joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0xa1860
call fcn.00408ca0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa1824], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1824]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
cmp dword [0x40b3c8], 6
jl 0x4072b0
movaps xmm0, xmmword [0x4098e0]
lea eax, [ecx + 4]
movaps xmm6, xmmword [0x409870]
movaps xmm4, xmmword [0x4099c0]
movups xmm5, xmmword [0x409860]
movaps xmmword [ebp - 0xa1860], xmm0
mov edx, dword [ebp - 0xa1860]
nop
movd xmm0, ecx
add ecx, 8
pshufd xmm3, xmm0, 0
paddd xmm3, xmm6
movd xmm1, edx
movaps xmm2, xmm3
psrld xmm2, 4
pshufb xmm3, xmm5
movaps xmm0, xmm2
punpckldq xmm0, xmm2
pmuludq xmm0, xmm4
punpckhdq xmm2, xmm2
pmuludq xmm2, xmm4
shufps xmm0, xmm2, 0xdd
psrld xmm0, 4
pshufb xmm0, xmm5
psubb xmm1, xmm0
vpmovzxbw ymm0, xmm3
vpmovzxbw ymm1, xmm1
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm0, zmm0
xorps xmm0, xmm3
movd xmm1, edx
movd dword [ebp + eax - 0xa180c], xmm0
movd xmm0, eax
pshufd xmm3, xmm0, 0
paddd xmm3, xmm6
movaps xmm2, xmm3
psrld xmm2, 4
pshufb xmm3, xmm5
movaps xmm0, xmm2
punpckldq xmm0, xmm2
pmuludq xmm0, xmm4
punpckhdq xmm2, xmm2
pmuludq xmm2, xmm4
shufps xmm0, xmm2, 0xdd
psrld xmm0, 4
pshufb xmm0, xmm5
psubb xmm1, xmm0
vpmovzxbw ymm0, xmm3
vpmovzxbw ymm1, xmm1
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm0, zmm0
xorps xmm0, xmm3
movd dword [ebp + eax - 0xa1808], xmm0
add eax, 8
cmp eax, 0xa17fc
jb 0x4071c0
cmp ecx, 0xa17fc
jae 0x4072e8
nop dword [eax + eax]
mov edx, ecx
mov eax, 0xcccccccd
shr edx, 4
mul edx
mov al, 1
shr edx, 4
sub al, dl
mov byte [ebp - 0xa181d], al
movsx edx, byte [ebp - 0xa181d]
movsx eax, cl
imul edx, eax
xor dl, cl
mov byte [ebp + ecx - 0xa1808], dl
inc ecx
cmp ecx, 0xa17fc
jb 0x4072b0
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa1840], 0xa17fc
mov dword [ebp - 0xa1844], eax
lea eax, [ebp - 0xa1844]
push 0x20
push eax
push dword [ebp - 0xa1824]
mov dword [ebp - 0xa183c], 0
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1844]
push eax
push dword [ebp - 0xa1824]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1844]
push eax
push dword [ebp - 0xa1824]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1824]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407e8e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x407510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14303c
call fcn.00408ca0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x143018], 0
push eax
push eax
push eax
mov word [ebp - 0x143004], ax
lea eax, [ebp - 0x143014]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x143018]
mov dword [ebp - 0x143014], 0x10001
push eax
mov dword [ebp - 0x143010], 0xac44
mov dword [ebp - 0x14300c], 0xac44
mov dword [ebp - 0x143008], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x142ff8
lea eax, [ebp - 0x143000]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
cmp dword [0x40b3c8], 2
jl 0x4076b7
movaps xmm2, xmmword [0x409870]
lea edx, [eax + 0xc]
movups xmm3, xmmword [0x4098b0]
lea esi, [eax + 4]
nop word [eax + eax]
movd xmm0, eax
lea ecx, [edx - 4]
pshufd xmm0, xmm0, 0
add eax, 0x10
paddd xmm0, xmm2
movaps xmm1, xmm0
psrld xmm1, 0xa
xorps xmm1, xmm0
pmulld xmm1, xmm0
psrld xmm1, 0x10
movd xmm0, esi
andps xmm1, xmm3
pshufd xmm0, xmm0, 0
packuswb xmm1, xmm1
paddd xmm0, xmm2
packuswb xmm1, xmm1
movd dword [ebp + esi - 0x143004], xmm1
movaps xmm1, xmm0
psrld xmm1, 0xa
xorps xmm1, xmm0
