joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b727
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
push edx
add esp, 1
mov word [esp], di
mov word [esp], bx
jmp 0x48b6a4
mov edx, dword [edx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
clc
jmp 0x48b625
movzx ebx, byte [esi + 0xd]
cmc
and edx, ecx
jmp 0x48b642
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
mov bl, byte [esp]
lea ebx, [ecx + edi]
bt ebx, ebx
jmp 0x48b65b
sub esp, 0x10
mov word [esp], bx
sub esp, 0x1a
lea esp, [esp + 2]
lea esp, [esp + 0x6c]
jmp 0x48b678
lea esp, [esp + 3]
jmp 0x48b6ed
lea esp, [esp + 1]
sub esp, 8
lea esp, [esp + 3]
and ebx, ecx
pushal
jmp 0x48b690
mov dword [esi + 8], edi
bt edi, esp
pushal
mov dword [esp + 0x13], esi
mov di, 0x6031
jmp 0x48b6fc
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
bswap edx
mov edx, dword [esi + 0xc]
pushal
jmp 0x48b6cb
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
mov edi, edx
shr edi, 0x18
jmp 0x48b70e
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x48b747
mov byte [esp + 2], bh
jmp 0x48b6bb
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
rcr bx, cl
xchg bl, bh
dec ebx
jmp 0x48b754
and edi, ecx
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
and ebx, ecx
jmp 0x48b72d
mov ebx, dword [esp]
jmp 0x48b7ba
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_FileTimeToLocalFileTime
mov ebx, dword [ebp]
pop ebp
call fcn.0048b7e8
test byte [edi], dh
push ds
imul edx, dword [ebp - 0x75], 0x8be1ebeb
or bl, byte [eax + 0x2fbb0aff]
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0xccfd4209
pop edi
cmpsb byte [esi], byte es:[edi]
ror dword [edi], 1
mov dh, 0x5e
push cs
push ebp
mov ebp, ebx
jmp 0x48b789
movzx ebx, byte [esi + 0xe]
sub esp, 8
push esp
sub esp, 0x10
jmp 0x48b7a3

Function at 0x48b885
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop dword [esp + 2]
pop word [esp + 7]
lea esp, [esp + 2]
jmp 0x48b7ed
sub esp, 0xc
jmp 0x48b7c7
and edx, ecx
sub esp, 0x18
mov edx, dword [edx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
pushal
jmp 0x48b87b
and edx, ecx
sub esp, 0x1c
mov word [esp + 0x18], di
jmp 0x48b858
frstor dword [edi + edx*2 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
sub esp, esi
and al, 0xaf
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
pushal
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x48b81b
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
call 0x48b885
mov esi, 0x3fcca535
sub dword [eax + reloc.KERNEL32.dll_FileTimeToLocalFileTime], 0xffffffec
ficomp dword [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
in al, 0x3e
pop word [esp + 1]
call fcn.0048b84c
mov dword [esp], ecx
push dword [esp]
mov dword [esp + 1], ebp
jmp 0x48b8d5
mov dword [esi + 0xc], edi
call fcn.0048b8bb
pop es
mov dword [ecx], ebx
js 0x48b829
cmp eax, 0xdfb82aa7
sub bl, byte [eax - 0x13629d35]
lea esp, [esp + 8]
dec dword [ebp - 4]
push edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x48b891
Function at 0x48b8bb
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x48b91f
lea esp, [esp + 4]
jne 0x45d144
je 0x45d0aa
push esi
rcl dword [ecx + 0x30], 0xc3
add bl, bl
inc edi
xlatb
mov dl, 0x41
invalid

Function at 0x48b8fe
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 2], ah
mov byte [esp + 1], ch
call fcn.0048b8e7
invalid
Function at 0x5614fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0xc]
mov ecx, 0x5394cd56
cld
rcr ecx, 0x15
mov al, 0x46
mov edx, ecx
bswap ebx
stc
jmp 0x561438
pushal
popal
lea esi, [eax - 0x51]
xchg byte [esp + 0xb], cl
pop dword [esp + 0xe]
xchg word [esp + 3], ax
jmp 0x561451
rdtsc
mov edx, 0xa6d275b0
xchg word [esp + 0x19], bx
bsr di, cx
xchg byte [esp + 0x18], dl
stc
jmp 0x561469
not ax
xchg dx, cx
xchg bp, dx
mov ch, byte [esp + 0xb]
stc
sub esp, 8
jmp 0x561482
stc
push esp
mov edi, dword [esp + 0xd]
pop dx
xor dl, ch
btr edx, edx
jmp 0x5614a3
jmp 0x5614bd

Function at 0x56384c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea edx, reloc.KERNEL32.dll_FileTimeToLocalFileTime
xchg byte [esp + 2], dh
jmp 0x563889
neg edi
xchg dx, ax
bswap edi
add esp, 5
push word [esp + 1]
jmp 0x564fc5
mov edx, 0x48c11eac
xchg byte [esp + 2], dh
mov eax, 0xfd7441f8
rdtsc
jmp 0x56385c
mov word [esp + 4], di
lea edi, [edx + edi]
xchg dword [esp + 2], edi
push dword [esp + 4]
dec edx
not dh
jmp 0x564408
xchg byte [esp], dh
xchg di, ax
not di
not edi
bsr di, bp
rdtsc
jmp 0x5643db
mov dx, word [esp + 6]
mov dl, dh
btr eax, esp
lea esp, [esp + 0xb]
add esp, 0
jmp 0x564605
add esp, 5
sbb edx, esi
xchg byte [esp + 9], dh
lea edi, [ebp + 0x47]
pop eax
xchg word [esp + 3], ax
jmp 0x5643f6
neg edx
mov edx, 0xd0f074f0
lea esp, [esp + 6]
call fcn.00564483
call 0x60e83aaa
mov ah, 0x16
popfd
or eax, 0x6c4aa754
jg 0x56449a
lea edx, [ecx + ebx]
lea esp, [esp]
sub esp, 0x16
sub esp, 0
mov dx, word [esp + 9]
bsr di, bp
jmp 0x564435
setg ah
lea eax, [ecx - 0x5b]
bsf di, si
xchg byte [esp], al
mov dx, 0x26ab
cmc
jmp 0x564454
mov al, ah
inc eax
bt edi, esp
lea edi, [esi + 0xf5]
lea eax, [edx + edx]
setnp dh
jmp 0x56446f
mov byte [esp], dh
mov byte [esp], bh
mov dh, bh
mov di, 0x7f77
stc
lea eax, [ebx + edi]
jmp 0x56449a
push dword [esp + 8]
xchg word [esp + 7], di
mov word [esp + 8], dx
push esp
cmc
mov ax, sp
jmp 0x564421
rdtsc
rdtsc
push dword [esp + 1]
mov byte [esp + 5], bh
bswap edi
lea edx, [esp + eax]
jmp 0x564634
mov dh, 0xb0
lea eax, [ebx + edi]
mov byte [esp], ah
bswap edx
push esp
mov al, ah
jmp 0x5646f3
xchg edi, eax
push dword [esp]
lea esp, [esp + 0xb]
xor edi, esi
clc
mov byte [esp], dh
jmp 0x564727
xchg dword [esp], edi
setge dh
xchg word [esp + 1], di
neg ah
mov di, word [esp + 2]
push dword [esp + 2]
jmp 0x564853
bsf ax, si
mov dx, word [esp + 2]
mov edx, 0x1a9797a8
bsf ax, si
neg ah
mov ax, di
jmp 0x564873
Function at 0x564568
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
mov di, word [esp + 5]
setl ah
jmp 0x5645b8
mov word [esp], di
rcl ax, cl
mov dl, 0x9c
lea eax, [ebx*4]
lea edx, [ebx*4]
jmp 0x564541
mov edx, 0x584d213e
add esp, 3
pop di
add esp, 1
btr edx, esp
xchg edx, eax
jmp 0x5644ae
push esp
rcr dh, 7
pop dword [esp]
xor dx, 0x5052
push dword [esp]
mov edx, 0x18dc845a
jmp 0x5644d1
shl dh, 3
bt eax, edx
not ax
xchg word [esp], dx
rdtsc
push word [esp + 1]
jmp 0x5644ed
lea edx, [edx*4]
xor edi, ecx
cmc
xchg dh, dl
mov dx, 0xdd81
call fcn.0056451f
rdtsc
xchg byte [esp + 2], dh
xchg byte [esp + 2], dh
rdtsc
call 0x564568
xchg word [esp + 4], di
mov di, 0x985d
jmp 0x56459f
cmc
mov di, 0x8ee7
xchg byte [esp], al
setb dh
mov byte [esp + 1], dh
and eax, ecx
jmp 0x5645ed
add esp, 7
and edi, ecx
setl dh
neg ah
mov byte [esp], bh
mov eax, dword [esp]
jmp 0x564509
mov eax, dword [esp + 0x16]
not eax
ror eax, 7
and dh, bh
xchg dh, al
cld
jmp 0x56461a
pop dword [esp]
sub esp, 0x14
lea edi, [edx*4]
mov dword [esp + 3], ebp
jmp 0x5645cd
btr edi, esp
pop edi
xchg byte [esp + 0x10], al
pop di
pop di
btc edi, edx
jmp 0x5646d8
mov ax, di
xchg word [esp + 4], ax
rdtsc
xchg ah, dh
rdtsc
mov ax, 0xd547
jmp 0x5646c1
dec di
pop edx
lea edx, reloc.KERNEL32.dll_FileTimeToLocalFileTime
add dx, 0x56a6
jmp 0x5646ab
neg di
push dword [esp]
mov dh, byte [esp + 1]
mov dword [esp + 6], ebp
mov eax, dword [esp + 2]
bsr ax, bp
jmp 0x56464c
mov word [esp + 0xa], dx
lea esp, [esp + 5]
add esp, 2
neg dh
xchg edi, eax
add esp, 0
jmp 0x564677
push dword [esp + 3]
mov di, dx
call fcn.00564709
and eax, 0xb14227b7
or dword [edx], ebp
inc ebp
hlt
setp ah
and edi, ecx
mov dword [esp + 4], esi
sub edi, eax
mov byte [esp + 9], ch
mov al, ah
jmp 0x564660
mov byte [esp + 0xd], bh
add esp, 2
xchg byte [esp + 2], dl
xchg word [esp + 0xa], di
add esp, 1
jmp 0x564697
Function at 0x56495b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 7]
pop dword [esp + 2]
mov ax, 0x72a9
xchg word [esp + 8], di
jmp 0x5648e4
pop ax
push word [esp + 2]
mov edi, esi
mov di, word [esp + 0xf]
adc dx, 0x376a
jmp 0x56488b
pushal
mov di, 0xfd2b
setp dh
cmc
xchg ah, dh
xchg byte [esp + 8], dh
jmp 0x5648a2
mov ax, word [esp + 0xb]
xchg edi, eax
mov dl, 0xbc
mov al, ah
rcr edi, 0x15
jmp 0x56493e
add esp, 4
xchg dh, dl
xchg byte [esp + 0xa], dl
xchg edx, edi
sub esp, 4
lea edi, [ebx + ebx]
jmp 0x5648ce
mov di, word [esp]
xchg dword [esp], eax
inc edi
mov ah, byte [esp]
xchg edx, eax
stc
jmp 0x5648bd
mov al, 0xde
pop edx
xchg word [esp + 0x1f], di
mov word [esp + 0x1a], sp
mov edi, ebp
cmc
jmp 0x5649b9
mov dh, byte [esp]
pushal
neg dh
mov al, 0x56
pop dword [esp + 0x13]
bswap eax
jmp 0x56490b
bsf di, ax
mov di, 0xdc53
lea edi, [edx + ebx]
add al, dh
pop di
setno dh
jmp 0x564925
mov dh, 0x12
mov dword [esp], eax
jmp 0x5648fc
mov byte [esp + 0xa], bh
pop edx
mov ax, 0x455
bsf dx, ax
mov dh, byte [esp + 7]
pushal
jmp 0x5649e7
pop ax
pop word [esp + 1]
not dx
mov dh, 0x62
not dh
pop ax
jmp 0x564962
mov byte [esp + 5], ah
rdtsc
mov di, word [esp + 0x16]
xchg dx, di
xchg dx, di
bswap edi
jmp 0x564981
mov di, si
xchg ah, dh
mov di, 0xa233
add esp, 0x1f
xchg dword [esp + 0x11], edi
xchg byte [esp + 0x12], dl
jmp 0x56499f
inc edi
lea eax, [esi - 0xc5]
sub esp, 0x1c
lea esp, [esp + 0x4a]
xchg ah, dh
jmp 0x564bed
mov ax, dx
mov di, word [esp + 2]
mov di, word [esp]
mov dh, bh
xchg dh, dl
mov edi, eax
jmp 0x5649cf
add esp, 7
pop edi
mov edi, edx
mov ah, byte [esp + 0xd]
inc dh
xchg word [esp + 0xc], di
jmp 0x564a11
pop di
mov byte [esp + 6], ch
sub esp, 0xc
lea edi, [eax + 0x31]
stc
mov dword [esp + 0x13], ebp
jmp 0x564a29
mov dh, 0x80
mov dword [esp + 9], ebp
pop dword [esp + 0xa]
mov dh, 0x10
lea edi, [eax*4]
lea eax, reloc.KERNEL32.dll_FileTimeToLocalFileTime
jmp 0x564af9
dec ax
bt edi, esp
sub esp, 0x18
pop dword [esp + 2]
clc
stc
jmp 0x564b11
mov dh, byte [esp]
rdtsc
lea edi, [ecx*4]
xchg dh, dl
rol dh, 3
neg ah
jmp 0x564b95
Function at 0x564fa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 3], ecx
mov edi, 0x258fe2c2
mov dh, ch
xchg dh, al
xchg di, dx
rdtsc
jmp 0x564f87
pop ax
mov dx, di
mov dword [esp + 3], esi
neg edi
btc edx, edi
rdtsc
jmp 0x564f5b
mov edx, dword [esp + 7]
sub esp, 0x1e
xchg word [esp + 2], dx
mov word [esp + 0x1a], dx
jmp 0x564fa9
xchg dh, al
add dx, 0x15f6
jmp 0x564f75
mov di, word [esp + 0x1f]

Function at 0x565011
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ecx*4]
xchg word [esp + 0x16], dx
xchg edi, edx
jmp 0x564ff7

Function at 0x5655bd
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 3]
mov dword [esp + 0xac], esi
call fcn.0056556a
pop word [esp + 5]
push word [esp + 1]
mov word [esp + 6], sp
push word [esp + 7]
jmp 0x56568b
mov word [esp + 0x13], di
pop word [esp + 5]
jmp 0x56558e
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0xb8], edi
lea esp, [esp + 0xb8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x565626
Function at 0x80b4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x80b4c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80b4c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80b4b8
mov eax, 1
add ebx, ebx
jne 0x80b4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80b4d0
jne 0x80b4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b4d0
xor ecx, ecx
sub eax, 3
jb 0x80b500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80b572
mov ebp, eax
add ebx, ebx
jne 0x80b50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x80b518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x80b53c
inc ecx
add ebx, ebx
jne 0x80b528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80b51d
jne 0x80b539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b51d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80b55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80b54d
jmp 0x80b4be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80b55c
add edi, ecx
jmp 0x80b4be
pop esi
mov edi, esi
mov ecx, 0x147
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80b57a
cmp byte [edi], 1
jne 0x80b57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x80b57f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x80b5f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb58c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80b5ac
mov ecx, edi
jns 0x80b5db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb590]
or eax, eax
je 0x80b5f1
mov dword [ebx], eax
add ebx, 4
jmp 0x80b5c9
call dword [esi + 0xb594]
popal
jmp 0x802d68

Function at 0x438c92
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x438a14
or edi, edi
call fcn.00438cb8
add edi, 0xd282a712
xor dword [ecx], esi
sub edi, eax
and eax, edi
inc ecx
mov edi, edi
cmp ecx, edx
jne fcn.00438c92
or eax, eax
ret
Function at 0x410728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410750
add dword [ebp - 4], 2
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410767
inc dword [ebp - 4]
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x41077f
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
jmp 0x410788
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418544
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x418553
pop dword [ebp - 0x14]
mov eax, 0x39779db6
sub eax, 0x39361863
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4fe9f
push 0
mov eax, 0xe7bcde80
add eax, 0x18898958
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xf1b76b91
add ecx, 0xe48e572
xor edi, edi
add edi, eax
mov ebx, 0x6e7b8fb
add ebx, 0xf9612705
add ebx, dword [ebp - 0x14]
mov edx, 0x7fa4f444
add edx, 0x36cce1e3
sub dword [ebp - 0xc], eax
mov esi, dword [ebx]
add esi, edx
xor dword [ebp - 8], 0x1af76869
mov dword [edi], esi
xor dword [ebp - 0x10], edx
add edi, 0x3420e43
add edi, 0xfcbdf1c1
add ebx, 0x2db56454
sub ebx, 0x2db56450
loop 0x4185b4
add eax, 0x58ec10c4
sub eax, 0x58ead9e5
mov ebx, eax
add eax, 0xbb5bd710
add eax, 0x44a428f5
mov ecx, 0x4d427d9f
sub ecx, 0x4d027d9f
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x408946
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
or ebx, edx
mov ebx, 0x592966e
call fcn.0040896d
xor dword [eax], ecx
inc eax
and edx, ebx
cmp eax, esi
jne fcn.00408946
sub ebx, 0x47cd712b
add edx, 1
ret
Function at 0x4100a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x4100c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4100c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4100b8
mov eax, 1
add ebx, ebx
jne 0x4100db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4100d0
jne 0x4100ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4100d0
xor ecx, ecx
sub eax, 3
jb 0x410100
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410172
mov ebp, eax
add ebx, ebx
jne 0x41010b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410118
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41013c
inc ecx
add ebx, ebx
jne 0x410128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41011d
jne 0x410139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41011d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41015c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41014d
jmp 0x4100be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41015c
add edi, ecx
jmp 0x4100be
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41017a
cmp byte [edi], 5
jne 0x41017a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41017f
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x4101ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x123f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x124ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4101ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x124b0]
or eax, eax
je 0x4101e8
mov dword [ebx], eax
add ebx, 4
jmp 0x4101c9
call dword [esi + 0x124c0]
mov ebp, dword [esi + 0x124b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410222
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40328c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405120
test esi, esi
jne 0x4032c2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405210
jmp 0x4032e0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403190
mov edi, eax
test esi, esi
je 0x4032e0
cmp dword [ebx], 0
je 0x4032e0
dec esi
jmp 0x4032c9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x404058
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x465020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4040f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4040d0
xor eax, eax
push ebp
push 0x4040c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40410c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x465020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x465020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404eec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x467048], 0
je 0x404f4d
cmp word [0x46721c], 0xd7b2
jne 0x404f15
cmp dword [0x467224], 0
jbe 0x404f15
mov eax, 0x467218
call dword [0x467234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404f74
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46502c], 0
jne 0x404f69
push 0
push 0x46575c
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4050a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x465034], 0
je 0x4050ca
mov edx, esi
mov eax, ebx
call dword [0x465034]
jmp 0x4050d9
mov eax, 8
call fcn.00402ea0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x467049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40506c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4065f0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406820
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406673
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406820
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406673
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40683c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4066fc
xor eax, eax
push ebp
push 0x4066f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040642c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4066da
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40685c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4066da
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066fc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406816
cmp byte [ebp - 0xd], 0
jne 0x406743
cmp byte [ebp - 0x12], 0
je 0x406816
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40675c
dec ebx
cmp byte [ebx], 0x2e
je 0x40676b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40675b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406816
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4067a8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406816
cmp byte [ebp - 0xd], 0
je 0x406816
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406816
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret