joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf1e9b4
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
sbb cl, 0x8f
rol cl, 1
xor bl, cl
sal dword [esp + edx - 0x24b79d9], 0xf2
shr dword [esp + edx*2 - 0x496f3ac], 0x61
lea ecx, [esp + ecx + 0xc]
rol edx, 0xb3
ror dl, 0x61
mov word [ecx], ax
mov edx, dword [esi + 2]
pop eax
ror eax, 0x81
xor eax, 0x2bae399a
mov cx, word ss:[edx]
mov edx, dword [esp + 4]
mov word [esi + edx - 0x2e667fe1], cx
shl dx, 4
neg dword [esp + edx*2 - 0x5ccdfca0]
lea esi, [esi + edx - 0x2e66fe4c]
jo 0xf36dd5
sal eax, 0x84
mov dword [esp + edx - 0x2e66fe50], ebp
ret 4
xadd ecx, edx
adc ebp, eax
movzx eax, cx
shl eax, cl
movzx edx, byte [edi + edx*8 - 0x1217fff0]
not cl
sar eax, cl
dec cl
lea edi, [ecx + edi - 0x19556bb4]
neg eax
shl ecx, cl
cbw
xor dl, bl
inc dl
sar cx, 0xcc
or cx, ax
rol dl, 1
dec ax
not cx
jno 0x10353ff
adc ebp, edx
shl cx, cl
mov ax, word [esi + eax*4 - 0x11200]
lea edx, [ecx - 0xff16fe7]
movzx ecx, byte [edi + edx - 0x5c33d395]
mov dword [esp + edx - 0x5c33d399], edx
lea edi, [edx + edi - 0x5c33d394]
lea edx, [edx*8 + 0x533ed137]
xor cl, bl
push edx
sub cl, 0xb6
rol dword [esp + edx*2 - 0x69badbfd], 0xa8
xor cl, dl
xchg byte [esp + edx - 0x34dd6dfa], dl
inc cl
push edx
sar edx, 0x55
rol byte [esp + edx*2 - 0x342], 0xe6
neg cl
xor edx, 0xdd31dd01
neg dword [esp + 5]
lea edx, [edx*2 + 0x4837a500]
not cl
imul edx, dword [esp + edx*2 - 0x536bc94]
jb 0xeb2256
rol eax, 2
sub cx, cx
setbe cl
bswap eax
ror eax, cl
not cx
sub eax, 0xfca18e3e
xor ebx, eax
bts dx, cx
jb 0xee8b60
xor dl, 0x36
and al, cl
sbb dl, 0x92
add al, cl
bt ecx, 0x9a
xor bl, dl
shl ecx, cl
or al, 0x16
xor eax, eax
adc edx, esp
add ax, word [edx + eax*2]
lea edx, [ecx + 0x8ae7b5]
xchg dx, cx
sub esi, 2
mov word [esi], ax
push edx
lea eax, [ecx + ecx*2 - 0x32d8b769]
pop eax
jmp fcn.00f19375

Function at 0xf90048
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov edi, 0x5e80531a
movsx ecx, di
mov dword [ebp + edi - 0x5e80531a], eax
movsx esi, cl
movsx edx, cx
lea ebx, [edx*4 + 0x3593c6ad]
mov esi, ebp
add edx, edx
pop ebx
movzx ebp, cx
shl edx, cl
pop ebp
shr edi, cl
ror cl, 0x45
mov eax, ecx
pop edi
xor dx, 0x9d29
mov eax, dword [edi + ecx*2 - 0xa7a0]
sar edx, 0x5d
lea edi, [edi + ecx*8 - 0x29e7c]
xor eax, ebx
jmp 0xef09a9
Function at 0xfd5667
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf7ef4f
mov edx, 0xf4a39829
movzx dx, byte [esi]
mov ecx, 0x837ad
movzx eax, cx
push eax
mov cl, byte [esi + ecx*4 - 0x20deb2]
not dword [esp + eax - 0x37ad]
lea esi, [esi + eax*2 - 0x6f58]
ror al, 0xc1
shr dl, cl
mov word [esi + eax - 0x37d6], dx
movzx ecx, word [esp + eax*8 - 0x1beb0]
mov ecx, dword [edi + eax*8 - 0x1beb0]
rol dword [esp + eax*2 - 0x6fac], 0x4c
lea edi, [edi + eax*8 - 0x1beac]
jb 0xf84b24
les esp, [0x1eedced6]
inc edi
jl 0xf7efb0
inc esi
int 0x36
inc edi
jl 0xf7efb6
invalid
call [0x7c473ab1]
sbb eax, 0x7c473ab1
push dword [edx - 0x5b]
mov dl, 0x8b
xchg esi, edi
pushfd
and ah, cl
arpl di, di
mov al, byte [esi + 0x62b345d8]
mov eax, 0x81a0a880
mov dword [0xa7187c67], eax
imul esp, esi, 0x18bbbf8e
bound ebp, qword [edi + esi*8]
cmp ebp, dword [esi]
rcl byte [eax]
sbb eax, 0x151a1f40
jg 0xf7f058
out 0x9a, eax
and dword [ebp + edx*2 - 0x25], ecx
adc dword [edi*4 - 0x278aee02], esi
and edi, dword [ebp + 0x4d]
xchg byte [ecx - 0x1b3e65e6], dl
and ah, byte [edx]
push 0x5d
adc al, 0xbe
out 0x16, eax
insb byte es:[edi], dx
sub esp, dword [edx + esi*4 - 0x4a45870f]
mov gs, word [ebx + 0x52]
mov byte [0x5e152a09], al
out dx, eax
dec eax
dec esi
sbb al, 0x91
dec ebp
neg byte [eax + 0xe53119b]
mov byte [0x7e3c0c90], al
mov edi, 0x2b40f86c
invalid
insb byte es:[edi], dx
jo 0xf7f0c1
xchg ebp, eax
xchg dword [esi - 0x4a], ebx
pop esi
mov dh, 0xb0
xor ebx, dword [eax]
push ss
mov al, 0x33
sbb byte [esi], dl
imul eax, dword [edx + 0x2a6e69a1], 0x33
arpl word [edx], sp
pop eax
pop ss
jns 0xf7f046
in eax, dx
imul eax, dword [eax + 0x7c], 0x77
xchg ecx, eax
ficomp dword [eax + 0x51]
cmpsd dword [esi], dword es:[edi]
pop eax
jle 0xf7f048
out 0xe8, al
pop ebx
call 0x52fb87a5
add dl, byte [edx - 0x250ff3bf]
popfd
mov ecx, 0x6b0ae8c0
sub eax, 0xb8c9528c
mov ecx, 0xa861955d
push edx
xlatb
lodsb al, byte [esi]
add ch, byte [ebp + 0x20a7c5e8]
or al, 0xe3
outsd dx, dword [esi]
jecxz 0xf7f0fe
cmpsb byte [esi], byte es:[edi]
adc ah, ah
test dword [ebp + 0x40], edi
adc dword [eax - 0x541c95f1], edx
ja 0xf7f041
fisttp dword [eax + ebx*2 + 0x617f70ef]
pop ecx
pop ebp
dec eax
mov bl, 0xe7
or dword [esp + esi*8], esp
dec edi
lodsb al, byte [esi]
adc eax, 0x1a1cbb19
dec ecx
mov dword [esi + edx*2 - 0x57afc2c3], ebp
salc
pop ebp
mov ds, word [ecx + 0x78415061]
leave
inc ecx
js 0xf7f08d
jbe 0xf7f0bb
imul esi, dword ds:[ebx + 0x70], 0x3787ec60
cmc
jecxz 0xf7f0f8
sbb eax, 0x7b1bec25
xchg edx, eax
out 0x33, al
mov bh, byte [eax + 0x72]
xor ch, byte [edi - 0x77890c28]
ficom dword [ebx - 0x4a]
salc
cmp eax, 0x774c31d2
inc edx
sub dword [ebp + 5], edx
mov ecx, 0x9bec32d2
cmpsb byte [esi], byte es:[edi]
push cs
jl 0xf7f0c6
mov al, byte [eax]
add al, 0x2b
retf
xor esi, esp
out dx, eax
int3
xor ecx, ebx
movzx edx, ax
not ecx
neg al
rol ecx, 2
or ax, word [esp + eax - 0x3728]
rol edx, 0x9b
cwde
sbb ecx, 0x7e18c297
bts ax, ax
rol ecx, 2
neg ecx
xor ebx, ecx
neg dword [esp]
add ebp, ecx
or ax, dx
pop ecx
jmp ebp
xchg dword [esp + eax*2 + 0x10], eax
xor ebx, ecx
call fcn.00ec0d7b
jmp 0xed018a
Function at 0x1055ee6
Capabilities:
Encode data using xor

Disassembly:
dec ebp
arpl bx, bx
dec ebp
add esi, ebx
inc ecx
sub ecx, 0x3a00e937
jl 0xf9bd5d
dec edx
mov edx, dword [eax - 0x1c99d]
inc ecx
movzx ecx, cx
inc ecx
shr bh, 0x44
inc bp
mov eax, dword [esp + eax - 0x1c995]
inc eax
sets bh
inc eax
inc dh
dec ebp
lea esp, [esp + eax - 0x1c993]
dec ecx
add esi, ebp
dec esp
cmovs ebp, ecx
jae 0xeb7f60
inc sp
mov dword [edx + eax - 0x1c99d], eax
inc ecx
inc edi
dec esi
lea ebx, [edi*4 + 0x3d0f0d32]
dec ecx
xor ebp, esi
jmp ebp
inc eax
not bh
inc eax
xor bl, bh
dec ecx
lea ebp, [edi - 0x5ad4d67e]
dec esp
mov dword [esp + esi - 0x1b], ebx
dec eax
lea edi, [esp + edi + 0x10]
mov cx, word [edi + esi*4 - 0x6c]
push edx
inc cx
mov dword [esp + esi - 0x1d], ecx
push ebp
dec ecx
btr edi, 0xa5
inc esp
movsx eax, dh
inc ebp
mov ecx, dword [edx + esi*2 - 0x35]
inc esp
xor ecx, ebx
inc esp
movsx ebp, word [esp + esi - 8]
inc ecx
movzx edi, ch
mov eax, dword [esp + edx + 3]
inc ecx
ror ecx, 2
inc ecx
bts edi, ebp
dec eax
cdq
inc ecx
dec ecx
xchg edi, esi
cbw
inc esp
and ebp, edi
inc ecx
not ecx
inc ecx
imul ebx
not ax
inc ecx
bswap ecx
inc eax
setno dh
dec eax
mul edi
dec ecx
adc edi, 0x701c5917
inc ecx
ror ecx, 1
inc eax
or dl, dh
dec ecx
ror ebx, 0xb3
inc ecx
inc edi
dec eax
mov dword [esp + esi + 0x17], ebx
inc eax
setb bh
inc esp
xor dword [esp + esi*2 + 0x16], ecx
dec eax
mov ebx, dword [esp + esi*2 + 0x16]
inc cx
and eax, 0x31e8e52c
sbb eax, 0xc040fff1
in eax, dx
cmpsb byte [esi], byte es:[edi]
inc edx
xor dword [esp + ebx - 0x73], ecx
inc edx
and byte [esp + ebx*2 - 0xf3], al
movzx ebx, byte [esp + ebp - 0xb200]
dec eax
mov ebx, dword [esp + ebp - 0xb1f8]
dec eax
shr ebp, 0x69
dec eax
arpl cx, cx
cdq
dec esp
adc esi, ecx
shr word [esp + ebp*2 + 4], 0x4e
imul edx
jb 0xf498b3
dec edx
mov edi, dword [ebp + edx + 4]
neg al
dec edi
lea edx, [edx + ebx*8 - 0x3cc]
dec eax
xor edi, ebx
dec eax
lea edi, [ebp + edi + 0x614898b]
dec eax
inc ebp
inc ecx
or dl, ch
jle 0x193e7aa
dec eax
bswap edi
dec eax
mov dword [esp + ebp + 7], edx
dec eax
sbb edi, ebp
inc ecx
push ebx
inc esp
movsx eax, bp
dec eax
rol edi, 4
inc dx
sub dword [esp + ebx*2 - 0xf0], edx
sbb bp, 0xeea8
inc ecx
not al
dec eax
xor ebx, edi
inc ebp
movzx ecx, ch
inc ecx
bswap ecx
dec ecx
mov dword [esp + ebp - 0x115e], edi
dec ebp
lea esp, [esp + ebp*8 - 0x8ac6]
inc ecx
sar bl, 0x83
inc esp
and byte [esp + ebp - 0x1146], al
xadd dword [esp + ebp - 0x1156], ebp
pop edi
pop eax
pop esi
jg fcn.00ebc0c8
Function at 0x193bcf7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x10], edx
mov edx, dword [edi + edx*2 - 0x20]
lea ecx, [eax*2 - 0x5a6b75d0]
ror ax, 0x2a
and dword [esp], eax
xor edx, ebx
inc edx
dec ecx
dec dword [esp]
dec eax
xor edx, 0x209f2793
sub word [esp + 1], cx
inc word [esp + 1]
jns 0xf8c8e9
bswap edx
neg edx
bt ecx, 0x1d
bswap edx
sar ax, cl
lea eax, [ecx*2 - 0x24e32459]
dec edx
jmp 0xf2f19c

Function at 0x193fceb
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea edx, [eax + edx - 0x34a9548d]
xor cx, bx
shr byte [esp + eax - 0x34a9547a], 0xa5
inc ebp
mov ebp, eax
dec edx
cmovne esi, dword [esp + eax - 9]
xor cx, 0x8a4
dec ecx
xadd ebx, ebp
or di, bp
not cx
inc esp
mov edi, eax
sbb byte [esp + eax - 0x34a95485], 0x20
dec eax
ror esi, 0x33
ror cx, 1
sub cx, 0x6294
not edi
inc ecx
pop ebp
xor bx, cx
inc ebp
movsx ecx, bl
rol esi, 0xa8
ror bp, 0x21
dec eax
lea ecx, [esp + ecx + 0x10]
inc cx
movzx ebp, byte [eax + ecx - 0x19]
inc dword [esp + eax - 0x34a9548f]
dec ecx
bt ecx, 0x85
inc cx
shr ebp, 0x68
dec ebp
lea esp, [esp + eax*2 - 0x6952a920]
mov ecx, dword [esp + eax - 0x34a95485]
inc ecx
sub ebp, 0x529d6019
inc cx
mov dword [esp + eax*2 - 0x6952a91e], ebp
call fcn.00f8dc9e
inc ecx
ror eax, 3
dec eax
mov dword [esp + eax - 0x4e3d1987], ebx
movzx ebx, ax
dec eax
mov dword [esp + edi - 0x51072b19], ebx
inc esp
xor dword [esp + edi - 0x51072b11], eax
dec eax
mov ebx, dword [esp + eax - 0x4e3d1987]
dec eax
mov dword [esp + ecx - 0x54b33d17], 0x8719ed9c
add word [esp + edi - 0x51072b11], 0xa629
push edi
dec ebp
arpl ax, ax
inc eax
setns dh
dec ebp
add esi, eax
sub eax, dword [esp + eax - 0x4e3d1980]
sal dword [esp + ecx - 0x54b33d16], 0xe1
inc esp
movzx eax, bh
inc edx
movzx ecx, word [eax + edx - 0x34a9548f]
jno 0xec7123
cmp dword [edi], esi
mov dl, 0xcf
mov eax, dword [0xfe18559b]
adc byte [eax], 0x97
push ebp
sbb dh, bh
outsd dx, dword [esi]
cmc
ret
Function at 0x42d5fe
Capabilities:
Terminate process

Disassembly:
jmp 0x462194
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4621a5
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.0042eb0c
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x42d69e
Capabilities:
Query environment variable

Disassembly:
jmp 0x46a295
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x46a2a9
xor edi, edi
jmp 0x46a2e0
push ebx
push esi
call fcn.0046a19f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042dc0c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x46a2d0
push ebx
push esi
push edi
call fcn.0042e99a
add esp, 0xc
push 0
call fcn.0042f039
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x42ea21
Capabilities:
Parse pe header

Disassembly:
jmp 0x43567f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4356bf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4356bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4356bf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4356bf
cmp dword [ecx + 0x74], 0xe
jbe 0x4356bf
cmp dword [ecx + 0xe8], 0
je 0x4356bf
mov al, 1
ret
xor al, al
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3f062bfe
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..tls
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x49c5f23
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x413760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
jmp 0x41377a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413781
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413770
mov eax, 1
add ebx, ebx
jne 0x413793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413788
jne 0x4137a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413788
xor ecx, ecx
sub eax, 3
jb 0x4137b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41382a
mov ebp, eax
add ebx, ebx
jne 0x4137c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4137d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4137f4
inc ecx
add ebx, ebx
jne 0x4137e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4137d5
jne 0x4137f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4137d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413814
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413805
jmp 0x413776
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413814
add edi, ecx
jmp 0x413776
pop esi
mov edi, esi
mov ecx, 0x13f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413832
cmp byte [edi], 3
jne 0x413832
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x413837
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x4138a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413864
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1306c]
or eax, eax
je 0x4138a0
mov dword [ebx], eax
add ebx, 4
jmp 0x413881
call dword [esi + 0x13068]
mov ebp, dword [esi + 0x13070]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x13901]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4138f2
sub esp, 0xffffff80
jmp 0x4012e0
Function at 0x87902c
Capabilities:
Packed with generic packer

Disassembly:
stc
jmp 0x879036
push ebp
pushal
clc
jae 0x87903b
cmp al, ch
add al, 0
add byte [eax], al
call 0x879044
add byte [eax], al
add byte [ebp - 0xd], bh
jge 0x879035
jl 0x87905a
pop esi
jmp 0x87904b
add esi, 0xffffffc0
jmp 0x87905a
cmp dword [esi], 0
clc
jmp 0x879063
je 0x8790ed
jae 0x87906d
mov esp, 0x73ce8b76
add eax, 0x89799330
inc eax
mov ecx, esi
jae 0x879076
xor byte [ebx - 0x7cbf7687], dl
mov byte [ebx + ebp*8], 8
mov cl, 0x4b
dec ebp
push esp
fistp dword [esi]
inc edx
add esi, 4
jmp 0x879083
mov edx, dword [esi]
jmp 0x87908f
add edx, esi
stc
jb 0x87909a
xchg ecx, eax
jl 0x87903d
sbb ch, ah
inc ecx
mov eax, dword [esi + 4]
jmp 0x8790a4
sub dword [edx], 0xb1561b07
jmp 0x8790af
add edx, 4
jmp 0x8790b7
sub eax, 1
clc
jmp 0x8790bf
jne 0x87909d
jmp 0x8790ca
add esi, 8
jmp 0x8790d1
sub dword [ecx], 1
stc
jmp 0x8790d8
jne 0x879079
clc
jmp 0x8790e2
mov ebx, esi
stc
jb 0x8790e8
wait
call fcn.008790fb
jmp 0x8790f1
popal
clc
jmp 0x8790f6
jmp section..text
Function at 0x402a50
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404424
test esi, esi
jne 0x402a86
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404514
jmp 0x402aa4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402964
mov edi, eax
test esi, esi
je 0x402aa4
cmp dword [ebx], 0
je 0x402aa4
dec esi
jmp 0x402a8d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47000c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403588
xor eax, eax
push ebp
push 0x403581
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403588
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47000c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47000c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404288
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47204c], 0
je 0x4042e9
cmp word [0x472220], 0xd7b2
jne 0x4042b1
cmp dword [0x472228], 0
jbe 0x4042b1
mov eax, 0x47221c
call dword [0x472238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x470054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404310
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47001c], 0
jne 0x404305
push 0
push 0x470074
push 0x470054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40b550
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b589
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404514
jmp 0x40b592
mov eax, ebx
mov edx, esi
call fcn.00404478
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b59c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5bd
mov al, byte [esp]
jmp 0x40b5bf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bc44
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40babc
mov eax, dword [0x471428]
cmp byte [eax], 0
je 0x40bcac
mov eax, dword [0x471188]
call fcn.00402e2c
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408ba8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bcf4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bce2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x471128]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x472718]
call fcn.00405b98
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40cacc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cb30
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040468c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408854
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb37
lea eax, [ebp - 0xc]
call fcn.00404424
ret
Function at 0x41ecc4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x472a24
cmp dword [edi], 0
jne 0x41ed40
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x472a20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4705a0
mov ecx, 2
call fcn.00402924
mov edx, 0x41ec9c
lea eax, [esi + 5]
call fcn.0041ecbc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041ecbc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ed15
mov dword [0x472a20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42022c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x420232
ret

Function at 0x4227b4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x422805
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4227ec
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4227dc
jmp 0x422805
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4227ed
pop ebx
mov esp, ebp
pop ebp
ret