pmulld xmm1, xmm0
psrld xmm1, 0x10
movd xmm0, ecx
andps xmm1, xmm3
pshufd xmm0, xmm0, 0
packuswb xmm1, xmm1
paddd xmm0, xmm2
packuswb xmm1, xmm1
movd dword [ebp + esi - 0x143000], xmm1
movaps xmm1, xmm0
psrld xmm1, 0xa
add esi, 0x10
xorps xmm1, xmm0
pmulld xmm1, xmm0
psrld xmm1, 0x10
movd xmm0, edx
andps xmm1, xmm3
pshufd xmm0, xmm0, 0
packuswb xmm1, xmm1
paddd xmm0, xmm2
packuswb xmm1, xmm1
movd dword [ebp + edx - 0x143004], xmm1
movaps xmm1, xmm0
psrld xmm1, 0xa
xorps xmm1, xmm0
pmulld xmm1, xmm0
psrld xmm1, 0x10
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp + edx - 0x143000], xmm1
add edx, 0x10
cmp esi, 0x142ff4
jb 0x4075c0
cmp eax, 0x142ff8
jae 0x4076d3
mov ecx, eax
shr ecx, 0xa
xor ecx, eax
imul ecx, eax
shr ecx, 0x10
mov byte [ebp + eax - 0x143000], cl
inc eax
cmp eax, 0x142ff8
jb 0x4076b7
lea eax, [ebp - 0x143000]
mov dword [ebp - 0x143034], 0x142ff8
mov dword [ebp - 0x143038], eax
lea eax, [ebp - 0x143038]
push 0x20
push eax
push dword [ebp - 0x143018]
mov dword [ebp - 0x143030], 0
mov dword [ebp - 0x14302c], 0
mov dword [ebp - 0x143028], 0
mov dword [ebp - 0x143024], 0
mov dword [ebp - 0x143020], 0
mov dword [ebp - 0x14301c], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x143038]
push eax
push dword [ebp - 0x143018]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x143038]
push eax
push dword [ebp - 0x143018]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x143018]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407e8e
mov esp, ebp
pop ebp
ret
Function at 0x4086bf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4086fe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4086fe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4086fe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4086fe
cmp dword [ecx + 0x74], 0xe
jbe 0x4086fe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x42fe70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x42fe8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42fe91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42fe80
mov eax, 1
add ebx, ebx
jne 0x42fea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42fe98
jne 0x42feb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fe98
xor ecx, ecx
sub eax, 3
jb 0x42fec8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ff3a
mov ebp, eax
add ebx, ebx
jne 0x42fed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42fee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ff04
inc ecx
add ebx, ebx
jne 0x42fef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42fee5
jne 0x42ff01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fee5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ff24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ff15
jmp 0x42fe86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ff24
add edi, ecx
jmp 0x42fe86
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ff42
cmp byte [edi], 9
jne 0x42ff42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ff47
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42ffbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41258]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41338]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ff74
mov ecx, edi
jns 0x42ffa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41340]
or eax, eax
je 0x42ffb9
mov dword [ebx], eax
add ebx, 4
jmp 0x42ff91
call dword [esi + 0x4133c]
mov ebp, dword [esi + 0x41344]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42fff3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x147c076
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx + ebx]
bswap eax
ror edx, 3
mov bx, 0x9260
xchg dword [esp], ebp
bswap edx
call fcn.0147bf54
lea ebx, [edx + edx]
mov dl, byte [esp]
xchg ebx, eax
cmc
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
rdtsc
jmp 0x147bf7c
stc
rdtsc
mov eax, 0xfc8533a7
xchg dword [esp], ebp
jmp 0x147bfc5

Function at 0x1482df5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf146cd78
jmp 0x1482ea3
push word [esp + 2]
jns 0x1482e36
push dword [esp + 1]
push dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x28], esp
jmp 0x1482e65
push dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x28], esp
jmp 0x1482e7b
push dword [esp + 1]
jmp 0x1482e20
mov dword [esp + 0x24], ebp
jmp 0x1482e7f
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x1482ec5
lea ebx, [esp + ebx]
mov di, 0x76aa
rdtsc
jmp 0x1482ecb
lea esi, [esp]
xchg dx, di
mov edx, 0xa5b14596
xchg bl, ch
push sp
jmp 0x1483387
pushfd
jmp 0x148196b
mov ebp, dword [esp + 0x2c]
mov edx, 0xc5d73923
lea ecx, [edx*4]
xchg bx, ax
mov si, word [esp]
jmp 0x1482eae
bt cx, dx
push edi
call 0x148332d
fist word [esi - 0x3c]
mov dword [reloc.iphlpapi.dll_GetAdaptersInfo], eax
stc
fdivr dword [ebx]
adc cl, byte [eax]
ljmp 0xd1a3
or dl, ch
jb 0x14832f2
bt cx, dx
push edi
jmp 0x148335a
lea esp, [esp + 2]
sub esp, 0xc0
mov edi, esp
xchg ecx, eax
jmp 0x1483308

Function at 0x1482e13
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x20], ebx
call fcn.01482df5
invalid
mov dword [esp], ecx
lea esp, [esp + 2]
mov dword [esp + 4], edx
jmp 0x1482dea
Function at 0x14b9d6f
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x14b9db3
inc eax
inc dword [ebp + 8]
stc
push ebx
jmp 0x14b9d92

Function at 0x14b9e56
Capabilities:
Encode data using base64

Disassembly:
fimul dword [ebp + reloc.iphlpapi.dll_GetAdaptersInfo]
enter 0xffffffffffffe8e9, 1
add byte [eax], al
sub dh, byte [eax + 0xb04126]
sub eax, 0x1960f3c
ror byte [ebp + 0x4f042464], 0x66
push edi
push word [esp + 2]
jmp 0x14b9e8c
xor byte [ecx - 0x18], al
loopne 0x14b9e73
invalid
invalid
cmp ecx, 0x10
call fcn.014b9ec5
add eax, 0xa455329c
pushal
jne 0x14b9e6f
jns 0x14b9ea0
jmp 0x14b9ee1
lea esp, [esp + 2]
lea esp, [esp + 4]
add eax, 4
jmp 0x14b9e76
add cl, byte [ebp - 0x7cfbdb9c]
rol byte [ebx + ebp*8], 0xdd
pop edi
rcl byte [esi + 0x31], 0xc0
jo 0x14b9e83
jge 0x14b9e8f
je 0x14b9e2b
xor eax, 0x8d5489cc
shr al, 0xbd
invalid
add al, 0x24
jmp 0x14b9f24
rcl eax, 0x16
rol al, cl
xor eax, eax
jmp 0x146ed6f

Function at 0x156ef2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], cl
pop dx
mov dl, ch
mov si, 0xe70e
not si
jmp 0x156ef41
lea edx, [ebp*4]
mov ax, word [esp + 0xc]
pop dword [esp + 9]
add esp, 0xe
jmp 0x156ef16
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
mov si, 0x6336
adc edx, edx
cld
not edx
lea esi, [esi + edi]
jmp 0x156ef7b
mov eax, dword [esp]
xchg dx, ax
shl ah, 0
mov dl, byte [esp]
rdtsc
mov eax, ebx
jmp 0x156efd7
mov eax, 0x1a328ffb
bt dx, di
bsr dx, si
mov dh, al
lea esi, [ebx + ebx]
jmp 0x156efbc
cmc
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
mov dh, byte [esp]
xchg dh, ah
std
rdtsc
jmp 0x156fe35
xchg dx, ax
rcr al, 5
rdtsc
mov edx, dword [esp]
mov al, byte [esp]
mov dl, byte [esp]
jmp 0x156ef8c
sub edx, edx
std
call fcn.0156efe9
pop dword [esp + 0xd]
xchg word [esp + 6], si
mov dl, 0x18
btc ax, sp
mov byte [esp + 5], dl
mov si, 0xf004
jmp 0x156efff
btc esi, edi
mov esi, 0x9cc269b4
mov dh, 0x73
mov al, dl
lea edx, [edx + esi]
sub esp, 0xd
jmp 0x156f029
clc
mov edx, 0x8cbf2e7a
mov al, byte [esp]
mov dx, 0x863b
neg dh
sub esp, 9
jmp 0x156f35e
not ax
clc
mov ax, 0x334d
bsr esi, esi
stc
mov esi, 0x321ec1d7
jmp 0x156f914
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x23883002
mov ebx, 0x10564000
xor edx, ebx
mov ebx, 0x5b81f3e8
xor edx, ebx
mov esi, 0x600a8d28
xor esi, 0x734386f9
xor edx, esi
mov ebx, 0x2a272e73
xor ebx, 0x2ac56e6b
mov edx, 0x386674b3
mov ecx, 0x26625551
xor ecx, edx
xor ebx, ecx
mov edx, ebx
push edx
push 0x2a6168a8
mov ecx, 0x5ebc07fd
pop edx
xor ecx, edx
push ecx
push 0x2cb26bbb
mov edi, 0x46896514
pop ecx
xor edi, ecx
pop ebx
xor edi, ebx
pop eax
xor edi, eax
cmp edi, 0
je 0x403fc4
add dh, al
add eax, 0x40c033
add al, dh
add eax, 0x40c034
add al, dh
add eax, 0x40c035
add esp, dword [esi - 0x39]
add eax, 0x40c3dc
add byte [eax], al
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
mov edx, 0x404398
call fcn.00403c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404391
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x429ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x65eff4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xf8], ecx
lea eax, [ebp - 0xd0]
push eax
push 1
push 0
push 0x62c73c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x429e6b
mov dword [ebp - 0xdc], 0x20
mov dword [ebp - 0xe0], 0x80
mov dword [ebp - 0xd8], 0
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xec], ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xdc]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0xec]
push ecx
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xd8]
add eax, 1
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xf0], 0
jne 0x429e5e
mov dword [ebp - 0xdc], 0x20
push 0x62c778
lea ecx, [ebp - 0x44]
push ecx
call fcn.0042da30
add esp, 8
test eax, eax
je 0x429e59
mov dword [ebp - 0xe0], 0x80
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0xc4]
push eax
push 0
push 0
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc8], ecx
mov edx, dword [ebp - 0xc8]
mov ax, word [edx]
mov word [ebp - 0xd2], ax
mov ecx, dword [ebp - 0xcc]
cmp ax, word [ecx]
jne 0x429e25
cmp word [ebp - 0xd2], 0
je 0x429e19
mov edx, dword [ebp - 0xc8]
mov ax, word [edx + 2]
mov word [ebp - 0xd4], ax
mov ecx, dword [ebp - 0xcc]
cmp ax, word [ecx + 2]
jne 0x429e25
add dword [ebp - 0xc8], 4
add dword [ebp - 0xcc], 4
cmp word [ebp - 0xd4], 0
jne 0x429dbf
mov dword [ebp - 0xe4], 0
jmp 0x429e30
sbb edx, edx
or edx, 1
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jne 0x429e59
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x429e6d
jmp 0x429d05
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a980c
mov esp, ebp
pop ebp
ret 4

Function at 0x42da90
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x475511
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x47555b
call fcn.004772b6
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x475558
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4755a9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x475587
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.005aa066
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x475587
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4755a7
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.005aa066
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc