joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449600
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4497ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44978c
mov dl, 1
mov eax, dword [0x411688]
call fcn.00403474
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004041f8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44977b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00437224
test al, al
je 0x44976e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4497bc
lea eax, [ebp - 0x254]
call fcn.00408cd0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44976e
xor eax, eax
push ebp
push 0x449767
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4497f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x449750
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404460
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x449750
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404460
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44976e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x449671
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004157d0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4497b2
lea eax, [ebp - 0x260]
call fcn.004041f8
ret

Function at 0x44a0e0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x44ebfc]
cmp byte [eax + 0xa5], 0
jne 0x44a151
cmp dword [0x44ec14], 0
jne 0x44a112
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44a09c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x44ec14], eax
cmp dword [0x44ec10], 0
jne 0x44a12d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x44ec10], eax
cmp dword [0x44ec18], 0
jne 0x44a151
push esp
push 0
push 0
push 0x44a040
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x44ec18], eax
pop edx
ret
Function at 0x44a248
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44a25f
add esp, 0xfffffff0
call fcn.004037f0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b138
mov eax, dword [0x44dd64]
cmp word [eax + 2], 0
jne 0x44a287
mov eax, dword [0x44dd64]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b87c
mov eax, dword [0x44dde8]
cmp word [eax + 2], 0
jne 0x44a2a1
mov eax, dword [0x44dde8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044ba74
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411198]
call fcn.00403474
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411198]
call fcn.00403474
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d278]
call fcn.00422e84
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44a428
mov eax, dword [0x44dca8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423254
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44bfe4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44dca8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a54c
test eax, eax
je 0x44a396
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040862c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040a574
test eax, eax
je 0x44a3aa
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404460
mov eax, dword [0x44dbd4]
cmp byte [eax], 0
jne 0x44a3de
mov eax, ebx
call fcn.0044a550
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044c1c0
mov eax, ebx
call fcn.0044cb00
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44a41e
call fcn.00403848
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a7c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44ebfc]
cmp dword [eax + 0x30], 0
je 0x44a86e
cmp dword [ebx + 0x94], 0
jne 0x44a868
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44a754
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44a868
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44a82e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44a868
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413838
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44a83d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44b34c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44b381
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042e8
jmp 0x44b38e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040424c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44c39c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44c3dd
mov eax, esi
call fcn.00432ae8
test al, al
je 0x44c3dd
mov eax, dword [ebx + 0x84]
call fcn.004327e4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c3dd
push 0
mov eax, dword [ebx + 0x84]
call fcn.004327e4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x1577315
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
sar eax, 0x13
aaa
shl eax, 3
push ebp
sal ah, cl
test esi, 0x768947e2
bsf eax, ebx
btr bp, sp
mov ebp, esp
add al, ch
bsf ax, di
sub esp, 0x18
cmp ah, dl
shld ax, si, 4
push esi
shl ax, 0xd
movzx eax, dl
shl eax, cl
push edi
bsr ax, dx
sub ah, bh
shrd ax, bp, cl
rcl al, cl
push ebx
pushfd
jmp 0x1578233
aas
pushal
mov dword [esp + 0x20], edx
setp ah
rol ah, 5
mov eax, dword [ebp + 8]
bt edi, edx
cmp bp, 0x3891
mov byte [esp + 4], bh
push edx
test eax, eax
lea esp, [esp + 0x24]
jl 0x25e0eae
je fcn.025e2b98
sub si, 0x1e2c
mov si, sp
mov esi, dword [eax + 0x3c]
shl edx, cl
btc dx, 6
add esi, eax
setl dl
shld dx, ax, 0xf
sal dl, 2
mov edx, dword [esi + 0x78]
cmc
test edx, edx
pushfd
pushfd
push ebx
lea esp, [esp + 0xc]
je fcn.025e2b98
rol cl, cl
add edx, eax
rol ch, 4
bsr cx, ax
rol ch, 3
mov ecx, dword [esi + 0x7c]
pushfd
push 0x91a8da1f
call fcn.01572f28
sub edi, dword [ebx]
mov ecx, 0x63abc0e1
xor ebp, dword [edx + 0x24]
mov byte [0x1af89e34], al
aad 0x25
lcall 0x8411, 0x58626a8c
inc esi
cmpsb byte [esi], byte es:[edi]
mov al, 0x81
mov edi, 0xd8088dce
neg dword [0x86964c9d]
mov al, byte [0x8cca6a22]
dec ebx
inc esi
jbe 0x157826e
retf 0x3e68
pushfd
jmp 0x2861f63
push dword [esp]
lea esp, [esp + 8]
je fcn.025e2b98
bswap si
mov esi, dword [eax + 0x3c]
mov dl, cl
ror dh, cl
add esi, eax
test di, cx
rol dh, 7
rol dh, cl
mov edx, dword [esi + 0x78]
call fcn.0159034f
int3

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ab143fd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5ddd36ae
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405b70
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x80
mov edx, 0xea0000bd
add byte [ecx - 0x2e032eb3], cl
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
pop edi
popal
js 0x405b7c
hlt
mov eax, dword [0x8b56ecb6]
jne 0x405b7f
invalid
shl byte [eax + ecx - 0x75], 0x42
and byte [eax + 0x4f750038], al
mov eax, dword [edx + 0x20]
cmp byte [eax], 0
jne 0x405bd6
mov ecx, dword [esi + 0xc]
jbe 0x405b1a
sbb byte [ecx], ch
push ebp
mov dword [ebp + 0x14], 0
pop edx
and al, 0x8b
bound ebx, qword [esp + ecx]
add al, 0x8a
mov dword [esi + 0x20], eax
aas
cmp byte [0x50411675], ch
add dword [eax - 0x7c], eax
sal byte [ebp + ecx*8 - 0x58], cl
inc esi
and byte [edx + 0x2dfa8010], cl
xor al, 0x1e
inc ecx
mov dword [esi + 0xc], ecx
mov edi, 0x2d42046
inc ecx
in eax, dx
mov ecx, dword [ebp + 0x10]
mov al, byte [esi + 0x10]
pop edi
pop esi
cmp eax, 0x117eb801
add dword [esi + 0x51], esp
and dword [edi], esi
lea ecx, [ebx + 0x7d8b20c5]
or ecx, dword [edi]
mov esi, 0xf8834202
mov eax, ebp
and byte [ebx - 0x41f0f483], cl
add al, byte [edx - 0x7d]
clc
cmp cl, byte [ecx - 0x8f3efba]
and byte [edi], cl
pop ss
rol byte [eax], 1
add byte [edi - 0x4100ab5e], bl
jl 0x405bb6
inc eax
add byte [ebx - 0x3f7a4d3c], al
ud0

Function at 0x408ac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov esi, dword [ebp + 0x758b560c]
adc byte [ecx*2 + 0x83c8bf8], dl
push 0
mov eax, dword [esi]
push 0x6e
invalid
Function at 0x121e82a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push dword [esp + 4]
lea esp, [esp + 0x14]
jne 0x1224b1b
push edi
pushfd
pushf
pop word [esp + 6]
mov byte [esp + 4], al
pushfd
mov dl, byte [esi]
push 0xa4e9864c
push edi
rol dl, 7
stc
test ch, 0x1f
bt bx, dx
clc
sub dl, 0x1f
pushfd
pushal
neg dl
test bl, 0x58
pushfd
pushfd
cmc
not dl
mov byte [esp + 0x14], bl
cmc
test dl, bh
add dl, 0x48
jmp 0x123d61a
call 0x215862b

Function at 0x1221803
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, eax
push ebp
cmp bl, bl
inc al
rcr bp, cl
not ah
mov ebp, esp
shl al, cl
aad 0x84
dec al
sub esp, 0x18
aam 0xcc
das
push esi
mov al, ah
cmp cl, 0xcf
shl ah, cl
not ax
push edi
sal al, cl
btr eax, edi
bswap ax
das
push ebx
pushfd
dec ah
mov dword [esp], edx
and ax, 0xdf78
rcr ah, cl
pushfd
mov eax, dword [ebp + 8]
jmp 0x2154da3
pushfd
pushfd
mov dword [ebp - 0x10], ecx
inc ch
mov ecx, dword [ebp + 0xc]
push 0x76ff2e6e
pushfd
cmp ecx, 0xffff
push 0xe7d998c
mov word [esp + 8], 0x90e2
lea esp, [esp + 0x34]
jbe 0x215906b
cmp cl, bh
mov edi, dword [edx + 0x24]
dec bh
push esi
add edi, eax
mov byte [esp], 0x42
mov ebx, dword [edx + 0x20]
add cl, 0xc7
adc ch, 0x3f
sbb cl, 0xfd
add ebx, eax
push dword [esp]
mov dword [ebp - 8], 0
btc ecx, 0x16
call fcn.021599fa
dec esi
ja 0x1222d12
mov edx, 0xe0e816f9
insb byte es:[edi], dx
add byte [esi + 0x77], cl
cmc
add ah, ah
pop es
adc bh, byte [ebx - 0x378f8e5c]
dec edi
push esi
push cs
out 5, eax
out 0xe2, al
or dword [ebx + 0x7937b430], edi
jb 0x1222d47
push esi
out dx, al
pop es
imul ecx, dword [eax + eax*2 + 0x2d9fc9ab], 0x45c05fbe
xor ecx, ecx
cmp byte [edx - 0x5e], bl
retf 0x25e5
mov byte [0xb625e5ca], al
cld
or ah, bl
inc esi
dec edi
nop
and edx, dword [esi - 0x43a2785c]
ficomp word [esi]
mov dl, 0x39
fadd qword [ebp + esi*4 + 0x4b13d109]
out 0x2d, eax
dec edi
ret 0x12f2
add edi, eax
call fcn.01240405
btr dx, sp
rcl dl, cl
sal dx, 3
mov edx, dword [esi + 0x78]
stc
test edx, edx
push 0x8f42887
lea esp, [esp + 4]
je fcn.012227eb
setno ch
rol cl, 5
test sp, 0xb75
add edx, eax
bsr cx, cx
shr cl, 6
sbb ch, 0x9d
shld cx, di, 9
mov ecx, dword [esi + 0x7c]
test al, 0xc5
pushal
add ecx, edx
jmp 0x1222cbf
mov word [esp], dx
test eax, eax
push esi
lea esp, [esp + 8]
je fcn.012227eb
xor dx, di
mov si, di
rcl dh, 4
shld si, cx, 9
mov esi, dword [eax + 0x3c]
btr dx, 0xd
sal edx, 0x12
sal edx, 0x15
add esi, eax
jmp 0x1228ba1
shld di, ax, cl
shr di, 2
bt bp, 0xd
add edi, 0xf53dee5
mov edi, dword [edx + 0x1c]
push 0x3b38339d
cmp ah, 0x46
jmp 0x1227b28
cmp ecx, dword [edx + 0x14]
push 0xcbf9864b
push edx
pushfd
jmp 0x2159029
lea esp, [esp + 0x30]
jae fcn.012227eb
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0xc]
jmp 0x21555cb
stc
pushal
mov byte [esp], al
test ch, 0x16
sub ecx, dword [edx + 0x10]
push edi
bt dx, 6
jmp 0x21564f4
Function at 0x1229c62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1227623
lea esp, [esp + 0x2c]
ja 0x2158b75
shl al, cl
sub ebx, edi
pushal
pop edi
stc
btc di, 9
add esp, 0x1c
add ebx, esp
dec edi
lea edi, [edi + 0x819e71f]
neg al
rcr edi, 0xf
mov edi, ebx
sete al
rcr al, 1
mov al, 0x2e
bt cx, dx
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x20]
jne 0x2157164
jmp 0x2156503
mov byte [esp], 0x80
cmc
clc
sub edi, 4
bt bx, di
push dword [edi]
pop dword [esp + 4]
pushfd
pushal
push dword [esp]
cmp edi, ebx
jmp 0x1223b44
not al
pushal
mov byte [edi - 1], 0
movsx ax, bl
call fcn.01221bb1

Function at 0x123d4f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
jb 0x12227ef
test bh, al
pushal
push ebp
push dword [esp]
cmp eax, dword [ebp - 0x10]
push dword [esp]
lea esp, [esp + 0x2c]
jae 0x12227ef
cmc
mov ebx, eax
neg di
lea ecx, [edi + 0x2636f3d0]
sal ecx, cl
mov edi, eax
rcl cl, cl
mov cx, di
shl cx, cl
rol ecx, 0xa
mov ecx, 0x104
call fcn.012223fa
ja 0x123d5b4
fmul qword [eax + edi*8 + 0x2301a970]
xchg ecx, eax
mov al, 0x15
mov edi, dword [eax - 0xd890912]
mov ds, edx
stc
and ebp, 0x7f
jbe 0x123d59f
mov eax, dword [0xf7f4d01b]
shr dword [edx], 0x1e
xlatb
adc eax, 0xc52c27d6
out 0x15, eax
in eax, 3
stc
test al, 0x9b
jnp 0x123d5e4
push 0x63ffce7c
out 0x59, eax
lcall 0x9e76, 0x9d74f92
dec edx
xor al, bl
jae 0x123d530
movsb byte es:[edi], byte [esi]
les ebp, [ecx - 0x4a]
nop
cmp byte [ebp - 0x18], 0x12
invalid
int3
sbb al, 2
test dword [edi - 0x49], ebx
insb byte es:[edi], dx
mov eax, dword [0x39d22bf9]
mov bh, 0xaa
retf
push edi
mov dh, 0xd8
sub dl, byte [esi]
adc eax, 0x91241702
div dword [ecx + 0x17]
mov al, byte [0x8caa68a3]
xchg edi, eax
cmp eax, 0x21920c2a
add byte [edx], al
lcall 0x42ba, 0x4d6fd61e
mov esi, 0xef698c0b
mov dh, 0x70
mov bl, 0x4f
aam 0x42
loope 0x123d5fa
mov bl, 0xaa
dec edi
ljmp 0xa2b9
dec edx
test word [ecx - 0x468a5589], bx
push 0xffffffffffffffab
je 0x123d593
invalid
Function at 0x123d61f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], dx
pushal
lea esp, [esp + 0x24]
jne 0x2157164
pushal
push esi
not ah
pushal
mov byte [edi - 1], 0
lea esp, [esp + 0x44]
jge 0x1221d08
not ax
push ebx
push 0xac857136
cwde
pushal
mov al, 0xad
lea eax, [0x123c981]
pushfd
pushfd
mov dword [esp + 0x28], 0x2157aee
mov byte [esp], 0xd9
mov dword [esp + 0x24], eax
pushal
pushfd
push dword [esp + 0x48]
ret 0x4c
test bh, ah
out dx, al
invalid
cmc
clc
sub al, 0x30
bt esp, eax
pushfd
bt sp, 1
cmp al, 9
pushal
pushal
call fcn.0123f0ca
pushal
pushal
mov dword [esp + 0x3c], ebx
not ah
lea eax, [eax*4 - 0x601959f3]
movzx ax, cl
mov byte [esp], 0x53
add al, 0x24
push ebx
lea eax, [0x123c981]
call fcn.0215b0f8
scasd eax, dword es:[edi]
sbb dword [ebx], esi
xor eax, 0x15d6de17
stosd dword es:[edi], eax
inc eax
test al, 0x43
sub dword [edi], edi
cmp dword [edi], ebp
popfd
dec esi
add eax, dword [ebp + 0x798075e3]
cmpsb byte [esi], byte es:[edi]
jae 0x1221cf2
jno 0x1221ced
neg byte [edi]
enter 0xffffffffffffd2bb, 0x7f
xchg edx, eax
in eax, 0x64
jg 0x1221dcd
pushfd
xchg edi, eax
shl dh, 1
mov al, 0x55
ja 0x1221d1c
jmp 0x4fd2635f
int1
mul byte [edx]
xlatb
out 0x43, al
xor edi, esi
pop eax
nop
and bl, cl
das
hlt
mov byte [esp + 8], 0xbb
lea esp, [esp + 0xc]
ja 0x2158b75
inc al
sbb al, cl
rol al, cl
test ax, si
sub ebx, edi
lea edi, [ebx - 0x7e4956d]
not edi
add ebx, esp
sal edi, 4
mov al, 0x7e
mov edi, ebx
rol al, cl
cmc
neg al
mov al, 0x2e
bt sp, 1
clc
repne scasb al, byte es:[edi]
push 0x31efe3af
jmp 0x1221675
stc
cmp edi, ebx
mov word [esp], cx
jmp 0x12248e8

Function at 0x123e78d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp]
mov dword [esp + 0xc], 0x8a7669f4
mov byte [esp], bh
push dword [esp + 4]
lea esp, [esp + 0x10]
jmp 0x215c5cb
push 0xaf3bc2a5
jmp 0x215d861

Function at 0x21581c0
Capabilities:
Encode data using xor

Disassembly:
into
push ss
pop es
sub dword [ebx - 0x65], esi
dec ebp
jae 0x21581e6
mov dword [edi + edi*4], ebp
or eax, 0x9b16781
dec eax
mov dl, 0x62
pop esi
push ds
inc edx
sbb eax, 0xdc81695e
and dh, cl
add dh, byte [ebp - 0x21cc4e9e]
inc ecx
mov al, 8
cmp al, 0x2c
test eax, 0x2a3e26cf
jecxz 0x2158205
stosb byte es:[edi], al
invalid
or dword [esi], edx
sti
push ebx
and ax, 0x726f
push ebx
jb 0x2158211
xchg ecx, eax
pushfd
add eax, edi
call fcn.02155cf1
fsubr st(5)
ja 0x21581bc
fist dword [eax]
and dword [esi - 0x58787a31], edx
rol byte [edx - 0x20f32fec], 1
mov dword [eax + ecx*2 - 0x5d], ebp
leave
sub al, 0x14
loope 0x2158165
jb 0x21581ee
pop esi
pop edx
xchg ecx, eax
das
mov esp, 0x22c9e704
invalid
out 0xc9, eax
and dh, al
xor esp, edx
fisub word [esi]
in al, dx
inc eax
imul ebx, dword [ecx + 0x7468bc64], 0xffffffd8
sub al, 0xd1
jp 0x21581ea
int1
mov edi, 0x29c0726a
daa
sbb dl, byte [esi - 0x36]
cwde
xchg esi, eax
out 5, al
push esp
pushfd
adc dl, ah
push cs
and edx, 0x6f6d38b7
fmul qword [eax]
std
jb 0x2158226
stosd dword es:[edi], eax
hlt
xor dl, dl
jg 0x21581b5
pop ecx
mov al, 0xd2
push cs
pushal
dec ebx
cdq
jo 0x21581c7
xchg ecx, eax
ret 0xc226
Function at 0x403304
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x469020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40339c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40337c
xor eax, eax
push ebp
push 0x403375
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40337c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x469020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x469020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404098
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46b048], 0
je 0x4040f9
cmp word [0x46b21c], 0xd7b2
jne 0x4040c1
cmp dword [0x46b224], 0
jbe 0x4040c1
mov eax, 0x46b218
call dword [0x46b234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46906c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404120
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x469030], 0
jne 0x404115
push 0
push 0x469064
push 0x46906c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405f02
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040448c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ec8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405eec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f09
lea eax, [ebp - 0x10]
call fcn.0040421c
ret

Function at 0x40b110
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b149
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040430c
jmp 0x40b152
mov eax, ebx
mov edx, esi
call fcn.00404270
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b15c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b17d
mov al, byte [esp]
jmp 0x40b17f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b814
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b67c
mov eax, dword [0x46a9c0]
cmp byte [eax], 0
je 0x40b890
mov eax, dword [0x46a7d0]
call fcn.00402d34
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040888c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b8d8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b8c6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46a780]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46b664]
call fcn.00405308
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret