joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c094a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, bp
and si, ax
jg 0x4c096d
rdtsc
jmp 0x4c0957
mov ah, 0xc5
pop word [esp]
mov ebx, dword [esp]
bswap ebx
jmp 0x4c0934
lea esp, [esp + 2]
jmp 0x4c0973
rdtsc
lea esp, [esp + 2]
mov edi, dword [esp + 0x2c]
sub esp, 9
jmp 0x4c09b2
bsr si, ax
push word [esp + 4]
xchg word [esp + 7], bp
jmp 0x4c09f5
jg 0x4c0980
bsr si, ax
push word [esp + 4]
jmp 0x4c099c
xchg byte [esp + 2], al
add esp, 9

Function at 0x4c1389
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp]
lea esp, [esp + 2]
ror edi, 0
mov cx, dx
mov ah, byte [esp]
inc ch
jmp 0x4c11cb
mov edx, ebx
bswap ecx
and ecx, 0x21b2edf6
mov ecx, dword [esp]
lea ecx, [ebp - 0x75]
mov dx, 0x281d
jmp 0x4c11d3
mov ax, 0x464
xchg edx, eax
sub eax, edi
call fcn.004c1177
and ecx, 0x21b2edf6
mov ecx, dword [esp]
lea ecx, [ebp - 0x75]
jmp 0x4c119a
je 0x4c118a
mov edx, ebx
bswap ecx
jmp 0x4c11b5
mov ax, di
bsf cx, si
bsf ecx, esi
jae 0x4c1268
jb 0x4c1268
sti
js 0x4c11d7
mov dword [eax - 0x79], edi
aad 0x44
neg esi
lea edx, [edi - 0x67]
lea edx, [ecx + ebp]
lea edx, [ecx*4]
mov ecx, dword [esp]
xchg dword [esp], ecx
and edx, ebp
jmp 0x4c11a9
jbe 0x4c122f
neg dh
mov cl, 0x78
jmp 0x4c1214
mov dh, byte [esp]
cmc
stc
jmp 0x4c1238
neg dh
mov cl, 0x78
mov dh, byte [esp]
cmc
stc
lea ecx, [esi + edi]
jmp 0x4c1241
xchg dx, cx
mov ah, cl
mov edx, 0xc6160e6a
mov al, 9
jmp 0x4c1285
add edi, dword [ebp]
sbb al, 0xf4
jmp 0x4c1207
pushal
mov ebp, 0x15ee8b32
rol ebp, 0x18
jge 0x4c1287
rdtsc
jmp 0x4c12ca
jmp 0x4c126f
rdtsc
jmp 0x4c128f
mov dword [esp + 0x18], edi
lea eax, [ecx - 0x30]
popal
movzx edx, byte [ecx]
xchg ecx, eax
mov ah, byte [esp]
mov ax, 0x5871
lea eax, [ebx + edi]
mov ah, 0xdd
jmp 0x4c1313
jmp 0x4c1134
mov dword [esp + 0x18], edi
lea eax, [ecx - 0x30]
popal
call fcn.004c1304
xchg byte [edi], cl
pushfd
shl byte [esi - 0x79], 4
and al, 0xf
enter 0xffffffffffffe8c1, 0x1b
lea ebp, [ebp - 0x23]
inc eax
jmp 0x4c1333
push dword [esp + 4]
ret 8
mov ch, 0x53
mov ch, byte [esp]
shr ch, cl
jb 0x4c135d
xchg cx, ax
lea ecx, [edx + ebx]
mov ax, word [esp]
mov ecx, dword [esp]
jmp 0x4c1362
mov eax, 0x44a01c42
mov ah, byte [esp]
neg eax
xchg dword [esp + 4], ebp
inc ax
mov eax, edx
jmp 0x4c12ed
lea ecx, [edx + ebx]
mov ax, word [esp]
mov ecx, dword [esp]
jmp 0x4c1362
xchg cx, ax
jmp 0x4c1347
sub dl, bl
mov al, dl
call 0x4c136c
psubsb mm1, qword [eax]
add byte [eax], al
jmp 0x4c13a3
lea ecx, [edi*4]
pop cx
neg cx
jmp 0x4c1424
bswap ecx
pop cx
rcr dx, cl
jb 0x4c12af
mov dx, word [esp]
lea esp, [esp + 2]
call fcn.004c111a
push dword [esp + 9]
setns cl
pop cx
jmp 0x4c1373
push ebx
call 0x4c13de
mov cl, dl
bsf ax, bx
jp 0x4c13f4
push ebx
jmp 0x4c13f5
Function at 0x71a916
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
neg edi
mov edx, dword [esp + 0x10]
push word [esp + 2]
add esp, 0x11
jmp 0x71a91b
sub esp, 0x11
jmp 0x71a900
mov ax, 0x7461
stc
bswap ebx
sub esp, 0x19
mov byte [esp + 9], ah
mov ecx, eax
jmp 0x71a96a
add esp, 0x1e
shr bp, 7
xchg cx, ax
xchg ebx, esi
rdtsc
mov edi, 0x7ffa0d78
jmp 0x71a954

Function at 0x71bb49
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp]
xchg bx, dx
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
mov cx, 0xa779
rdtsc
xchg bh, dh
jmp 0x71bb19
cld
mov si, bp
clc
bsf eax, edi
std
bsr ebp, ebx
jmp 0x71bad0
mov al, 0x8e
cpuid
mov si, word [esp]
xchg dh, bl
mov esi, dword [esp]
mov ebx, dword [esp]
jmp 0x71bb3e
inc bl
rcl cx, cl
xchg si, dx
inc edx
mov bl, 0x86
bswap ebp
jmp 0x71bb03
mov byte [esp], bh
mov byte [esp], al
call fcn.0071bb28
jmp 0x71bc13
mov dword [esp], ebx
pop dx
bswap edx
xchg dl, bl
mov byte [esp], dh
sub esp, 0x10
jmp 0x71bb96
lea esp, [esp]
cld
setnp bh
rdtsc
not cx
mov ebx, 0xcff07027
jmp 0x71baf5
pushfd
pop cx
bsr ebx, esi
pop dword [esp]
mov ecx, dword [esp]
pop eax
jmp 0x71bbc4
lea esp, [esp + 0xb]
mov byte [esp + 2], cl
neg cx
bsf ax, si
pop word [esp + 3]
xchg dh, bl
jmp 0x71bb80
xchg esi, ebp
mov bx, 0xca76
rol cl, cl
lea ebp, [ecx + 0xa6]
jmp 0x71bbef
push sp
bts bx, cx
xchg byte [esp + 2], bh
rcr dh, cl
add esp, 0
xchg word [esp], di
jmp 0x71bbae
rol cl, cl
cmc
bsr bx, bx
mov ax, 0x987c
rdtsc
rdtsc
jmp 0x71bc25
mov al, byte [esp + 2]
rdtsc
add esp, 0
pop ecx
bswap edi
cpuid
jmp 0x71bbd9
bsf ecx, edi
mov bh, ch
bswap edi
mov ecx, esi
mov ax, cx
dec ebp
jmp 0x71bb4e
mov ecx, dword [esp]
mov ebx, ecx
mov ah, byte [esp]
lea ecx, [ebx + ebp]
lea ebp, [eax*4]
btr bx, di
jmp 0x71bcca
bt dx, bp
mov byte [esp], al
mov esi, dword [esp]
mov byte [esp], al
not bl
cpuid
jmp 0x71bb6a
cpuid
xchg si, ax
mov dword [esp + 0xd], edx
mov dh, byte [esp + 0xc]
jmp 0x71bca8
std
mov ebx, dword [esp + 0x11]
mov word [esp + 8], bp
pop bp
mov dx, word [esp + 0xc]
lea ebp, [esi + esi]
jmp 0x71bc64
cpuid
sete dl
mov bl, dl
mov byte [esp + 0xd], bh
cpuid
neg ebx
jmp 0x71bc7a
push word [esp + 0xb]
std
cpuid
mov dh, 0x71
mov edi, 0xabac4d72
lea esp, [esp + 8]
jmp 0x71bd05
mov bp, sp
lea edx, [edx + ebp]
rdtsc
neg cx
std
sub esp, 0x1a
jmp 0x71bc97
cpuid
mov ebx, eax
cpuid
mov si, cx
cpuid
push dword [esp + 0xb]
jmp 0x71bd34
cpuid
mov al, 0x9b
std
lea esp, [esp + 1]
mov si, word [esp + 0xc]
xchg dh, bl
jmp 0x71bd1e
xchg dword [esp + 0xc], edi
lea ebp, [edx*4]
lea esp, [esp + 3]
bswap ebx
mov edx, dword [esp + 0xe]
pop dx
jmp 0x71bcdb
mov edx, dword [esp + 8]
mov dword [esp + 6], eax
setl dh
pop bp
jmp 0x71bd4b
bswap eax
mov byte [esp + 7], ah
push word [esp + 0xb]
pop dword [esp + 3]
btr ecx, ecx
lea ecx, [esp + eax]
jmp 0x71bcec
xchg word [esp + 5], bp
mov ax, bp
bsr ebx, ecx
call fcn.0071bd87
and al, 0xa4
cmp bl, byte [ebp - 0x54]
inc esi
push ecx
sar bh, 1
push dword [esp]
add esp, 0xb
add esp, 0
jmp 0x71bc4e
Function at 0x71bd63
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp]
xchg bx, dx
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
mov cx, 0xa779
rdtsc
xchg bh, dh
jmp 0x71bb19
cld
mov si, bp
clc
bsf eax, edi
std
bsr ebp, ebx
jmp 0x71bad0
mov al, 0x8e
cpuid
mov si, word [esp]
xchg dh, bl
mov esi, dword [esp]
mov ebx, dword [esp]
jmp 0x71bb3e
inc bl
rcl cx, cl
xchg si, dx
inc edx
mov bl, 0x86
bswap ebp
jmp 0x71bb03
mov byte [esp], bh
mov byte [esp], al
call fcn.0071bb28
jmp 0x71bc13
mov dword [esp], ebx
pop dx
bswap edx
xchg dl, bl
mov byte [esp], dh
sub esp, 0x10
jmp 0x71bb96
lea esp, [esp]
cld
setnp bh
rdtsc
not cx
mov ebx, 0xcff07027
jmp 0x71baf5
pushfd
pop cx
bsr ebx, esi
pop dword [esp]
mov ecx, dword [esp]
pop eax
jmp 0x71bbc4
lea esp, [esp + 0xb]
mov byte [esp + 2], cl
neg cx
bsf ax, si
pop word [esp + 3]
xchg dh, bl
jmp 0x71bb80
xchg esi, ebp
mov bx, 0xca76
rol cl, cl
lea ebp, [ecx + 0xa6]
jmp 0x71bbef
push sp
bts bx, cx
xchg byte [esp + 2], bh
rcr dh, cl
add esp, 0
xchg word [esp], di
jmp 0x71bbae
rol cl, cl
cmc
bsr bx, bx
mov ax, 0x987c
rdtsc
rdtsc
jmp 0x71bc25
mov al, byte [esp + 2]
rdtsc
add esp, 0
pop ecx
bswap edi
cpuid
jmp 0x71bbd9
bsf ecx, edi
mov bh, ch
bswap edi
mov ecx, esi
mov ax, cx
dec ebp
jmp 0x71bb4e
mov ecx, dword [esp]
mov ebx, ecx
mov ah, byte [esp]
lea ecx, [ebx + ebp]
lea ebp, [eax*4]
btr bx, di
jmp 0x71bcca
bt dx, bp
mov byte [esp], al
mov esi, dword [esp]
mov byte [esp], al
not bl
cpuid
jmp 0x71bb6a
cpuid
xchg si, ax
mov dword [esp + 0xd], edx
mov dh, byte [esp + 0xc]
jmp 0x71bca8
std
mov ebx, dword [esp + 0x11]
mov word [esp + 8], bp
pop bp
mov dx, word [esp + 0xc]
lea ebp, [esi + esi]
jmp 0x71bc64
cpuid
sete dl
mov bl, dl
mov byte [esp + 0xd], bh
cpuid
neg ebx
jmp 0x71bc7a
push word [esp + 0xb]
std
cpuid
mov dh, 0x71
mov edi, 0xabac4d72
lea esp, [esp + 8]
jmp 0x71bd05
mov bp, sp
lea edx, [edx + ebp]
rdtsc
neg cx
std
sub esp, 0x1a
jmp 0x71bc97
cpuid
mov ebx, eax
cpuid
mov si, cx
cpuid
push dword [esp + 0xb]
jmp 0x71bd34
cpuid
mov al, 0x9b
std
lea esp, [esp + 1]
mov si, word [esp + 0xc]
xchg dh, bl
jmp 0x71bd1e
xchg dword [esp + 0xc], edi
lea ebp, [edx*4]
lea esp, [esp + 3]
bswap ebx
mov edx, dword [esp + 0xe]
pop dx
jmp 0x71bcdb
mov edx, dword [esp + 8]
mov dword [esp + 6], eax
setl dh
pop bp
jmp 0x71bd4b
bswap eax
mov byte [esp + 7], ah
push word [esp + 0xb]
pop dword [esp + 3]
btr ecx, ecx
lea ecx, [esp + eax]
jmp 0x71bcec
xchg word [esp + 5], bp
mov ax, bp
bsr ebx, ecx
call fcn.0071bd87
and al, 0xa4
cmp bl, byte [ebp - 0x54]
inc esi
push ecx
sar bh, 1
push dword [esp]
add esp, 0xb
add esp, 0
jmp 0x71bc4e

Function at 0x71bd87
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
mov dword [esp + 8], ebp
mov cx, word [esp + 0xc]
push word [esp + 0xb]
jmp 0x71bda6
pop dx
xchg dword [esp + 1], esi
std
jmp 0x71bd71
setnp ch
rdtsc
add esp, 5
mov word [esp + 6], sp
rdtsc
jmp 0x71bdeb
push dword [esp + 2]
push dword [esp + 1]
btc ax, si
xchg word [esp + 4], cx
dec ebx
pop edi
jmp 0x71bd90
mov bh, 0xee
cpuid
btr di, bp
not dh
xchg word [esp + 6], bx
shl ah, cl
jmp 0x71bdd5
Function at 0x71c3f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edi*4]
mov byte [esp + 1], al
jmp 0x71c354
pop dword [esp + 2]
rcl ax, 1
mov ax, 0xa097
mov word [esp + 1], di
jmp 0x71c2f8
neg cx
cpuid
mov byte [esp + 5], dh
pop word [esp + 1]
mov bp, si
pop dword [esp + 1]
jmp 0x71c30e
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
sub esp, 8
mov esi, edi
lea esp, [esp + 2]
jmp 0x71c3a7
lea edi, [esi - 0xae]
mov byte [esp + 4], bl
rdtsc
cmp dh, 0x12
add esp, 6
stc
jmp 0x71c33e
setb ch
push word [esp]
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
push word [esp + 0xf]
setne dl
bsr ax, di
jmp 0x71c327
bt bx, cx
mov di, 0x3a42
lea ebx, [ecx*4]
mov esi, edx
cpuid
jmp 0x71c3d5
xchg byte [esp + 6], al
mov word [esp + 2], dx
mov si, word [esp + 4]
cmc
mov dx, di
bsf ax, di
jmp 0x71c38b
mov ch, byte [esp + 3]
std
xchg si, cx
xchg byte [esp + 5], bh
add esp, 2
jmp 0x71c4e6
mov edi, dword [esp + 5]
mov esi, 0x97a01a0b
xchg ecx, eax
mov bh, ch
mov edx, ebp
cpuid
jmp 0x71c3bf
jmp 0x71c370
cld
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
std
mov ebx, 0xb64c0ae4
bsf ebx, edx
jmp 0x71c437
bswap ecx
xchg dx, bx
bswap eax
xchg bx, cx
rdtsc
mov byte [esp + 1], bh
jmp 0x71c3f9
pop bp
lea edx, reloc.WSOCK32.dll___WSAFDIsSet
lea esi, [edi*4]
jmp 0x71c465
mov word [esp + 2], bx
push dword [esp + 4]
rdtsc
mov byte [esp + 1], bl
sub esp, 0x16
mov byte [esp + 6], ah
jmp 0x71c421
shl esi, 3
lea esi, [ebp + 5]
sub esp, 0x16
mov word [esp + 0x1f], bp
jmp 0x71c4b6
mov si, ax
sete ah
neg di
lea ebx, [esi*4]
inc ch
neg esi
jmp 0x71c44f
bswap ebx
xchg di, si
mov edx, dword [esp + 3]
mov ax, sp
cpuid
mov ebp, edx
jmp 0x71c40f
not ebx
push edx
push word [esp + 0x1a]
pop bx
xchg word [esp + 0x2e], dx
jmp 0x71c4cf
pop word [esp + 0xb]
lea esi, [ecx*4]
mov edx, edi
setno ch
neg edi
mov bl, byte [esp + 0x2f]
jmp 0x71c4a0
rdtsc
ror bl, cl
lea esi, [ebx + ebp]
bt edi, esi
lea ebx, [eax - 0x20]
jmp 0x71c511
not ebp
neg edi
cmp dx, 0xc175
xchg si, bp
xchg word [esp + 1], bp
cpuid
jmp 0x71c48b
mov bp, 0x75fb
sub esp, 7
neg ax
mov word [esp], di
jmp 0x71c52e
lea ebx, [ecx*4]
xchg word [esp + 0x16], bp
mov dx, 0x9745
xchg dword [esp + 0xe], edi
sub esp, 0xf
lea esp, [esp + 0x45]
jmp 0x71c4fb
mov dword [esp], edi
not di
pop word [esp + 1]
xchg bh, bl
bsr esi, esi
pushal
jmp 0x71c5f5
lea eax, [ecx + ebp]
mov byte [esp + 0xa], cl
push ebx
btr dx, bx
cmc
mov cx, 0x9c1d
jmp 0x71c55f
xchg ecx, edx
mov cx, word [esp + 0x10]
mov edx, esp
stc
mov byte [esp + 9], ch
sub esp, 0xb
jmp 0x71c575
lea edi, [esi + edi]
inc bp
setb cl
mov ah, 0xd4
std
lea esp, [esp + 0x13]
jmp 0x71c5a0
Function at 0x71c5c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ax, cx
mov cx, 0xda4
lea edx, [ebp*4]
jmp 0x71c5d3
cpuid
pop dx
xchg byte [esp + 0x10], dh
jmp 0x71c5b3
add esp, 0xf
cld
not dx
mov al, byte [esp + 3]
add esp, 4
mov ebx, dword [esp + 3]
jmp 0x71c61c
pop bx
rol di, cl
push word [esp + 2]
jmp 0x71c675
ror al, cl
xchg bp, cx
inc bl
setg dh
mov cx, 0x1b50
lea ecx, [edi*4]
jmp 0x71c606
sub esp, 0x14
mov si, ax
mov word [esp + 0xa], ax
or ah, dh
mov al, dl
jmp 0x71c65d
xchg byte [esp], ch
setns ah
rdtsc
cld
mov esi, 0xcafbf7eb
mov word [esp], ax
jmp 0x71c633
lea esp, [esp + 2]
lea esp, [esp + 0x14]
popal
std
cmc
cmc
jmp 0x71c6a3
lea ecx, [ecx*4]
bswap edx
lea esp, [esp + 4]
bswap esi
bsf bp, bx
mov ebp, dword [esp]
jmp 0x71c649
lea esp, [esp + 4]
jmp 0x71caf0
sub esp, 0x13
push cx
pop word [esp + 3]
sub esp, 0x19
lea esp, [esp + 0x2c]
popfd
jmp 0x71c68d
pushfd
mov dword [esp], eax
call fcn.0071c8b9
ficomp word [esi - 0x34]
invalid
stosd dword es:[edi], eax
mov word [ebx + esi*4], gs
and eax, dword [esi - 0x4b]
add eax, 0x4d2ab432
mov esp, 0x31a12409
push eax
mov dword [reloc.WSOCK32.dll___WSAFDIsSet], eax
pop ss
loop 0x71cb68
movsb byte es:[edi], byte [esi]
daa
mov bh, 0xd2
and dword [eax - reloc.WSOCK32.dll___WSAFDIsSet], ebp
pop eax
fbstp tbyte [0xbf4c25b5]
dec esi
and eax, 0xae5334a6
push ecx
push ebp
fisttp dword [ebx + 0x2e]
fnsave dword [ecx]
mov esi, 0x1c862889
and al, 0x83
les eax, [eax]
popfd
or eax, 0x6a11a754
out dx, al
jl 0x71cb81
test byte [ebp + 0x78], 3
js 0x71cb6d
xchg ebx, eax
test byte [0x5ac44e84], 0x3d
int3
test byte [esi - 0x3c], cl
pop edx
cmp eax, 0x71f14bcc
loope 0x71caf8
jae 0x71cafc
int1
jb 0x71cb5d
xchg dword [edx - 0x73], esi
int1
ja 0x71cb6a
xor byte [ecx - 0x6b], 0xe9
push 0xde6899fe
add dword [ebp + reloc.WSOCK32.dll___WSAFDIsSet], eax
mov cl, 0x36
movsb byte es:[edi], byte [esi]
ret
Function at 0x402998
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029d5
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029f5
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004045c0
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b5c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404350
test esi, esi
jne 0x402b92
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404440
jmp 0x402bb0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a70
mov edi, eax
test esi, esi
je 0x402bb0
cmp dword [ebx], 0
je 0x402bb0
dec esi
jmp 0x402b99
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x50b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403344
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403324
xor eax, eax
push ebp
push 0x40331d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403360
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403324
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x50b020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x50b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404130
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50f04c], 0
je 0x404191
cmp word [0x50f220], 0xd7b2
jne 0x404159
cmp dword [0x50f228], 0
jbe 0x404159
mov eax, 0x50f21c
call dword [0x50f238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x50b06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041b8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x50b030], 0
jne 0x4041ad
push 0
push 0x50b064
push 0x50b06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404304
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027b0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x50f04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4042cc
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406508
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40656e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004045c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e64
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406558
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406575
lea eax, [ebp - 0x10]
call fcn.00404350
ret

Function at 0x409364
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404810
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40937d
test al, 0x10
jne 0x409381
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c018
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c051
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404440
jmp 0x40c05a
mov eax, ebx
mov edx, esi
call fcn.004043a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c064
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c085
mov al, byte [esp]
jmp 0x40c087
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c70c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c584
mov eax, dword [0x50e438]
cmp byte [eax], 0
je 0x40c788
mov eax, dword [0x50e05c]
call fcn.00402c94
call fcn.00402924
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040963c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c7d0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c7be
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x50dfc0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x50f668]
call fcn.004059cc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d078
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d14e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004043e8
lea eax, [ebp - 8]
call fcn.00404860
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404810
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d138
mov eax, ebx
call fcn.004027b0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d131
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404810
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d11b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d160
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d11b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d138
mov eax, dword [ebp - 0x10]
call fcn.004027d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d155
lea eax, [ebp - 8]
call fcn.00404350
ret

Function at 0x40d6e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d74c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004045c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408e84
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d753
lea eax, [ebp - 0xc]
call fcn.00404350
ret

Function at 0x423d28
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00423b80
dec esi
jne 0x423d4a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x424e8c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x50f88c
cmp dword [edi], 0
jne 0x424f08
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x50f888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x50b528
mov ecx, 2
call fcn.00402a30
mov edx, 0x424e64
lea eax, [esi + 5]
call fcn.00424e84
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00424e84
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x424edd
mov dword [0x50f888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x426574
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42657a
ret

Function at 0x428ca0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x428cf1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x428cd8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x428cc8
jmp 0x428cf1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x428cd9
pop ebx
mov esp, ebp
pop ebp
ret