov bl, 0xa8
cpuid
btr esi, edx
not cx
xor dl, ch
jmp 0x71cac3
rdtsc
lea eax, [eax - 0xd1]
rdtsc
mov esi, dword [esp]
not bh
pop si
jmp 0x71ca6f
push word [esp + 3]
add esp, 3
jmp 0x71ca88
mov si, sp
push esp
mov dword [esp], ebp
inc bl
mov ax, sp
mov dx, 0x6ab1
jmp 0x71cdf9
mov bx, word [esp]
mov bp, 0x41a9
rdtsc
xchg byte [esp], dl
neg ah
mov cx, word [esp]
jmp 0x71caaa
lea eax, [ecx + edi]
inc ebx
lea esp, [esp]
call fcn.0071caf2
mov bl, byte [edi]
invalid
xchg ch, dl
not ebx
mov di, 0xb9e7
mov di, word [esp]
xchg ebx, ebp
mov dl, dh
jmp 0x71cb0d
xchg byte [esp], bl
mov bp, dx
mov ch, byte [esp]
mov bp, word [esp]
lea edi, [ecx + edi]
mov byte [esp], ah
jmp 0x71cb24
mov al, 0xbe
bswap eax
xchg bp, si
cmc
mov di, word [esp]
lea esp, [esp + 1]
jmp 0x71cbe0
inc edx
pop dx
pop word [esp]
lea ebp, [edx + edi]
add esp, 1
not bh
jmp 0x71cc1c
mov dword [esp], ecx
sub ebx, eax
push word [esp]
mov dl, dh
lea ebp, [eax + edx]
mov dword [esp], esi
jmp 0x71ccf4
Function at 0x71cb81
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
mov cx, word [esp]
mov eax, ebp
jmp 0x71cb5a
rcl bx, cl
xchg bh, cl
lea esp, [esp + 1]
not esi
pop dx
pushal
jmp 0x71cbc1
mov ax, word [esp + 4]
lea ebx, reloc.WINMM.dll_midiStreamOut
lea esi, reloc.WINMM.dll_midiStreamOut
mov ah, byte [esp]
btc eax, edi
not ah
jmp 0x71cb36
bsf bx, si
not ecx
call 0x71cb81
inc esp
pop ebp
bswap ebp
sub esp, 6
pop dx
jmp 0x71cbf8
mov eax, dword [esp + 1]
add esp, 5
bswap edx
sub esp, 0xc
mov ecx, 0x541e9526
add esp, 9
jmp 0x71cb75
push dword [esp + 0xa]
lea esi, [ebx*4]
pop word [esp + 0x13]
lea esp, [esp + 0xf]
add esp, 0xf
jmp 0x71cb98
clc
mov dword [esp + 3], eax
mov word [esp], dx
setge ch
xchg bx, dx
mov cl, 2
jmp 0x71cc89
mov si, word [esp + 8]
neg bx
push dword [esp + 0xe]
push dword [esp + 0x10]
lea ebx, [eax + edi]
btc ecx, ebx
jmp 0x71cc65
clc
neg dh
push dword [esp + 6]
push dword [esp]
xchg word [esp + 9], cx
mov eax, ebp
jmp 0x71cc2e
pop edi
and bx, 0x5662
lea esp, [esp + 5]
lea edx, reloc.WINMM.dll_midiStreamOut
cpuid
mov dword [esp + 4], esi
jmp 0x71ccb3
cpuid
xchg ch, dl
btc eax, ebx
mov edx, dword [esp + 5]
btc eax, ebx
not ch
jmp 0x71cc52
xchg dword [esp + 3], edx
sub esp, 0x1e
inc di
pop cx
pop dword [esp + 0xa]
jmp 0x71ccc8
xchg bx, dx
xchg dword [esp + 7], ecx
stc
ror bh, 3
ror esi, 0x1b
pop word [esp + 3]
jmp 0x71cc9b
pop dword [esp + 0x18]
mov byte [esp + 0xd], bh
mov bx, dx
cld
mov dl, dh
xchg ah, bl
jmp 0x71ccde
push word [esp + 0xa]
neg ebx
pop bp
xchg edx, ebx
mov word [esp + 0x17], sp
jmp 0x71cd9c
xchg word [esp + 0x11], bp
lea ebx, [ebx + ebx]
cpuid
stc
rdtsc
bsr si, cx
call fcn.0071cd35
cpuid
mov byte [esp], bh
add esp, 5
xchg dword [esp + 1], eax
btr edx, edx
lea esp, [esp + 0xe]
jmp 0x71cdde
rdtsc
lea esp, [esp + 5]
mov ebx, 0xc1474ee2
mov ebx, ebp
mov bl, 0xf0
mov cl, ch
jmp 0x71cd4e
shr ch, 5
xchg byte [esp], cl
xchg byte [esp + 6], cl
pop cx
xchg ah, bl
call fcn.0071ce98
cmp al, 0xf
xchg esi, eax
bswap ecx
mov esi, dword [esp + 3]
push word [esp + 4]
not dx
lea ebp, [ecx + ebx]
jmp 0x71cdaf
mov ebx, eax
mov word [esp + 0xa], bx
btc ebp, ebx
xchg dword [esp + 6], ebp
pop dword [esp + 4]
cmc
jmp 0x71cdc5
Function at 0x71cf69
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], bx
pop cx
lea ebp, [esi + 0xad]
bsf bp, ax
xchg esi, ecx
mov byte [esp], ah
jmp 0x71cf2a
mov ecx, dword [esp + 3]
xchg word [esp + 1], cx
lea esp, [esp + 1]
mov ecx, dword [esp]
setbe dh
lea ebp, [esi*4]
jmp 0x71ce9e
mov dword [esp + 4], ebp
push esp
rdtsc
add esp, 0x11
and si, 0x3e82
xchg dh, al
jmp 0x71ceb9
add al, dh
btc eax, ebx
mov edi, dword [esp + 2]
mov dword [esp + 0x17], esi
xchg dword [esp + 9], ebp
shl di, cl
jmp 0x71cf3f
add esp, 0
bswap eax
xchg dx, bx
pushal
sub esp, 0
mov dword [esp + 0x12], ecx
jmp 0x71cef2
mov cl, 0xc2
xchg bh, cl
lea ebp, [edx*4]
btr ecx, edx
lea esp, [esp]
mov ebx, eax
jmp 0x71cf0c
btc ecx, ebx
lea esp, [esp + 1]
mov ecx, ebp
mov cx, word [esp + 0x18]
cpuid
setae ch
jmp 0x71cfac
push dword [esp + 1]
mov di, 0xb385
jmp 0x71cedf
add esp, 0xe
mov dh, byte [esp + 4]
mov edi, dword [esp + 3]
mov cx, dx
cpuid
pop bp
jmp 0x71cfe7
btc ebp, edi
setge ch
pop dword [esp + 0xe]
pop dword [esp + 0xd]
pop dword [esp]
btc ebp, edi
jmp 0x71cf76
add esp, 1
mov al, 0x1e
inc esi
bswap esi
mov dl, 0x14
not ebx
jmp 0x71cf90
bsf si, si
mov ebp, esi
not ecx
pushal
lea esp, [esp + 0x43]
cmc
jmp 0x71ee02
push edx
cmc
inc cx
pop dword [esp + 4]
mov dword [esp + 0xf], esi
bsf bp, ax
jmp 0x71cfba
pushal
pop ebp
xor bx, 0x639c
mov ebp, 0x79566520
mov cl, ch
push dword [esp + 0x10]
jmp 0x71cfd0
mov si, word [esp]
Function at 0x71d0dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 0xb]
neg esi
jmp 0x71d0e9
mov ebp, 0xd951dffe
mov al, ah
xchg ecx, edi
xchg bp, ax
rcl dx, cl
lea esi, [ecx + 0x83]
jmp 0x71d19c
mov ax, word [esp + 2]
mov di, 0x52b1
push dword [esp + 0x10]
mov dword [esp + 1], ecx
not edi
jmp 0x71d185
rcl bx, cl
push word [esp + 9]
mov ecx, 0x6cce8020
mov word [esp + 0x14], di
clc
jmp 0x71d120
push word [esp + 0xf]
mov dl, 0x7c
mov dword [esp + 0x11], ebp
xchg byte [esp + 0x15], bl
inc dx
bswap ebp
jmp 0x71d13d
sub esp, 0x12
mov bl, bh
lea ecx, [eax + edi]
xchg dh, al
xchg dword [esp + 6], ebx
rdtsc
jmp 0x71d156
mov edx, 0xeb746940
mov edi, dword [esp + 0xf]
mov dl, 0x4c
mov word [esp + 0x10], bx
jmp 0x71d206
pop edi
cld
mov al, ah
setno bh
lea edi, [edx*4]
pop dx
jmp 0x71d173
mov dword [esp + 0xd], ecx
xchg byte [esp + 4], bl
add esp, 1
add esp, 0x1e
cpuid
rcr esi, 9
jmp 0x71d1ef
mov edi, 0x2e3f3c46
lea esi, [eax + 0x59]
lea ebx, [ecx + ebx]
ror edx, 0x15
sub cx, 0x9a48
mov al, ah
jmp 0x71d1ae
xchg si, di
bswap edi
xchg edx, esi
mov byte [esp], dh
lea ebp, [ebx*4]
jmp 0x71d306
rcr ch, 5
mov byte [esp + 0x18], ch
not edx
pop si
mov bl, 0x28
mov eax, esi
jmp 0x71d1d8
xchg edx, eax
lea esp, [esp]
cpuid
mov ebx, 0x3b3d8d06
mov bl, bh
rdtsc
jmp 0x71d2e5
lea ecx, [esp + eax]
btc edx, ebx
mov bl, 0x90
lea ebp, [edx*4]
bswap esi
mov di, 0xacbb
jmp 0x71d217
not bx
xchg ch, dl
add dx, 0xdcc6
btc ebp, edi
mov al, ah
mov dx, word [esp]
jmp 0x71d236
mov dh, byte [esp]
xchg esi, eax
xchg byte [esp], cl
mov ecx, ebp
mov byte [esp], ah
btc esi, edi
call fcn.0071d2ad
ja 0x71d35d
jbe 0x71d363
dec edi
jne 0x71d375
dec edi
jo 0x71d369
outsb dx, byte [esi]
add byte [esi - 0x79], ah
stc
xchg cx, di
mov cx, sp
xchg ch, dl
mov cx, 0x4b39
mov byte [esp], bh
xchg ch, dl
jmp 0x71d257
xchg bx, di
call 0x71d36a
bswap eax
inc dx
pop edx
neg cx
lea ebp, [esi + 0xc5]
jmp 0x71d83c
push esp
xchg word [esp + 0xc], bp
push esp
xchg dword [esp + 0x11], esi
inc di
mov edx, 0xc5498e4e
jmp 0x71d31c
and al, 0x24
cpuid
mov dl, 0x14
mov al, ah
sub esp, 0x12
jmp 0x71d33a
sar byte [ecx - 0x3fac99a2], 1
bswap edx
btr eax, edx
mov ebx, dword [esp + 0x17]
pop esp
and al, 0x17
pop dx
jmp 0x71d324
pop ecx
lea esp, [esp + 2]
cpuid
bswap ebx
bswap eax
setns bh
call fcn.0071d4a5
push dword [esp + 3]
mov bx, sp
bsf dx, si
xchg dword [esp + 2], eax
pushal
push dword [esp + 0x15]
jmp 0x71d5d2
bsr bx, cx
bsr si, cx
shr bh, 3
bsr cx, bp
jmp 0x71d631
mov ebx, 0x5fcbde56
inc al
btc eax, ebx
cpuid
sete ch
pop ebx
jmp 0x71d5bc
pop dword [esp + 4]
bswap edi
push word [esp + 0x2f]
mov ch, byte [esp + 0x14]
setae dh
call fcn.0071d75f
cmpsd dword [esi], dword es:[edi]
into
pop ecx
pop esi
mov dword [esp + 0x16], esi
xchg byte [esp], dl
pop dword [esp + 0xb]
sub esp, 0x1a
jmp 0x71d5ff
push word [esp + 0x17]
mov dword [esp + 0xb], eax
pop edi
xchg dword [esp + 0x23], ebx
add al, dh
mov dword [esp + 8], ecx
jmp 0x71d619
pop ebx
mov dword [esp + 2], ebp
push word [esp]
not bh
stc
xchg dh, al
jmp 0x71d57a
bsf bx, ax
xchg dword [esp + 3], eax
mov esi, dword [esp + 0x13]
mov eax, 0x588f4e9e
mov bh, byte [esp + 6]
xchg ebp, ebx
jmp 0x71d7fa
Function at 0x71d4a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
neg dx
lea esi, [ecx + edi]
lea ebx, [eax + 0xa1]
xchg byte [esp + 0x22], cl
mov dword [esp + 0x18], ebp
jmp 0x71d457
push dword [esp + 6]
bsf dx, si
pushal
xchg ch, dl
not ah
bswap ecx
jmp 0x71d39c
neg eax
btr eax, esp
neg edi
setge bh
lea esp, [esp + 5]
mov bl, bh
jmp 0x71d3c8
xor ebx, esi
xchg word [esp + 0x1c], bp
mov ch, byte [esp + 0x10]
bswap ebx
jmp 0x71d533
pop dword [esp + 0x25]
xchg byte [esp + 0x18], dl
mov word [esp + 0x1e], di
mov byte [esp + 9], dh
jmp 0x71d3f7
xchg esi, ecx
pop bx
mov dx, 0x81c5
mov di, bx
not bh
sub esp, 0x1c
jmp 0x71d40e
mov bl, bh
bsr dx, cx
lea ebx, [esi - 0x25]
mov bx, 0x36bb
lea esi, [esp + ebp]
sub esp, 0
jmp 0x71d425
add esp, 0x1c
bswap ecx
setnp ah
push word [esp + 6]
push word [esp + 0xa]
push word [esp + 0xb]
jmp 0x71d43e
mov byte [esp + 3], ah
mov bx, 0xf9eb
btc ecx, ebx
cpuid
rdtsc
lea esp, [esp + 9]
jmp 0x71d3e5
jmp 0x71d47b
mov dx, word [esp + 0x18]
mov word [esp + 0x18], sp
rdtsc
mov ah, byte [esp + 0x10]
lea ebp, reloc.WINMM.dll_midiStreamOut
lea eax, [esi + 0xd5]
call fcn.0071d506
Function at 0x71d823
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop si
mov bl, 0x10
and cl, bh
mov ax, bx
and edi, ecx
push dword [esp]
jmp 0x71db6d
xchg bh, cl
jmp 0x71d80d
cmc
pop ax
bsf si, si
mov di, 0x1441
mov di, 0xd955
xchg dh, al
jmp 0x71d8a5
lea ebx, [eax - 0x49]
mov ecx, dword [esp]
lea ebx, [ebx + ebx]
rdtsc
lea ebp, [eax*4]
jmp 0x71d88e
mov dl, 0x14
mov si, sp
clc
stc
stc
rcl di, cl
jmp 0x71d855
sub esp, 0x16
push esp
setno dh
cpuid
pop dword [esp]
xchg ebx, edi
jmp 0x71da0d
mov bl, byte [esp]
setle ah
setle ah
not cx
not edi
lea edi, [edi + ebp]
jmp 0x71d868
pop word [esp + 0x1f]
lea esp, [esp + 0x23]
not edi
setae ch
pop word [esp]
inc bx
jmp 0x71d881
xchg dh, al
cld
btr edx, edx
add esp, 0
call fcn.0071d8df
pop dword [esp + 3]
mov word [esp + 4], sp
lea eax, [esi - 0x3d]
push word [esp + 5]
jmp 0x71d953
xchg byte [esp + 6], al
btc edi, ebx
mov ah, byte [esp + 7]
lea edx, [esi + 0x95]
jmp 0x71d969
xchg dword [esp + 3], edi
neg ax
mov dword [esp + 5], ecx
push word [esp + 8]
sub bl, ah
xchg edi, ebx
jmp 0x71d93c
neg dx
rcl bx, cl
pop word [esp + 9]
push word [esp + 0xc]
mov cl, ch
cmc
jmp 0x71d9c2
mov edi, esi
rdtsc
mov dl, 0x64
pop word [esp + 9]
lea esp, [esp + 0x15]
not ch
jmp 0x71d903
lea edi, [ecx - 0x9b]
neg ebp
add esp, 0
and bp, 0xc302
btc ebp, ebx
jmp 0x71d9f0
rcr edx, 3
mov dx, di
setns bh
mov esi, dword [esp + 1]
jmp 0x71d9a8
not ecx
xchg byte [esp + 7], cl
mov ch, byte [esp + 1]
push word [esp + 3]
not ch
mov ax, bx
jmp 0x71d992
mov cl, ch
mov byte [esp + 7], bh
mov bp, word [esp + 0xb]
neg dh
lea edx, reloc.WINMM.dll_midiStreamOut
xchg bp, ax
jmp 0x71da9d
mov dword [esp + 7], eax
add ebp, ebp
xchg dword [esp], ecx
setl bh
mov ebx, dword [esp + 5]
mov ax, word [esp + 8]
jmp 0x71d9da
cld
lea edi, [ecx + ebx]
bsr di, cx
call 0x71da41
mov si, 0xccf5
pop dx
lea esi, [ecx*4]
mov byte [esp + 0xf], ch
jmp 0x71db16
lea esi, [ecx + 0x33]
push word [esp + 0xc]
pop dword [esp + 1]
xchg dh, al
xchg dword [esp + 3], esi
mov dx, word [esp + 0xb]
jmp 0x71da58
mov cx, word [esp + 5]
neg ah
mov al, 0xce
cpuid
jmp 0x71dafc
rdtsc
pop dx
push word [esp + 1]
neg dh
push dword [esp + 0xe]
mov cx, word [esp + 3]
jmp 0x71dab6
lea ecx, [eax*4]
mov edx, 0x6dbe09ee
mov byte [esp + 0x37], ch
xchg byte [esp + 0x20], al
jmp 0x71db3f
mov edx, 0xa6176f2
sub esp, 0x1a
mov di, 0x7d29
push dword [esp + 0x18]
push esp
jmp 0x71dae2
pop word [esp + 0xc]
neg ecx
xchg bh, cl
xchg bx, dx
rdtsc
neg bh
jmp 0x71dacc
pushal
mov dl, 0x84
sub esp, 6
btr ebp, edx
pop ecx
call fcn.0071db53
push ebx
je 0x71db88
outsb dx, byte gs:[esi]
jne 0x71db3f
pushal
lea esp, [esp + 0x59]
setae ah
neg edi
bswap edi
lea esi, [ecx - 0xdb]
jmp 0x71db28
xchg ah, bl
bsr ax, bp
rdtsc
mov ah, byte [esp + 7]
pushal
lea ebp, [ebp - 0xf]
jmp 0x71d8c9
and al, 2
lea esp, [esp + 0x28]
popal
call fcn.0071dcf7
cmp al, 0xf
xchg esi, eax
add dword [esi - 0x79], esp
retf

Function at 0x722102
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
call fcn.007222aa
mov esp, 0x22d7b022
movsd dword es:[edi], dword [esi]
jecxz 0x72217b
not dword [edx + reloc.WINMM.dll_midiStreamOut]
xchg edi, eax
dec byte [ecx + 0x34ff2404]
and al, 0x66
pop dword [esp + 1]
Function at 0x402a36
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x7a2750]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x407010]
cmp eax, ebx
jne 0x402aca
mov esi, dword [0x407008]
mov edi, 0x105
jmp 0x402a87
cmp dword [ebp + 0x10], ebx
jne 0x402abe
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a36
test eax, eax
jne 0x402a99
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a6e
push dword [ebp - 4]
call dword [0x40701c]
push 2
call fcn.00405d12
cmp eax, ebx
je 0x402ad1
push ebx
push dword [0x7a2750]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402aca
push dword [ebp - 4]
call dword [0x40701c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7a2750], ebx
jne 0x402ac7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x407014]
test eax, eax
jne 0x402ac7
jmp 0x402aca

Function at 0x4058d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x407010]
test eax, eax
jne 0x405948
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [section..rdata]
test eax, eax
jne 0x405937
cmp dword [ebp + 0x14], 1
je 0x405939
cmp dword [ebp + 0x14], 2
je 0x405939
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [0x40701c]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405a12
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x405a30
mov ecx, dword [0x7a1e7c]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x7a26d8]
mov edx, dword [ebp + 8]
add ecx, eax
mov eax, 0x7a1640
push ebx
sub edx, eax
push esi
push edi
cmp edx, 0x800
mov edi, eax
jae 0x405c2f
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405c2f
mov esi, edi
sub esi, eax
cmp esi, 0x400
jge 0x405c39
inc ecx
cmp dl, 0xfc
mov dword [ebp + 0xc], ecx
jbe 0x405c22
movsx eax, byte [ecx + 1]
movsx ecx, byte [ecx]
mov esi, eax
mov ebx, ecx
and esi, 0x7f
and ebx, 0x7f
shl esi, 7
or esi, ebx
mov ebx, ecx
add dword [ebp + 0xc], 2
or bh, 0x80
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov ecx, eax
mov dword [ebp - 0x14], ebx
or ch, 0x80
cmp dl, 0xfe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x405bcc
push 2
pop esi
call dword [0x4070e8]
test eax, eax
jns 0x405adc
cmp ax, 0x5a04
je 0x405adc
cmp dword [ebp - 0xc], 0x23
je 0x405adc
cmp dword [ebp - 0xc], 0x2e
je 0x405adc
and dword [ebp - 4], 0
jmp 0x405ae3
mov dword [ebp - 4], 1
cmp dword [0x7a2724], 0
je 0x405aef
push 4
pop esi
test bl, bl
jns 0x405b2a
mov eax, ebx
and ebx, 0x3f
add ebx, dword [0x7a26d8]
and eax, 0x40
push eax
push edi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058d7
cmp byte [edi], 0
jne 0x405bb3
push dword [ebp - 0xc]
push edi
call fcn.00405a12
jmp 0x405bae
cmp ebx, 0x25
jne 0x405b3d
push 0x400
push edi
call dword [0x4070e4]
jmp 0x405bae
cmp ebx, 0x24
jne 0x405baa
push 0x400
push edi
call dword [0x4070a4]
xor esi, esi
jmp 0x405baa
mov eax, dword [0x7a26a4]
xor ecx, ecx
dec esi
cmp eax, ecx
je 0x405b76
cmp dword [ebp - 4], ecx
je 0x405b76
push edi
push ecx
push ecx
push dword [ebp + esi*4 - 0x18]
push dword [0x7a26a8]
call eax
test eax, eax
je 0x405bae
lea eax, [ebp - 8]
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x7a26a8]
call dword [0x407164]
test eax, eax
jne 0x405ba7
push edi
push dword [ebp - 8]
call dword [0x407150]
push dword [ebp - 8]
mov ebx, eax
call dword [0x407278]
test ebx, ebx
jne 0x405bae
and byte [edi], 0
test esi, esi
jne 0x405b52
cmp byte [edi], 0
je 0x405bc4
cmp dword [ebp - 0xc], 0x1a
jne 0x405bc4
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call fcn.00405a0c
push edi
call fcn.00405c52
jmp 0x405c10
cmp dl, 0xfd
jne 0x405bff
cmp esi, 0x1d
jne 0x405be4
push dword [0x7a26a8]
push edi
call fcn.0040594e
jmp 0x405bf5
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004059f0
add esi, 0xffffffeb
cmp esi, 7
jae 0x405c10
jmp 0x405bc4
cmp dl, 0xff
jne 0x405c10
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405a12
push edi
call fcn.00405a06
mov ecx, dword [ebp + 0xc]
add edi, eax
mov eax, 0x7a1640
jmp 0x405c2f
jne 0x405c2c
mov dl, byte [ecx]
mov byte [edi], dl
inc edi
inc ecx
jmp 0x405c2f
mov byte [edi], dl
inc edi
mov dl, byte [ecx]
test dl, dl
jne 0x405a5f
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405c4e
push eax
push dword [ebp + 8]
call fcn.004059f0
leave
ret 8
Function at 0x403cdb
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x462fd0]
xor eax, ebp
mov dword [ebp + 0xdc], eax
cmp dword [ebp + 0xec], 0x800
mov eax, dword [ebp + 0xe8]
push esi
mov dword [ebp - 0x3c], eax
mov esi, ecx
lea eax, [ebp - 0x40]
jne 0x403d73
push 0x4521d4
push 4
push eax
call fcn.00425b6d
push eax
call fcn.00402320
add esp, 0x10
push ebx
push edi
call fcn.00425ca6
mov edi, dword [eax]
call fcn.00425ca6
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004248e6
add esp, 0x18
mov dword [ebp - 0x3c], eax
call fcn.00425ca6
cmp dword [eax], ebx
je 0x403d8a
call fcn.00425ca6
push dword [eax]
call fcn.00403b49
pop ecx
jmp 0x403d91
push 4
push eax
push 3
push dword [ebp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x403d27
jmp 0x403e03
call fcn.00425ca6
mov dword [eax], edi
cmp dword [ebp - 0x3c], 0xffffffff
je 0x403dff
cmp dword [ebp - 0x3c], esi
jae 0x403dff
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.00425d80
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x403df1
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x403df1
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x403df1
push ebx
push ebx
push esi
jmp 0x403df7
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x403e01
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
pop esi
call fcn.00424420
add ebp, 0xe0
leave
ret
Function at 0x4107c7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x410800
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041076f
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00405f92
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x412707
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41274a
call fcn.00414267
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41274a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412765
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004122be
test ebx, ebx
mov esi, eax
je 0x412763
test edi, edi
je 0x412763
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x424420
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x462fd0]
jne 0x42442a
repz ret
jmp fcn.0042f1dc
Function at 0x430a9c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x463308]
je 0x430ab7
inc edi
cmp edi, 0x17
jb 0x430aa8
cmp edi, 0x17
jae 0x430c37
push ebp
push 3
call fcn.0043f530
cmp eax, 1
pop ecx
je 0x430c03
push 3
call fcn.0043f530
test eax, eax
pop ecx
jne 0x430aeb
cmp dword [0x462fe0], 1
je 0x430c03
cmp ebx, 0xfc
je 0x430c36
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x466888
push ebp
call fcn.00425b6d
add esp, 0xc
test eax, eax
je 0x430b21
push esi
push esi
push esi
push esi
push esi
call fcn.0042b842
add esp, 0x14
push 0x104
mov esi, 0x4668a1
push esi
push 0
mov byte [0x4669a5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x430b65
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00425b6d
add esp, 0xc
test eax, eax
je 0x430b65
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042b842
add esp, 0x14
push esi
call fcn.00425be0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x430baa
push esi
call fcn.00425be0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x466b9c
push 0x454d1c
sub ecx, eax
push ecx
push eax
call fcn.004291e7
add esp, 0x14
test eax, eax
je 0x430baa
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0042b842
add esp, 0x14
jmp 0x430bac
xor esi, esi
push 0x454d18
push ebx
push ebp
call fcn.00425ee2
add esp, 0xc
test eax, eax
je 0x430bcc
push esi
push esi
push esi
push esi
push esi
call fcn.0042b842
add esp, 0x14
push dword [edi*8 + 0x46330c]
push ebx
push ebp
call fcn.00425ee2
add esp, 0xc
test eax, eax
je 0x430bee
push esi
push esi
push esi
push esi
push esi
call fcn.0042b842
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043f373
add esp, 0xc
jmp 0x430c36
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x430c36
cmp ebp, 0xffffffff
je 0x430c36
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46330c]
push dword [esi]
call fcn.00425be0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret