joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4398
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
xor ecx, ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c44d6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5c43ca
cmp dword [ebp - 4], 0
jne 0x5c43ce
xor ebx, ebx
jmp 0x5c43d0
mov bl, 1
test bl, bl
je 0x5c44bd
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005c469c
test al, al
je 0x5c44bd
xor edx, edx
push ebp
push 0x5c44a9
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
call fcn.005c4310
test al, al
je 0x5c4493
mov ebx, dword [ebp - 0xc]
dec ebx
cmp ebx, 0
jl 0x5c4493
mov dword [ebp - 0x10], 0x40
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x80
call fcn.00405424
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x5c448d
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x94]
mov ecx, 0x40
call fcn.00408374
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.005c4398
dec ebx
cmp ebx, 0xffffffff
jne 0x5c442f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c44b0
mov eax, dword [ebp - 0x14]
call fcn.005c4574
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c44dd
lea eax, [ebp - 0x98]
call fcn.00407460
ret

Function at 0x5c451c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x5c456a
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.004082b8
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
call fcn.005c4310
test al, al
je 0x5c4565
cmp dword [esp + 4], 4
je 0x5c456a
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x5c4580
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov ebp, edx
mov esi, eax
test esi, esi
setne al
test al, al
je 0x5c45c3
mov ebx, edi
test ebx, ebx
je 0x5c459e
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, edi
call fcn.004082b8
push eax
push 1
push 0
mov eax, ebp
call fcn.004082b8
push eax
push esi
call sub.advapi32.dll_RegSetValueExW
call fcn.005c4310
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c4c38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5c4cb7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push esi
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x5c4c97
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00408374
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.005a5c68
jmp 0x5c4c9e
mov eax, ebx
call fcn.005a5d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c4cbe
lea eax, [ebp - 0x210]
call fcn.00407460
ret

Function at 0x5c4f1c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 5
push 0x5c4f50
mov eax, esi
call fcn.004082b8
push eax
mov eax, ebx
call fcn.004082b8
push eax
push 0x5c4f54
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
setae al
pop esi
pop ebx
ret

Function at 0x5c5018
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.00405424
push 0x4011
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x5c5050
call sub.shell32.dll_SHGetFileInfoW
add esp, 0x2b4
ret

Function at 0x5c503b
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.00405424
push 0x4011
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x5c5050
call sub.shell32.dll_SHGetFileInfoW
add esp, 0x2b4
ret

Function at 0x5c5510
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
push 0x4009
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
mov eax, dword [eax + 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
ret

Function at 0x5e1444
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e14c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040addc
mov ecx, eax
mov edx, 0x5e14d4
mov eax, dword [ebx + 0x14]
call fcn.0042512c
test al, al
je 0x5e14b3
xor eax, eax
push ebp
push 0x5e14ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e14b3
lea eax, [ebp - 4]
call fcn.0040addc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e14d0
lea eax, [ebp - 4]
call fcn.0040addc
ret

Function at 0x60431c
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
test edx, edx
jle 0x60432a
xor cl, byte [eax]
dec edx
inc eax
test edx, edx
jg 0x604322
mov eax, ecx
ret

Function at 0x6043e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
test ecx, ecx
jle 0x6043f8
mov bl, 0xff
sub bl, byte [edx]
xor bl, byte [eax + 4]
mov byte [edx], bl
dec ecx
inc edx
test ecx, ecx
jg 0x6043e9
pop ebx
ret
Function at 0x6084ac
Capabilities:
Delete file
Move file

Disassembly:
push ebx
mov ebx, eax
push 4
push 0
mov eax, ebx
call fcn.004082b8
push eax
call sub.kernel32.dll_MoveFileExW
pop ebx
ret

Function at 0x609788
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov edi, eax
xor eax, eax
push ebp
push 0x60986a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x14]
call fcn.005a884c
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, edi
call fcn.0059ffdc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffff
lea eax, [ebp - 8]
push eax
push 2
push 0xa
push 0
call sub.NetApi32.dll_NetUserEnum
test eax, eax
jne 0x60984f
xor edx, edx
push ebp
push 0x609848
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.005a0bcc
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x60982a
inc ebx
push 0
lea eax, [ebp - 0x18]
mov edx, dword [esi]
call fcn.00408320
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, edi
call fcn.0059ffdc
add esi, 0x10
dec ebx
jne 0x60980c
mov eax, edi
call fcn.005a0534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60984f
mov eax, dword [ebp - 8]
push eax
call sub.NetApi32.dll_NetApiBufferFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x609871
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004074c0
ret
Function at 0x60c850
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x60c9b3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00408320
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + 0x10]
mov edx, 0x60c9cc
call fcn.00604c58
test al, al
je 0x60c8a2
mov byte [ebx + 0x30], 1
movzx eax, byte [0x60c9e8]
mov byte [ebx + 0x31], al
jmp 0x60c98b
lea eax, [ebp - 8]
call fcn.00407460
mov ecx, eax
mov edx, 0x60c9f8
mov eax, dword [ebp - 4]
call fcn.005a6a18
test al, al
je 0x60c969
mov byte [ebx + 0x30], 0
movzx eax, byte [0x60ca04]
mov byte [ebx + 0x31], al
cmp dword [ebp - 8], 0
jne 0x60c8df
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0060cda4
mov edx, 0x60ca14
mov eax, dword [ebp - 4]
call fcn.005a697c
test al, al
je 0x60c93d
mov eax, dword [ebx + 0x34]
mov edx, dword [eax]
call dword [edx + 8]
test al, al
jne 0x60c98b
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x34]
call fcn.0060fa50
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x60ca30
mov dl, 1
mov eax, dword [0x416a70]
call fcn.00422fd0
call fcn.00406b5c
jmp 0x60c98b
mov edx, 0x60ca78
mov eax, dword [ebp - 4]
call fcn.005a697c
test al, al
je 0x60c952
or byte [ebx + 0x31], 2
mov edx, 0x60ca98
mov eax, dword [ebp - 4]
call fcn.005a697c
test al, al
je 0x60c98b
or byte [ebx + 0x31], 8
jmp 0x60c98b
mov byte [ebx + 0x30], 0
movzx eax, byte [0x60caa8]
mov byte [ebx + 0x31], al
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0060cda4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60c9ba
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004074c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004074c0
ret
Function at 0x62b818
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, 0x621e68
call fcn.0040b5fc
xor eax, eax
push ebp
push 0x62b9c4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0060c1b4
test al, al
je 0x62b9a9
mov eax, dword [0x633724]
mov eax, dword [eax]
cmp byte [eax + 0x30], 1
jne 0x62b8f3
mov eax, 0x649848
call fcn.00407460
push eax
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00408320
mov eax, dword [ebp - 0x14]
mov edx, 0x62b9dc
pop ecx
call fcn.005a6a18
test al, al
je 0x62b8b0
mov eax, dword [0x649848]
call fcn.005a6004
test al, al
je 0x62b8b0
mov eax, dword [0x633724]
mov eax, dword [eax]
mov edx, dword [0x649848]
call fcn.0060cda4
jmp 0x62b8f3
lea eax, [ebp - 0x18]
call fcn.005a6930
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.005a5d9c
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00597f28
test al, al
je 0x62b8e9
push 0x10
push 0x62b9e8
push 0x62b9f4
push 0
call sub.user32.dll_MessageBoxW
jmp 0x62b9a9
call fcn.006082e8
jmp 0x62b9a9
mov eax, dword [0x633510]
mov eax, dword [eax]
call fcn.0058b2c8
mov eax, dword [0x633510]
mov eax, dword [eax]
mov dl, 1
call fcn.0058ceec
mov eax, dword [0x633510]
mov eax, dword [eax]
mov edx, 0x62ba30
call fcn.0058acf8
mov eax, dword [0x633724]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
call fcn.0060e1bc
mov eax, dword [0x633724]
mov eax, dword [eax]
test byte [eax + 0x31], 8
je 0x62b985
mov eax, dword [0x633724]
mov eax, dword [eax]
mov dl, 1
call fcn.0060cbfc
mov eax, dword [0x633724]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.005a0a94
test eax, eax
jle 0x62b977
lea edx, [ebp - 0x20]
mov eax, dword [0x633724]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.005a0ba0
mov eax, dword [ebp - 0x20]
xor edx, edx
call fcn.006011f0
mov eax, dword [0x633724]
mov eax, dword [eax]
call fcn.0060c4fc
jmp 0x62b9a9
mov ecx, dword [0x633124]
mov eax, dword [0x633510]
mov eax, dword [eax]
mov edx, dword [0x620cb4]
call fcn.0058b2e0
mov eax, dword [0x633510]
mov eax, dword [eax]
call fcn.0058b43c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b9cb
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004074c0
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x55f85aeb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xbc65af5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ee15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x1002139c
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
push str._jW.
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call dword [0x100210e0]
mov dword [ebp - 4], 0
push 0x100212b2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call dword [0x100210e0]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x433db0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
lea eax, [edi + 0x2bab8]
push dword [eax]
mov dword [eax], 0x704242c
push eax
push edi
jmp 0x433dda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x433de1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x433dd0
mov eax, 1
add ebx, ebx
jne 0x433df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x433de8
jne 0x433e04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x433de8
xor ecx, ecx
sub eax, 3
jb 0x433e18
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x433e8a
mov ebp, eax
add ebx, ebx
jne 0x433e23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x433e30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x433e54
inc ecx
add ebx, ebx
jne 0x433e40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x433e35
jne 0x433e51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x433e35
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x433e74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x433e65
jmp 0x433dd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x433e74
add edi, ecx
jmp 0x433dd6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x114b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x433e96
cmp byte [edi], 0x11
jne 0x433e96
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x433e9b
lea edi, [esi + 0x30000]
mov eax, dword [edi]
or eax, eax
je 0x433f0a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34228]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x34280]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x433ec8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x34288]
or eax, eax
je 0x433f04
mov dword [ebx], eax
add ebx, 4
jmp 0x433ee5
call dword [esi + 0x34284]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x433f3b
cmp al, 0xef
ja 0x433f2e
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x433f10
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x433f1d
mov ebp, dword [esi + 0x3428c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x433f6f
sub esp, 0xffffff80
jmp 0x408c19
Function at 0x669a1535
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xc
push 0x669a11f0
call fcn.669a5584
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
push 1
mov edi, dword [ebp + 8]
mov eax, edi
imul eax, eax, 0x38
add eax, 0x669a8020
push eax
call dword [sym.imp.ntdll.dll_RtlAcquireResourceExclusive]
mov esi, edi
shl esi, 2
cmp dword [esi + 0x669a7fa0], ebx
je 0x669a1580
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x669a7fa0]
cmp eax, dword [esi + 0x669a605c]
jb 0x669a15a1
call dword [esi + 0x669a6080]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x669a1595
mov dword [esi + 0x669a7fa0], ebx
jmp 0x669a15a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x669a7fa0], eax
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
call fcn.669a15bb
mov eax, dword [ebp - 0x1c]
call fcn.669a55bf
ret 4

Function at 0x669a1933
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x669a7f90]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x669a12bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x669a197e
mov eax, 0x3a98
jmp 0x669a1a02
push esi
push edi
push 4
pop edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
mov esi, 0x669a1290
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x669a19c9
cmp dword [ebp - 0x214], edi
jne 0x669a19c9
cmp dword [ebp - 0x208], 0x4e20
jae 0x669a19fa
lea eax, [ebp - 0x204]
push esi
push eax
mov dword [ebp - 0x208], 0x3a98
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.669a546c
leave
ret
Function at 0x4065c9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42d2c4], 0
jne 0x406604
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4065dd
mov dword [ecx*4 + 0x42d2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x4065d8
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406631
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42d2c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406612
not eax
pop ebp
ret 0xc

Function at 0x40b410
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, edx
dec esp
add eax, ecx
inc ecx
movzx eax, word [eax + 0x14]
inc ebp
movzx ebx, word [eax + 6]
dec edx
lea ecx, [eax + eax + 0x18]
inc ebp
test ebx, ebx
je 0x40b447
mov edx, dword [ecx + 0xc]
dec esp
cmp edx, edx
jb 0x40b43b
mov eax, dword [ecx + 8]
add eax, edx
dec esp
cmp edx, eax
jb 0x40b44a
inc ecx
inc ecx
dec eax
add ecx, 0x28
inc ebp
cmp ecx, ebx
jb 0x40b429
xor eax, eax
ret
dec eax
mov eax, ecx
ret
Function at 0x402a64
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402aa1
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402ac1
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004045c0
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4032ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4dc020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403384
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403364
xor eax, eax
push ebp
push 0x40335d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403364
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4dc020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4dc020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404130
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e004c], 0
je 0x404191
cmp word [0x4e0220], 0xd7b2
jne 0x404159
cmp dword [0x4e0228], 0
jbe 0x404159
mov eax, 0x4e021c
call dword [0x4e0238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4dc06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041b8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4dc030], 0
jne 0x4041ad
push 0
push 0x4dc064
push 0x4dc06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404304
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402804
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4e004d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4042cc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40675c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4067c2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004045c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ea4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4067ac
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067c9
lea eax, [ebp - 0x10]
call fcn.00404350
ret

Function at 0x40974c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404810
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409765
test al, 0x10
jne 0x409769
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409914
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404810
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409936
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40cca8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cce1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404440
jmp 0x40ccea
mov eax, ebx
mov edx, esi
call fcn.004043a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ccf4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cd15
mov al, byte [esp]
jmp 0x40cd17
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret