joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46af20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aec58
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x4d8104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0x4c0420
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.00403430
lea eax, [ebp - 0x3c]
push eax
call fcn.0046eb57
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00403d30
mov dword [esi], vtable.std::codecvt_utf8_wchar_t__1114111__0_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4a1395
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a120b

Function at 0x4a65eb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a6138

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x75991259
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7f3f6c82
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x78c176fd
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x42af34ba
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x43b642
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub ecx, 1
sub ecx, 0x93dc655d
call fcn.0043b68f
sub ecx, edx
and ecx, ecx
add edx, 0xddb1f0e5
xor dword [ebx], eax
mov ecx, 0x296de79c
add ecx, 0xa3aa3389
mov edx, ecx
add ebx, 1
add ecx, 0x9a155d6e
or ecx, edx
mov edx, edx
cmp ebx, edi
jne fcn.0043b642
mov ecx, 0xe842efb4
ret
Function at 0x100168b
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a1f4]
push ebx
xor ebx, ebx
cmp eax, 2
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
mov dword [ebp - 4], ebx
jne 0x10017ae
lea eax, [ebp - 4]
push eax
call fcn.010015f6
test eax, eax
jne 0x100179c
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10017ae
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x1001790
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001790
push esi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x100178f
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x1001788
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1001788
cmp dword [esi], ebx
jbe 0x100177f
lea edi, [esi + 4]
push dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1001774
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x100175b
jmp 0x100177f
xor eax, eax
inc eax
mov dword [0x100a1f4], eax
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x10017ab
cmp dword [ebp - 4], ebx
je 0x10017ab
mov dword [0x100a1f4], 1
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x1001ea3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001ef0
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1001ee7
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x1001f4b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001f68
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1001f6b
and eax, 0x10
ret 4
Function at 0x100376f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.010022f2
jmp 0x1003773
inc dword [ebx - 0x5a7cf33c]
add cl, bh
invalid
inc dword [eax]
jmp 0x100378e
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x10037d7
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1003781
call fcn.01002381
js 0x1003836
jle 0x1003823
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.01002381
je 0x1003823
invalid
clc
invalid
loopne 0x1003830
invalid
mov dword [0xd4858d52], eax
clc
invalid
Function at 0x1004c18
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100b4a4], eax
xor eax, eax
mov ecx, 0x23f
mov edi, 0x100aba0
rep stosd dword es:[edi], eax
push 0x41
mov ecx, 0xcb
mov edi, 0x100b880
rep stosd dword es:[edi], eax
pop ecx
mov edi, 0x100aa80
rep stosd dword es:[edi], eax
push 0x7f
mov esi, 0x100abb4
xor edi, edi
push esi
xor ebx, ebx
inc edi
push 0x100142c
mov dword [ebp - 4], ebx
mov dword [0x100ae4c], edi
call fcn.01002a34
cmp eax, ebx
je 0x1004e3d
cmp eax, 0x80
ja 0x1004e3d
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100aa50], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100b494
push 0x1001420
call fcn.01002a34
test eax, eax
je 0x1004cd5
test byte [0x100b494], 0xc0
je 0x1004d65
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1001410
call fcn.01002a34
test eax, eax
jne 0x1004cf4
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.010038cc
mov dword [0x100aa5c], 0x80070714
jmp 0x1004e4d
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100aa54], eax
je 0x1004d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1004d65
test byte [0x100b494], 0x80
je 0x1004d34
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.010038cc
jmp 0x1004d4a
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.010038cc
cmp eax, 6
je 0x1004d65
push dword [0x100aa54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100aa5c], 0x800700b7
jmp 0x1004e4d
push dword [ebp + 0xc]
mov dword [0x100aa60], ebx
call fcn.010030a7
test eax, eax
jne 0x1004d86
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1004e47
cmp byte [0x100b89a], bl
je 0x1004d9d
push 0x100b89a
call fcn.01001c7f
jmp 0x1004e4d
push 0xa
push 0x1001404
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x1004dbe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100a2bc], ebx
je 0x1004dcc
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100b884], ebx
jne 0x1004e39
push dword [ebp - 4]
call 0x10041cd
test eax, eax
je 0x1004e4d
mov ax, word [0x100aa64]
cmp ax, di
je 0x1004df7
cmp ax, 2
je 0x1004df7
cmp ax, 3
jne 0x1004e39
test byte [0x100b495], 1
je 0x1004e39
test byte [0x100b898], 1
jne 0x1004e39
call fcn.0100168b
test eax, eax
jne 0x1004e39
push 0x83e
push 0x547
push 0x10017b1
push ebx
push 0x7d6
push dword [0x100b4a4]
call fcn.01004161
cmp eax, 0x83d
jne 0x1004e4d
mov eax, edi
jmp 0x1004e4f
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.010038cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401170
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403676
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x58], esi
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov al, 0x41
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x14], 0x5c3a41
mov byte [ebp - 0x4d], al
nop dword [eax + eax]
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x14]
push eax
call edi
cmp eax, 3
jne 0x4012c0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4012c0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401246
sub eax, edx
lea ecx, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401b70
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x3c]
push ecx
cmp eax, dword [esi + 8]
je 0x401284
mov edx, eax
call fcn.00402340
add esp, 4
add dword [esi + 4], 0x20
jmp 0x40128c
push eax
mov ecx, esi
call fcn.00402150
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
cmp ecx, 0xf
jbe 0x4012c0
mov edx, dword [ebp - 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4012b6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4012ed
push ecx
push edx
call fcn.00402760
add esp, 8
mov al, byte [ebp - 0x4d]
inc al
mov byte [ebp - 0x4d], al
cmp al, 0x5a
jle 0x4011f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402722
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x401350
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x54], 1
jle 0x401410
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40141e
mov ecx, dword [esp + 8]
mov edx, 0x404224
mov eax, dword [esp + 0xc]
shrd ecx, eax, 0x1e
push 0x401ec0
shr eax, 0x1e
push eax
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401ca0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64__]
push ecx
mov edx, 0x404220
mov ecx, eax
call fcn.00401ca0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
shrd ecx, edx, 0x1e
shr edx, 0x1e
call fcn.004035f0
movsd xmm1, qword [0x404310]
comisd xmm1, xmm0
jae 0x401410
cmp dword [esp + 0x54], 2
jg 0x40141e
movsd xmm1, qword [0x404308]
comisd xmm1, xmm0
jb 0x40141e
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00402722
mov esp, ebp
pop ebp
ret
Function at 0x402b3f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x402b74
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x402b71
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x402b7d
add edx, 0x28
cmp edx, esi
jne 0x402b5f
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x402b7a

Function at 0x402fc2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403001
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403001
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403001
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403001
cmp dword [ecx + 0x74], 0xe
jbe 0x403001
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40344c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004062bc
test esi, esi
jne 0x403484
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004063f8
jmp 0x4034a2
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403330
mov edi, eax
test esi, esi
je 0x4034a2
cmp dword [ebx], 0
je 0x4034a2
dec esi
jmp 0x40348b
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403fec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x546020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404084
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x404064
xor eax, eax
push ebp
push 0x40405d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4040bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404064
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x546020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x546020], ax
mov esp, ebp
pop ebp
ret

Function at 0x405240
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x552054], 0
je 0x4052a1
cmp word [0x552330], 0xd7b2
jne 0x405269
cmp dword [0x552338], 0
jbe 0x405269
mov eax, 0x55232c
call dword [0x552348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4052cc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x54602c], 0
jne 0x4052bd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x546034], 0
je 0x405466
mov edx, esi
mov eax, ebx
call dword [0x546034]
jmp 0x405475
mov eax, 8
call fcn.00403048
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x552055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405408
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4088d4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40c558
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x40c5f8
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.00405d18
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.00405bf0
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x40c582
cmp byte [esp], 0
je 0x40c5c7
mov eax, edi
call fcn.00405bf0
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x40c604
mov eax, edi
call fcn.00405bf0
push eax
mov eax, edi
call fcn.00405bf0
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00403230
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.00405d18
jmp 0x40c604
mov eax, edi
mov edx, 0x40c618
call fcn.00405510
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c61c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x40c6bf
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.00406578
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00406c34
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x40c644
cmp byte [esp], 0
je 0x40c68d
mov eax, edi
call fcn.00406c34
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x40c6cb
mov eax, edi
call fcn.00406c34
push eax
mov eax, edi
call fcn.00406c34
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call fcn.00403230
mov edx, ebx
mov eax, edi
call fcn.00406578
jmp 0x40c6cb
mov eax, edi
mov edx, 0x40c6e0
call fcn.004062bc
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d838
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x546a98], 0
jne 0x40d870
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40d867
movzx eax, word [esp]
mov word [0x546a98], ax
jmp 0x40d870
mov word [0x546a98], 0x2c
movzx eax, word [0x546a98]
pop edx
ret
Function at 0x40de44
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40de4c
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e05e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x40de8f
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x546824]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004064d8
jmp 0x40e02b
test ebx, 0xc0000000
je 0x40ded7
lea edx, [ebp - 0x10]
mov eax, dword [0x546ab0]
call fcn.0040e07c
mov eax, dword [ebp - 0x10]
call fcn.00405b78
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x546894]
call fcn.0040e07c
mov eax, dword [ebp - 0x14]
call fcn.00405b78
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x40ded7
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x40df1c
cmp ebx, 0xbb7
ja 0x40df1c
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x546aac]
call fcn.0040e07c
mov eax, dword [ebp - 0x18]
call fcn.00405b78
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40df21
or edi, 0x800
jmp 0x40df21
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40e024
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x40dfc4
xor eax, eax
push ebp
push 0x40dfbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406468
mov eax, dword [esi]
call fcn.0040656c
mov ebx, eax
test ebx, ebx
jbe 0x40dfa6
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x40df8d
mov eax, esi
call fcn.00406c34
mov word [eax + ebx*2 - 2], 0x20
jmp 0x40dfa1
cmp di, 0xa
jne 0x40dfa1
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.004069e0
dec ebx
test ebx, ebx
ja 0x40df70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e007
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x546ab4]
call fcn.0040e07c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.004064d8
push dword [ebp - 0x1c]
push 0x40e078
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.0040d044
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.00406760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e02b
cmp dword [ebp - 8], 0
je 0x40e023
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e065
lea eax, [ebp - 0x24]
call fcn.004062ac
lea eax, [ebp - 0x20]
call fcn.004054bc
lea eax, [ebp - 0x1c]
call fcn.004062ac
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004054e0
ret