joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8eca49
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
ja 0x8eca68
xchg edi, ecx
jmp 0x8eca99
lea esi, [esp + 4]
mov ah, byte [esp]
jmp 0x8eca6f

Function at 0x8ecf05
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ax, 0xbeed
jge 0x8ecebc
xchg dword [esp], eax

Function at 0x8edde3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], edx
push ebx
cmc
lea eax, [eax + eax]
call fcn.008ec54d
lea edx, [edx + 0x1b]
mov al, 0x43
seto ah
not eax
bswap eax
mov ax, 0xff12
jmp 0x8ec577
xchg dword [esp + 4], edx
mov ax, 0xf737
mov eax, dword [esp]
mov eax, ecx
not ax
pushfd
jmp 0x8ec75b
stc
mov ah, 0xfb
pushfd
xchg dword [esp], eax
mov ah, bh
jmp 0x8ed712

Function at 0x8eddf1
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ah
mov ax, word [esp]
mov eax, dword [esp]
xchg dword [esp], edx
ror ah, cl
jmp 0x8edfbc
push ebp
lea eax, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
lea eax, [eax*4]
lea edx, [edx + 0x55]
call fcn.008ede4d
Function at 0x8edfd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x61e0e5e3
jmp 0x8ee176
add edx, 0xbc15c7ca
jmp 0x8ee1f3
sete dh
not dl
lea eax, [ecx + edi]
lea eax, [esp + esi]
jmp 0x8edfe3
mov eax, 0x1c4ea67d
xchg dword [esp], ebx
bsf dx, sp
lea edx, [eax + eax]
jmp 0x8ee045
mov dx, 0x378d
sub esp, 0
lea ebx, [ebx + 0xf7]
lea eax, [ecx + 0xdc]
rdtsc
call fcn.008ee025
sub esp, 1
xchg dx, ax
xchg dx, ax
jmp 0x8ee088
lea esp, [esp + 1]
jmp 0x8ee0c8
mov edx, dword [esp]
jmp 0x8ee0b2
inc cl
neg ax
jle 0x8ee0d6
xchg al, ah
lea edx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
jmp 0x8ee0da
sub cl, 0xa1
lea edx, [edx - 0x53]
bswap eax
mov eax, ebx
rdtsc
jmp 0x8ee08e
xchg al, ah
jmp 0x8ee13e
cmp ax, si
stc
lea edx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
jmp 0x8ee14e
mov dl, dh
lea eax, [eax + edx]
bswap eax
xchg dx, ax
jmp 0x8ee16a
setb ah
not cl
or ax, 0x17f9
ja 0x8ee10b
jbe 0x8ee20b
mov ebx, 0x31c2a737
stc
stosb byte es:[edi], al
lds esi, [edi - 0x72]
sbb dword [ebp + 0x48466990], ecx
and dword [esi + 0x3b], 0xffffffc6
lea edx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
cmp ax, si
stc
lea edx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
btr dx, bx
jmp 0x8ee121
mov edx, ecx
mov ax, di
mov ah, byte [esp]
lea eax, [ebp*4]
jmp 0x8ee18d
neg cl
mov dh, 0xaf
not dx
lea edx, [edx + ebx]
jmp 0x8ee154
jmp 0x8ee19e
bswap eax
shl edx, 2
mov al, 0x90
mov eax, esi
sete al
jmp 0x8ec659
mov eax, dword [esp]
setno al
mov eax, esp
pushal
jmp 0x8ee1ad
and esi, edx
jae 0x8ee1e5
mov dword [esp + 0x1c], edx
popal
jmp 0x8ee1cf
xchg dx, ax
jmp 0x8ee16a
lea eax, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
mov edx, dword [eax]
lea eax, [edx + esi]
setle ah
jmp 0x8ee1ec
mov dword [esp + 0x1c], edx
popal
jmp 0x8ee1cf
mov al, 0x12
jmp 0x8ec6ab
btr eax, edx
jge 0x8ee22a
xchg al, ah
jmp 0x8ee214
mov dl, dh
lea eax, [eax + edx]
bswap eax
jmp 0x8ee1ca
sub eax, ecx
jmp 0x8ee22e
xchg al, ah
sub eax, ecx
mov esp, edi
mov al, byte [esp]
mov eax, esi
mov ax, 0x6c7f
jmp 0x8ee240
push edx
ret
Function at 0x8f916a
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ecx, byte [edi]
setae bh
lea edx, [edx + esi]
call 0x8f916a
xchg byte [edi], cl
sahf
invalid

Function at 0x8f957d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
jne 0x8f959a
bsr dx, bx
rcr dh, cl
mov byte [esp], dl
jmp 0x8f95a3
lea esp, [esp + 3]
jmp 0x8f964b
Function at 0x9005b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x9005df
call int.009005ed
jmp 0x9006e6
push ecx
jmp 0x90064d
push edi
jmp 0x90061e
cld
jmp 0x900655
mov esi, ecx
mov edi, edx
mov ecx, eax
jmp 0x900637
rep movsb byte es:[edi], byte [esi]
bswap ecx
mov ecx, dword [esp]
call fcn.009006a1
pop ss
jle 0x9006ad
call 0x12499d06
lea eax, [esi + 0x39]
movsb byte es:[edi], byte [esi]
fisttp dword [ebx]
mov byte [0x73f556dd], al
mov edi, 0x5e5fbd72
push esi
cmc
jae 0x900634
jb 0x900634
pop edi
pop esi
popfd
jmp 0x8eccaa
les ebx, [ebx]
jle 0x9006f6
sub dh, byte [ecx]
retf
mov esp, edx
pushfd
lea edi, [eax + edx - 0x40]
jmp 0x900671
add al, 0x24
jmp 0x90070d
shl ebx, cl
mov al, 0x24
lea eax, [esi + esi]
mov al, 0xde
jmp 0x900736
mov dword [ebp + 4], ebx
mov ecx, 0xf6c80356
mov ecx, dword [esp]
mov ecx, dword [esp]
mov ax, dx
jmp 0x9009b2
push ecx
setae ah
jmp 0x900839
pushfd
pop dword [ebp]
mov bh, byte [esp]
setne ch
jmp 0x9008a7

Function at 0x901e41
Capabilities:
Execute anti-debugging instructions

Disassembly:
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
push ss
pushal
arpl word [esi], ax
cmc
inc ebx
jbe 0x901e36
mov al, byte [0x8bc109e3]
adc al, 0x24
and al, 0xb8
jo 0x901dc9
aam 0x8a
and al, 0x24
movzx eax, word [ebp]
mov cl, 0x20
call fcn.00901e41
scasb al, byte es:[edi]
inc ebx
sal dword [esi + reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z], cl
xor byte [ebx], dh
sub al, byte [ebp - 0x75]
adc al, 0x24
and al, 0xf6
fnstenv [ecx - 0x2e]
jo 0x902508
call fcn.00901fc3
out 0x76, al
in al, 0x83
jle 0x901e0c
hlt
mov eax, 0xd4b87036
mov ah, byte [esp]
jmp 0x901e15
Function at 0x902617
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
lea ecx, [eax + edx]
mov cl, bh
bswap edx
mov ecx, dword [esp]
not ecx
jmp 0x9025e5
Function at 0x902df0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, bh
mov ah, byte [esp + 3]
mov ah, 0xf3
mov dword [esp + 0x1c], ebx
jmp 0x902dda

Function at 0x9e8ab3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
pushal
mov ah, ch
dec bh
xchg dh, al
sub esp, 0xa
jmp 0x9e8af1
call 0x9e8ab3
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
cld
jmp 0x9e8a7c
dec dx
lea edx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
push dword [esp + 0x1c]
bsf dx, dx
jmp 0x9e8b02
and ecx, eax
std
clc
std
lea ebx, [edx*4]
mov ah, cl
jmp 0x9e8ab7
sub esp, 0x1e
xchg word [esp + 0x25], bp
cpuid
pushfd
bswap ebx
mov dh, bl
jmp 0x9e8acd
setb ch
not ah
push word [esp + 0x2b]
mov word [esp + 0x23], ax
mov dword [esp + 0x16], eax
rdtsc
jmp 0x9e8b8c
push dword [esp + 3]
lea esp, [esp + 9]
lea esp, [esp + 8]
add esp, 0
jmp 0x9e8b6e
pop dword [esp + 4]
mov bx, word [esp + 9]
mov bx, word [esp + 0xa]
mov dword [esp + 6], edi
mov esi, dword [esp + 9]
rcl dl, 7
jmp 0x9e8b27
mov dword [esp], eax
not bh
mov di, word [esp + 2]
jmp 0x9e8bb2
btr ebp, ebp
lea ebx, [ecx*4]
add esp, 0
bswap esi
pushfd
mov ebp, 0x1981f4ca
jmp 0x9e8b58
mov dl, cl
setp bh
mov ax, 0x5414
mov ebx, ebp
popal
rol edi, cl
jmp 0x9e8b3d
xchg word [esp + 2], si
lea esp, [esp]
bts esi, ebx
jmp 0x9e8c60
lea ecx, [ebp*4]
mov dx, word [esp + 1]
not ah
cmc
mov dx, word [esp + 3]
not si
jmp 0x9e8b9c
pop eax
mov dl, byte [esp]
rdtsc
mov edi, 0xf6e3daea
call fcn.009e8bf7
xchg byte [esp], bl
mov cl, 0xf6
call fcn.009e8d84
cwde
push ss
test bl, ah
push ds
invalid
lea ebx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
lea edi, [edi + 0x2f]
xchg dword [esp], eax
dec edx
not dx
mov ch, byte [esp + 3]
jmp 0x9e8c10
Function at 0x9e8e2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9e8e6a
xchg byte [esp + 0xb], dh
push sp
bswap esi
xchg ch, ah
push dword [esp + 0xd]
inc di
jmp 0x9e8e7f
mov si, bx
pop edi
lea esp, [esp + 0xa]
xchg word [esp + 4], dx
xchg word [esp + 2], bp
pushfd
jmp 0x9e8e2e
xchg word [esp + 5], bp
bt si, bx
mov word [esp + 0xd], bx
neg bx
jmp 0x9e8ebf
add esp, 8
xchg dword [esp], ecx
neg dl
lea ecx, [esi + 0xa6]
jmp 0x9e906c
xchg dword [esp + 0xe], edi
lea edx, [esi*4]
bts esi, ebx
add esp, 4
bswap ecx
pop eax
jmp 0x9e8ea9
pop word [esp + 6]
pop dx
stc
xor bh, ch
lea esp, [esp + 1]
setno ah
jmp 0x9e8f39
push dword [esp + 0x10]
push word [esp + 0x13]
pushal
lea esp, [esp + 0x47]
lea ecx, [ebx + ebp]
sub esp, 0xf
jmp 0x9e8eef
mov ebp, 0xccdcd5c8
lea esp, [esp + 3]
lea esp, [esp + 4]
xchg byte [esp], al
jmp 0x9e8f4e
btc ax, sp
pop dx
xchg bh, dl
mov cx, bp
mov edx, dword [esp + 6]
mov bp, 0x411
jmp 0x9e8f23
inc si
lea edi, [edi*4]
xchg bx, cx
mov edi, dword [esp]
push dx
xchg word [esp], si
jmp 0x9e8f99
mov cx, bp
mov ebp, 0xe096362
xchg dword [esp + 3], eax
bsr ax, cx
mov dword [esp + 0x1c], eax
cpuid
jmp 0x9e8f0d
push di
lea esp, [esp + 1]
xchg word [esp], bx
mov dh, 0x40
lea esp, [esp]
jmp 0x9e8fbc
neg dl
pushal
popal
cpuid
lea eax, [eax + ecx]
pop bp
jmp 0x9e8f83
mov ax, dx
rcr bh, cl
sub esp, 0x16
pop eax
bts ax, ax
jmp 0x9e9009
sub esp, 0xd
mov word [esp + 9], cx
mov word [esp + 1], di
not ah
ror dx, cl
mov bl, byte [esp + 6]
jmp 0x9e8fa6
pop bx
mov ch, dl
mov si, 0x13d6
xchg dword [esp + 0x1b], edx
bsf ax, si
jmp 0x9e9034
inc bp
mov dh, 0x55
xchg word [esp + 0xe], cx
cpuid
mov dword [esp + 0x15], esi
mov cx, 0x3f45
jmp 0x9e8fd4
push word [esp + 0x17]
push dword [esp + 0x12]
bswap ebx
setno dh
stc
xchg dword [esp + 7], edi
jmp 0x9e8fea
pushal
cpuid
mov bp, word [esp + 0x1e]
mov word [esp + 0x20], si
popal
inc bx
jmp 0x9e9047
cmc
bswap edx
add esp, 0x1f
shl cx, 4
lea esp, [esp + 3]
not ax
jmp 0x9e901e
rdtsc
bsf bp, bx
push sp
mov edi, dword [esp + 1]
xchg si, ax
bt bp, si
jmp 0x9e909b
lea esp, [esp + 1]
sub esp, 0x1d
xchg dx, si
dec ebx
pop word [esp + 0x1a]
mov dword [esp + 2], ecx
jmp 0x9e8f6b
mov di, sp
neg dx
lea esp, [esp + 3]
mov edx, 0x60837343
jmp 0x9e9175
xchg si, cx
mov bl, 0x4b
lea eax, [edi*4]
neg si
xchg edx, esi
sub esp, 0x14
jmp 0x9e9085
xchg si, cx
jmp 0x9e9144
std
mov byte [esp + 7], dh
call fcn.009e90e3
bsf ebx, eax
mov dword [esp], ebx
xchg ah, al
sub esp, 0x1d
xchg di, bx
jmp 0x9e915d
pop dword [esp]
mov word [esp], si
xchg edx, eax
xchg byte [esp], ch
lea eax, [ecx*4]
mov byte [esp + 2], dl
jmp 0x9e912e
lea esi, [ecx + edx]
rdtsc
call fcn.009e919e
mov edi, 0x35c6a333
shl dword [edi + reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z], 1
aad 0xa1
loopne 0x9e90ff
mov dword [esp + 0xb], eax
inc esp
and al, 0xb
pop ebx
lea esp, [esp + 6]
mov ebx, ecx
mov ebp, dword [esp + 1]
rdtsc
jmp 0x9e9124

Function at 0x9e95e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
xchg word [esp + 0x2b], bx
bswap ecx
push ecx
xchg byte [esp + 0x2a], bl
jmp 0x9e9437
Function at 0x9e98d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xe
mov ax, 0x42df
mov ch, cl
btc cx, di
lea esp, [esp]
jmp 0x9e96ee
ror bp, 5
shr ebx, 5
mov byte [esp + 8], ch
mov eax, dword [esp + 9]
mov dword [esp + 9], edi
mov bp, word [esp]
jmp 0x9e96a9
xchg byte [esp], al
mov byte [esp], ch
bsf ax, cx
add esp, 0
lea ecx, [eax + edi]
jmp 0x9e9724
bsf cx, ax
xchg edi, edx
mov cl, ah
bsf esi, edx
lea eax, [ebp*4]
btc edx, esp
jmp 0x9e96d8
lea esp, [esp]
bswap ebx
add esp, 0
xchg ecx, ebx
clc
mov cx, 0x177b
jmp 0x9e9787
mov ebp, dword [esp]
lea ecx, [edx*4]
mov byte [esp], dh
lea ebx, [edx*4]
lea ecx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
mov ax, word [esp]
jmp 0x9e9705
shl bp, 0xb
setae ah
mov dword [esp + 4], edx
cmp ebp, 0x43fa3a59
mov ebx, esp
neg esi
jmp 0x9e96bf
xchg ebx, eax
neg cx
mov cl, bh
mov cl, bh
btr di, di
jmp 0x9e979e
sub esp, 0xf
xchg byte [esp + 0xb], dl
mov dword [esp + 0xb], ebx
sete dh
lea esp, [esp + 8]
lea ebx, [esi + ebp]
jmp 0x9e9771
pop word [esp + 2]
mov eax, esp
lea edx, [ebx*4]
bswap edi
pop word [esp]
neg edx
jmp 0x9e9817
xchg word [esp + 0xe], bp
mov bx, word [esp + 0x10]
pop word [esp + 7]
setne bl
xchg di, ax
not di
jmp 0x9e9757
lea ecx, [ecx*4]
rdtsc
mov word [esp + 1], si
jmp 0x9e97fe
mov eax, 0xb650aa6e
push esp
push eax
push word [esp]
pop dword [esp]
bswap esi
jmp 0x9e97d6
lea eax, [eax*4]
bswap edi
neg bl
sub esp, 0x12
mov dh, byte [esp + 2]
jmp 0x9e9861
shl bp, 4
pop bx
mov ebx, dword [esp]
pop si
bsr bx, bp
btc ebp, esp
jmp 0x9e97ec
mov si, ax
xor bh, al
pop word [esp + 5]
xchg dword [esp + 2], eax
jmp 0x9e9886
lea esp, [esp + 0x10]
xchg al, bl
push si
push dword [esp + 4]
pop word [esp + 3]
bsf di, bx
jmp 0x9e982b
cpuid
xchg esi, ecx
neg dl
xchg dword [esp + 0x12], edx
stc
bswap eax
jmp 0x9e9841
xchg bp, cx
pop ecx
bsr edx, edi
lea esp, [esp]
mov di, 0xbf1a
jmp 0x9e98af
add esp, 4
bswap edi
bsr dx, bp
xchg bl, cl
mov cl, byte [esp + 2]
xor dl, dl
jmp 0x9e9870
sbb dl, 0xaa
not di
push word [esp + 1]
cld
pop ebp
jmp 0x9e9953
lea ebp, [ebx + 0xef]
mov ch, byte [esp]
mov bp, word [esp]
mov ebp, dword [esp]
mov esi, ebx
xchg byte [esp], bl
jmp 0x9e9899
lea ebp, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
lea esp, [esp + 9]
push dword [esp + 8]
push dword [esp + 3]
mov al, 0x16
jmp 0x9e97bc
xchg di, bp
cmp bp, ax
cld
bswap ecx
mov edx, dword [esp]
mov ebx, dword [esp]
jmp 0x9e992d
lea edx, reloc.aquarius2.dll__CanAccessBrowser_ProxyClient__UAE_NV__shrewd_ptr_VProxyExtension___prime__V__shrewd_ptr_VProxyBrowser___3__N1_Z
mov al, 0x1c
bsr ecx, edi
mov ah, byte [esp]
mov dl, 0x24
sbb cl, dh
jmp 0x9e98ed
mov ax, 0xc558
cld
xchg ch, dh
rdtsc
ror ah, cl
sub esp, 2
call fcn.009e993d
inc ebp
hlt
bsf ebp, ecx
ror eax, cl
not ax
xchg bh, dh
bswap edi
not bl
jmp 0x9e9917
mov ax, word [esp]
not bh
rcl cx, cl
sbb ah, 0x46
xchg dx, cx
setp ah
jmp 0x9e9903
Function at 0x9e993d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9e9a35
mov bh, byte [esp]
add esp, 2
xchg ebp, ebx
lea eax, [ecx + ebx]
mov bl, dl
xchg esi, edi
jmp 0x9e99b4
mov word [esp + 0x2c], cx
rdtsc
mov dword [esp + 0x22], edx
pop word [esp + 0x22]
popal
btc eax, esi
jmp 0x9e9967
mov di, word [esp + 0x17]
setb bl
add esp, 2
add esp, 0x18
jmp 0x9e9a05
setb ch
pushal
xchg al, bl
pop dword [esp + 0x21]
mov edx, ebx
inc bl
jmp 0x9e999e
not bx
mov bp, word [esp + 0x10]
mov ebp, 0x56995061
xchg bh, dl
sub esp, 0x1f
mov edi, dword [esp + 1]
jmp 0x9e9988
mov dx, bx
push word [esp + 0xc]
mov esi, 0x308ebdeb
jmp 0x9e9a1a
bts ecx, ebp
xchg word [esp + 8], bp
rdtsc
pop ax
xchg word [esp + 4], si
bswap eax
jmp 0x9e99ef
mov si, word [esp + 5]
pop dword [esp + 5]
call fcn.009e9ac9
rcl byte [ecx - 0x3f], cl
mov al, byte [0xd254b353]
inc eax
daa
sar byte [ebx], cl
shl dword [esi + 0xf], cl
mov esp, 0xfd4066f3
bsf si, bx
inc ax
std
mov dh, byte [esp + 4]
sub esp, 0xc
mov edx, dword [esp + 3]
jmp 0x9e99d7
Function at 0x403dac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x457020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403e44
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403e24
xor eax, eax
push ebp
push 0x403e1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403e60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403e24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x457020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x457020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404c38
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x459048], 0
je 0x404c99
cmp word [0x45921c], 0xd7b2
jne 0x404c61
cmp dword [0x459224], 0
jbe 0x404c61
mov eax, 0x459218
call dword [0x459234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404cc0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45702c], 0
jne 0x404cb5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x408740
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4087d0
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4087d0
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408783
test edx, 3
jne 0x408772
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40877d
jmp 0x408783
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408783
cmp dword [ecx - 8], 1
je 0x40878d
mov edx, ebx
or edx, 3
call fcn.00405504
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40879f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404db8

Function at 0x4087dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40886c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40886c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40881f
test edx, 3
jne 0x40880e
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408819
jmp 0x40881f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40881f
cmp dword [ecx - 8], 1
je 0x408829
mov edx, ebx
or edx, 3
call fcn.00405504
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40883b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404db8

Function at 0x40ba50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba89
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404ea8
jmp 0x40ba92
mov eax, ebx
mov edx, esi
call fcn.00404e0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ba9c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40babe
movzx eax, byte [esp]
jmp 0x40bac0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40c150
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bfc8
mov eax, dword [0x4589ec]
cmp byte [eax], 0
je 0x40c1cc
mov eax, dword [0x458824]
call fcn.00403378
call fcn.00402e2c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004091e8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c214
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c202
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4587d0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45b7f4]
call fcn.00405f60
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40ca60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cb36
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404e50
lea eax, [ebp - 4]
call fcn.004052cc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040527c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cb20
mov eax, ebx
call fcn.00402cd0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cb19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040527c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cb03
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cb48
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cb03
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb20
mov eax, dword [ebp - 0x10]
call fcn.00402cec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb3d
lea eax, [ebp - 4]
call fcn.00404db8
ret
Function at 0x41b6bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45c300
cmp dword [edi], 0
jne 0x41b738
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45c2fc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x457af8
mov ecx, 2
call fcn.00402ecc
mov edx, 0x41b694
lea eax, [esi + 5]
call fcn.0041b6b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b6b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b70d
mov dword [0x45c2fc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41dbdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040527c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41dc34
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x458afc]
mov dl, 1
mov eax, dword [0x41d700]
call fcn.0040c310
call fcn.00404800
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041d808
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41ea90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41ea96
ret