joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xdc80dc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc80e6
pushal
call 0xdc80ec
pop ebp
sub ebp, 0x10
sub ebp, 0x9c80dc
jmp 0xdc8102
mov eax, 0x9c80dc
add eax, ebp
add eax, 0x4c
mov ecx, 0x595
mov edx, 0xc1c0090b
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc8119
jmp 0xdc812c
add dh, 0x80
xor byte [edi], 0xb
or ecx, dword [ebx]
mov cl, dl
or ecx, dword [ebx]
or ecx, dword [eax]
invalid
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x10019216
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001924e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10017985
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1001795d
jmp 0x1001925a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, 0xa42b5eee
nop
inc eax
mov eax, ebx
mov eax, 0x71caeb3a
cmp eax, 0x324757e9
cmp eax, 0xd07708b3
mov eax, ecx
cmp eax, 0xec6def12
nop
mov eax, ebx
cmp eax, 0xf94083e8
mov eax, ebx
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
nop
cmp eax, 0x31
nop
inc eax
mov eax, ebx
cmp eax, 0xe8282c85
mov eax, ecx
cmp eax, 0xa780fcf1
cmp eax, 0xacdf5bc9
mov eax, ecx
mov eax, ecx
inc eax
cmp eax, 0xc
mov eax, ebx
mov eax, 0x9fae929c
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x756a0273
inc eax
mov eax, 0xe3b51356
cmp eax, 0x2a4908c4
mov eax, ebx
nop
cmp eax, 4
nop
cmp eax, 0x2561200b
mov eax, 0x9e7edcf9
cmp eax, 0x4d
cmp eax, 0xb965b4ca
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc eax
cmp eax, 0xffffffc0
nop
cmp eax, 0xffffffa9
mov eax, ebx
mov eax, ebx
mov eax, 0x2deca928
cmp eax, 0x1e
cmp eax, 0xffffffe3
mov eax, 0xbcda9858
mov eax, 0x919c3ec7
cmp eax, 0xf3d94c39
mov eax, ecx
inc eax
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
cmp eax, 2
cmp eax, 0xfffffffc
mov eax, 0x41282121
cmp eax, 0x8ee89c68
cmp eax, 0x5dbc458a
mov eax, ecx
cmp eax, 0x4eef7b08
mov eax, ecx
mov eax, ecx
cmp eax, 0x22
cmp eax, 0xb7f87a69
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ebx
cmp eax, 0x5a58eda1
cmp eax, 0xc77add9a
cmp eax, 0x88db0a93
mov eax, ecx
mov eax, ecx
inc eax
mov eax, ebx
mov eax, ebx
mov eax, ecx
mov eax, 0x122bc41
cmp eax, 0xffffffd7
nop
mov eax, 0x7610bb3b
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401ef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4835c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x48b028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], vtable.CBitmap.0
mov eax, dword [ebp + 8]
mov dword [esp + 0x38], ecx
cmp eax, 2
jl 0x401f39
cmp eax, 6
jle 0x401f3e
mov eax, 2
cmp dword [ebp + 0xc], ecx
je 0x401f4d
movzx eax, word [eax*2 + 0x484bfc]
jmp 0x401f55
movzx eax, word [eax*2 + 0x484bf0]
push eax
push 2
push eax
call dword [0x484830]
push eax
call dword [0x48424c]
push eax
lea ecx, [esp + 0x10]
call dword [0x484690]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x18
push ecx
call dword [0x484074]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
push edx
call dword [0x484070]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CBitmap.0
call fcn.00402260
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x403320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4839bc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x48b028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea edi, [esi + 0x18]
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call dword [0x48484c]
mov dword [ebp - 4], ebx
xor eax, eax
lea ebx, [esi + 0x34]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.004033f0
mov dword [esi], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov ecx, 2
push edi
mov edi, dword [0x48423c]
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
call edi
xor eax, eax
push 0x48515c
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call dword [0x484670]
push 0
push 0
push 0
push 0
push ebx
call edi
cmp byte [ebp + 0xc], 0
mov dword [esi + 0x44], 0x18
je 0x4033d4
mov ecx, esi
call fcn.00403d30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x483989
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x48b028]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
xor ecx, ecx
call fcn.004035a0
mov ecx, 1
mov dword [esi], eax
call fcn.004035a0
mov ecx, 2
mov dword [esi + 4], eax
call fcn.004035a0
mov ecx, 3
mov dword [esi + 8], eax
call fcn.004035a0
mov ecx, 4
mov dword [esi + 0xc], eax
call fcn.004035a0
mov ecx, 5
mov dword [esi + 0x10], eax
call fcn.004035a0
mov ecx, 7
mov dword [esi + 0x14], eax
call fcn.004035a0
mov ecx, 8
mov dword [esi + 0x28], eax
call fcn.004035a0
lea edi, [esi + 0x30]
lea ebx, [esp + 0x10]
mov dword [esi + 0x2c], eax
call fcn.004038d0
push eax
mov ecx, edi
mov dword [esp + 0x44], 0
call dword [0x484668]
mov ecx, ebx
mov dword [esp + 0x40], 0xffffffff
call dword [0x484874]
mov ecx, 0x12
call fcn.004035a0
push 0x11
lea edx, [esi + 0x34]
lea ecx, [esp + 0x18]
mov dword [esi + 0x44], eax
call fcn.00403750
mov ecx, dword [eax]
mov dword [esi + 0x34], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x38], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x3c], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x40], edx
push 6
lea edx, [esi + 0x18]
lea ecx, [esp + 0x28]
call fcn.00403750
mov ecx, dword [eax]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x24], edx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
xor ecx, ecx
mov eax, 0x37
mov edx, 2
mul edx
seto cl
push edi
mov dword [esi], 0
neg ecx
or ecx, eax
push ecx
call dword [0x48486c]
push str.Version
push str.fx_991ES_PLUS_C
push str.ESPLUSemulator4
push 0x4852c0
push str._s_s_s_s
mov edi, eax
push 0x37
push edi
call dword [0x4841a8]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call dword [section..rdata]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x404f99
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.VERSION
push ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0x20
call dword [0x484030]
mov ebx, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
lea edx, [esi + 8]
mov dword [esi + 4], eax
push edx
mov eax, 0x485358
call fcn.004050e0
mov ebx, dword [ebp - 4]
lea eax, [esi + 0xc]
push eax
mov eax, str.HELP
call fcn.004050e0
mov ebx, dword [ebp - 4]
lea ecx, [esi + 0x1c]
push ecx
mov eax, str.SerialNo
call fcn.004050e0
mov ebx, dword [ebp - 4]
lea edx, [esi + 0x20]
push edx
mov eax, str.Country
call fcn.004050e0
mov ebx, dword [ebp - 4]
add esi, 0x24
push esi
mov eax, str.MANUAL
call fcn.004050e0
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
push eax
call dword [0x484034]
push edi
call dword [0x484888]
add esp, 4
pop edi
xor eax, eax
test ebx, ebx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov ah, byte [esi]
or byte [ebx + 0x56], dl
mov esi, dword [ebp - 0x54]
push edi
add dword [0x75663c18], 0xffffffc2
mov ecx, dword [ebp - 0x49]
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 0x10]
sbb al, 0x55
push ebp
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call fcn.00408560
jmp 0x4083bf
out dx, eax
adc eax, 0x6b40c174
mov ecx, dword [ecx - 3]
xchg ebp, eax
sbb byte [ecx + 0x157e013a], bl
xor eax, eax
sbb dword [ebx], eax
add dword [eax], eax
add byte [edx + 0x15ff50af], cl
push 0x8500b3c1
les ecx, [eax]
jmp 0x4083f9
test eax, eax
je 0x408443
cmp bl, 0x83
leave
push dword [ebx]
ror byte [ebx - 0x510ddbab], 0xa7
inc ebp
and byte [ebx + 0x49d1f782], cl
mov eax, ebx
mov dword [edx], ecx
inc ecx
mov edx, ecx
shr dword [ecx + 2], 0xf3
and al, 0x8b
in al, dx
and ecx, 3
movsb byte es:[edi], byte gs:[esi]
mov ecx, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
invalid
mov esi, dword [ebp + 0x20]
mov byte [esi], 0x30
inc esi
test edi, edi
jle 0x40849b
mov byte [esi], 0x2e
inc esi
test eax, eax
jge 0x40847e
idiv ebp
mov ecx, eax
mov edi, edx
sbb al, 0x8b
sar dword [eax - 0x3acfcfd0], 1
mov edi, esi
fsub st(1), st(0)
add dh, bl
stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
retf
push 0xeb184589
aas
dec eax
inc esi
mov dword [ebp - 0x73], eax
sbb eax, dword [edx]
mov byte [ecx], cl
sub dword [ebx - 2], eax
sar byte [edi - 0xf], 0x48
test edi, edi
mov dword [ebp + 0x18], eax
jg 0x4084a2
mov ecx, dword [ebp + 0x14]
test dword [ecx + 0x74], ebx
and esi, eax
push es
jno 0x4084ec
mov byte [esi], 0x71
inc esi
jmp 0x4084c3
inc esi
mov byte [ebp - 0x74f88041], al
inc ebp
adc al, 0x85
sal byte [esi + eax - 0x3a], 6
std
mov eax, dword [ebp + 0x18]
mov ch, byte [ecx]
push 0xffffffffffffffc9
je 0x4084d4
xchg edi, eax
push cs
mov cl, byte [ebx + 1]
inc esi
pushal
dec esp
jae 0x4084af
cmc
and byte [edi + 0x66], 0xff
push 0x98466488
mov dword [ebp + 0x18], eax
je 0x408521
lea esp, [ecx]
sbb al, 0x8d
push ebp
push ecx
lea ecx, [ebp + 8]
push edx
imul ebp, dword [edx], 0x50
call 0x4b4080f0
mov ecx, dword [ebx - 0xf3b84f8]
mov ecx, dword [ebp + 0x1c]
test ebx, ebx
setne byte [ecx + 0x1f98346]
lea ebx, [eax]
adc ch, byte [ebx]
mov byte [esi - 1], dl
jne 0x408517
mov dh, 0x90
xor byte [esi - 0x15], al
add al, 0x85
leave
test ecx, ecx
je 0x408541
mov dl, byte [eax]
mov byte [esi], dl
inc esi
inc eax
dec ecx
jne 0x40851b
mov eax, dword [ebp + 0x20]
adc ecx, dword [ebp + 0x24]
sub ebp, dword [eax]
pop edi
sub dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
test eax, 0x462b06c6
mov byte [esi], 0x30
inc esi
mov byte [esi], 0x30
inc esi
mov eax, dword [ebp + 0x59]
mov ecx, dword [ebp + 0x24]
sub esi, eax
pop edi
mov dword [ecx], esi
pop esi
pop ebx
popfd
in eax, 0x5d
ret
Function at 0x40ae50
Capabilities:
Encode data using xor

Disassembly:
fimul word [ebx + 0xcec83ec]
push ebx
push esi
popfd
sbb edx, dword [eax]
push edi
cmp dword [esi], 0x10
ja 0x40ae72
mov dword [esi], 0x9f
invalid
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
test byte [0x8b657402], 0x43
or al, 0x85
push ss
jne 0x40aee2
mov esi, dword [ebp + 0x6a]
adc al, 0x50
xor edi, edi
call fcn.00404a60
popfd
enter 0x3889, 0xffffffffffffff89
xor al, 4
mov dword [eax + 8], edi
mov dword [edx + 0xc], ebp
push edi
push edi
push edi
mov dword [eax + 0x10], edi
push edi
mov dword [ebx + 0xc], ecx
mov bl, 0x15
mov al, byte [0x1b0040c0]
insb byte es:[edi], dx
or al, 0x89
inc edx
adc al, ch
mov ecx, 0x10488bdb
test ecx, ecx
jne 0x40aee2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test edi, edi
jne 0x40aed2
pop edi
in al, 0x5b
mov esp, ebp
pop ebp
pushfd
or al, 0
dec edi
salc
pop edi
pop esi
add eax, 0xafc80
pop ebx
mov esp, ebp
pop ebp
ret 0x7c0c
mov ebp, dword [ecx + 0x30]
and cl, al
insd dword es:[edi], dx
sbb edi, eax
mov eax, dword [ebp - 0x18]
je 0x40af17
mov cl, byte [ebx - 0x27]
mov byte [edx - 0x75], bl
push ss
inc eax
dec edx
push eax
push ss
mov dword [ebx + 0x30], edi
mov ecx, dword [esi]
mov dword [0x75c96e79], edi
mov al, 0xc7
push es
dec edi
inc edi
add byte [eax], al
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
push ebp
ret 0xc
mov dh, byte [ebx]
lea eax, [ecx + ecx*8 + 0x11d840f]
add byte [eax], al
mov edx, dword [ebx + 0x58]
adc edi, dword [esi]
push edx
hlt
Function at 0x403664
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036dc
xor eax, eax
push ebp
push 0x4036d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403718
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x45d020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404508
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45f048], 0
je 0x404569
cmp word [0x45f21c], 0xd7b2
jne 0x404531
cmp dword [0x45f224], 0
jbe 0x404531
mov eax, 0x45f218
call dword [0x45f234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404590
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45d02c], 0
jne 0x404585
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a70
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ca0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405af3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ca0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405af3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cbc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405b7c
xor eax, eax
push ebp
push 0x405b75
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004058ac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b5a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405cdc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b5a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b7c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c96
cmp byte [ebp - 0xd], 0
jne 0x405bc3
cmp byte [ebp - 0x12], 0
je 0x405c96
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405bdc
dec ebx
cmp byte [ebx], 0x2e
je 0x405beb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405bdb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c96
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c28
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c96
cmp byte [ebp - 0xd], 0
je 0x405c96
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c96
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret