joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 8], 0
push esi
pop esi
call fcn.004fcc5f
push edi
push 0x441108
push 0x4410f8
mov byte [ebp - 0x14], 0x4b
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
call esi
push esi
call fcn.0048178c
push eax
call edi
and byte [ebp - 0x16], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x47
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x50
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x63
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x48
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x70
call esi
push eax
call edi
push dword [ebp + 8]
push 0
call eax
push eax
call dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x48ac2f
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + 1]
pop edi
movsx di, cl
mov dword [esp + 0x2c], ebp
lea edi, [esp - 0x5a285b99]
movzx bp, al
pushfd
bswap bp
mov ebp, 0x416ab1
pushfd
lea edi, [edi*8 - 0x5aefe56f]
jmp 0x4d846f
pushfd
lea ebp, [ebp - 0x28b33999]
push 0x4a53c3a9
pushal
mov edi, ebp
not bp
pushfd
mov ebp, dword [esp + 0x2c]
pushfd
push dword [esp]
push dword [esp + 0x38]
ret 0x3c
mov ebp, dword [ebp + 0x78da4]
movsx edi, al
lea esp, [esp + 0x30]
jae 0x4be565
mov di, 0x5e0e
pushal
lea ebp, [ebp - 0x28b33999]

Function at 0x49e8bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], ebx
mov dword [esp], ebp
lea esp, [esp + 0xc]
jl 0x4b9776
pushfd
mov edi, dword [esp + 4]
lahf
call fcn.004f9403
push 0x6c88aae
push esp
mov dword [esp], 0xa806a6c7
pushal
mov word [esp + 4], bx
push ebp
pushal
lea esp, [esp + 0x44]
jmp 0x4773cf
setle ah
add eax, ebx
test ch, 0xd
mov ecx, dword [ebp + 8]
Function at 0x4af9d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
mov word [esp + 8], bx
mov dword [esp + 0x20], edi
pushfd
push 0x69554e02
mov dword [esp + 0x24], ebx
push dword [esp + 4]
call fcn.0050cde2
xor edi, dword [edi - 0x2606241d]
test al, 0x93
sbb dh, byte [ebx + 0x43]
add dword [0xa588937e], 0xc9aaaf94
mov ch, 0xcf
sal ebp, cl
out 3, eax
or ch, byte [0x351d371c]
cmp al, 0x5f
pop ebp
jge 0x493d9e
mov ebx, 0xde6a5521
lodsb al, byte [esi]
sub dword [ebp - 0x4665752a], esi
loop 0x493e7b
lock and byte [0x2a54db3f], dh
aad 0x51
push ecx
and byte [eax], dh
jo 0x493e37
aaa
or eax, 0x94648fea
xchg esp, eax
pop ss
sub eax, 0x7e5f57e6
jnp 0x493e2d
cmp al, 2
popfd
add eax, 0xde3977aa
xchg esi, eax
mov dword [0x9160d480], eax
cmp eax, 0x53fc51b7
xor bh, 0x1a
jmp 0xe995c6a7
std
cwde
dec ebp
out 0xd1, eax
stc
mov eax, dword [0x5b91dc82]
xchg ecx, eax
pop ebx
jae 0x493ef0
dec edx
xor eax, 0xe37ca40b
mov esi, 0x9c48cbfa
dec eax
pushfd
insb byte es:[edi], dx
mov ah, 0x4e
jle 0x493ede
invalid
loope 0x493e88
invalid
jbe 0x493e72
lodsd eax, dword [esi]
mov edi, 0x5cbd122e
jge 0x493f0a
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx + 0x16], dh
loope 0x493ea7
das
push esp
xchg ebx, eax
pop edi
or dword [ebx + 0x4f628da4], 0x8b9fbae3
inc ebp
adc al, 0xf6
sal dh, cl
salc
xor dword [esi], ebx
add eax, 0x1bf8d00
lea edi, [edi + 1]
push 0x2cf95935
pushfd
mov dword [esp + 0x50], ecx
lea esp, [esp + 0x50]
jns 0x493dd3
push edi
pushfd
call fcn.0051bd82

Function at 0x4b5cb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx bx, cl
dec dword [esi + 0x28]
rdtsc
jmp 0x4e8677
mov dword [esp + 0x28], 0x4e5ad0
call fcn.004e29c7
push dword [esp + 4]
lea ecx, [ebp - 4]
mov byte [esp + 8], cl
push ebp
push dword [esp]
jmp 0x4ff34d
movsx ax, cl
rdtsc
mov byte [ebp - 1], 1
push 0xd91763af
rdtsc
mov ebx, dword [esp + 0x28]
seto al
sets dh
xchg dl, al
mov ah, byte [esp]
mov edx, dword [esi]
movsx ecx, al
movsx ecx, bl
pop ecx
mov eax, dword [edx + 8]
movzx cx, al
movzx cx, cl
setb cl
push eax
mov ecx, esi
mov byte [esp], 0x74
jmp 0x4c2c11
mov dword [esp + 0x40], ecx
pushfd
call fcn.004975c8

Function at 0x4d8f3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
push esp
pushal
push 0xc7f4f49e
push eax
lea esp, [esp + 0x2c]
jmp 0x4b9781
push ebx
jmp 0x49bd0c
bt ebp, 3
pushfd
mov dword [ebp - 4], ebx
bt di, di
test edx, edx
pushal
jmp 0x4f4436
push edx
mov word [esp + 8], bp
add edx, eax
stc
cmc
mov dword [ebp - 8], esi
sub esp, 0xfffffff4
ja 0x4bc467
stc
stc
mov dword [ebp - 4], ebx
test dh, 0xde
bt bx, sp
clc
test edx, edx
push ecx
lea esp, [esp + 4]
jle 0x5003ee
jmp 0x49d597
push 0x5a133426
sub ebx, ebx
jmp 0x4c4cc2
mov word [esp], cx
lea esp, [esp + 0x24]
jle 0x5003ee
push 0x6760651
jmp 0x5289e9
push 0x70ec4dc1
pushal
mov dword [esp + 0x24], edi
mov byte [esp + 4], 0xf5
push dword [esp + 4]
lea esp, [esp + 0x28]
jmp 0x4b9781

Function at 0x4e19ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jl 0x4b9776
lea esi, [ecx + 0x3c4a9a4d]
jmp 0x4b8168
Function at 0x4e669a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4162158b
push dword [esp]
mov dword [esp + 8], 0x461d60
mov byte [esp + 4], 0xe5
mov word [esp], cx
mov dword [esp + 4], 0x4a92ef
call fcn.00508bd1

Function at 0x4e66ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, ebx
call fcn.004d8f3c
movzx edx, word [esi]
movsx ax, dl
movzx eax, word [esi + 2]
cmp bh, al
sub esp, 0xffffffdc
jno 0x4e4de8
pushfd
xor ebx, ebx
add esp, 4
jo 0x480ad7
pushfd
add edx, eax
bt di, 0xb
mov dword [ebp - 8], esi
bt cx, di
clc
call fcn.00508287

Function at 0x4f4423
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], edx
push 0xb19b97a4
push 0xc6f12c71
call fcn.0051afdb

Function at 0x4f49fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
mov dword [ebp - 4], ebx
mov byte [esp], 0x9b
jmp 0x4fc924
cmp ebx, edx
jmp 0x4e422d
push ebp
lea esp, [esp + 0x34]
jl 0x4b9776

Function at 0x508287
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], ebx
clc
test edx, edx
pushfd
pushfd
push esi
mov byte [esp + 4], 0x32
lea esp, [esp + 0x14]
jle 0x5003ee
jmp 0x495b4b

Function at 0x50ccb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov esi, dword [esp + 4]
xchg al, ch
bswap dx
mov ebx, dword [esp + 8]
bswap eax
bswap edx
pop edx
pop edx
mov edx, dword [ebp + 0x14]
mov byte [esp], ch
not ch
pushfd
mov eax, dword [ebp + 0x10]
mov byte [esp], 5
sets ch
mov byte [esp + 4], bl
setp ch
mov ecx, dword [ebp + 0xc]
pushfd
push dword [esp]
jmp 0x4fdd4d
pushal
pushal
pushfd
jmp 0x4e5bfb
pushfd
inc ebx
pushfd
bt sp, 7
pushfd
add eax, ecx
push dword [esp + 8]
cmc
cmc
cmp ebx, eax
mov byte [esp + 8], 0xe9
mov dword [ebp - 4], ebx
pushfd
pushfd
push 0xcd0e67c2
lea esp, [esp + 0x1c]
jl 0x4e1fa3
movzx di, cl
jl 0x5122ac
lahf
pop edi
xchg si, bx
jmp fcn.004af225
mov byte [esp + 8], cl
lea esp, [esp + 0x44]
jl 0x4e1fa3
jmp 0x527a94
mov dword [ebp - 4], ebx
mov word [esp], 0xdcfa
jmp 0x4e42be
pushfd
mov dword [esp + 0x10], edx
jmp 0x51c413
lea esp, [esp + 8]
jl 0x4b3234
inc ebx
cmp al, 0xe9
cmp al, 0xaa
cmc
pushfd
add eax, ecx
test bh, cl
push dword [esp]
cmp ebx, eax
lea esp, [esp + 8]
jg 0x4a6eed
push ebp
mov byte [esp], dh
pushfd
mov dword [ebp - 4], ebx
pushfd
call fcn.004f041e
cdq
not di
pushal
mov edi, dword [esp + 0x20]
setae cl
rdtsc
mov esi, dword [esp + 0x24]
rdtsc
cwde
pop eax
mov ebx, dword [esp + 0x24]
xchg dl, al
xchg ah, cl
jmp fcn.004dacf6
pushfd
pushal
pushfd
mov dword [esp + 0x34], eax
pushfd
mov dword [esp + 0x34], ecx
pushfd
mov dword [esp + 0x34], 0x4a854a
pushfd
jmp 0x51c652
push dword [0x4600b0]
pop dword [esp + 0x34]
mov byte [esp], 0x5d
pushfd
push dword [esp + 0x38]
ret 0x3c
pop edi
cwde
jmp 0x47f1d2

Function at 0x51074a
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x10], 0x9ce3
lea esp, [esp + 0x14]
jne 0x5195db
Function at 0x754eaf5f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
test eax, eax
je 0x755221ef
mov ebx, dword [eax]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 0xc]
cmp edi, eax
jne 0x754eb2ec
pop edi
pop esi
pop ebx
pop ebp
ret 8
test eax, eax
jne 0x754edc9c
mov dword [esi + 4], edi
test edi, edi
je 0x754eaf84
push edi
push ebx
call fcn.754eb310
jmp 0x754eaf84
invalid
add dword [0xde238bf5], ebx
stosb byte es:[edi], al
jbe 0x754edca5
pushfd
jno 0x754edc47
aas
lea esi, [ebx + 0x184f7836]
inc ebx
or cl, byte [ecx]
dec edx
sub esi, ecx
mov bl, byte [edx - 0x2f6724ff]
mov bh, 0x34
aas
invalid
xor eax, 0x35d135c4
xor byte [esi], dh
jae 0x7552222e
test byte [esi], dh
invalid

Function at 0x754ffb07
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
sahf
jbe 0x754ffb17
invalid
test dh, bl
pop es
add eax, 0xc1f1a2c0
cmp eax, 0x8a2fcf1f
adc al, 0x35
lodsb al, byte cs:[esi]
imul ebx, dword [esp + ecx], 0xffffff82
outsb dx, byte [esi]
and al, 0x82
ror byte [0xae71ed94], 1
salc
adc eax, 0x121d64e0
cmpsb byte [esi], byte es:[edi]
sbb eax, 0xd856d9c5
clc
and ebp, esp
xchg ecx, eax
and dword [edi + 0x3e], esp
mov ah, byte [edx + 0x30]
pushfd
add byte fs:[ecx + 3], dl
pushal
test ebp, eax
sbb eax, 0x1766571c
int 0xaa
sub al, 0x1a
sub al, 0x1f
fcom dword [edi]
test dword [ebx + ebx], ecx
dec ebp
xor edi, esp
dec edx
lodsb al, byte [esi]
inc esp
daa
cmp dword [esi + 0x605b1a07], 0x6ef2de91
pop esp
sub byte [ecx - 0x1be9f496], ah
add dword [esi], esp
sub dh, byte [ecx]
jne 0x754ffb37
inc ecx
invalid
Function at 0x7556209f
Capabilities:
Check http status code

Disassembly:
xor ecx, eax
xor esp, ecx
xor esi, ebx
xor eax, dword [edi]
xor al, 0x1b
xor al, 0x39
xor al, 0x8e
xor al, 0xa9
xor al, 0xfa
xor al, 0x21
xor eax, 0x354e3542
sal dword [0x361e35d2], 0x4f
jle 0x755620f8
mov esp, 0x5b370a36
aaa
mov eax, dword [0xf037bf37]
aaa
xchg edx, eax
cmp ah, bl
cmp bh, ch
cmp byte [edx], al
cmp dword [ebx], edx
cmp dword [0x68395439], edi
cmp dword [edx + 0x839f939], esi
cmp cl, byte [esi]
cmp ah, byte [eax]
cmp bh, byte [edi]
cmp dl, byte [edi + 0x3a]
pop ebp
cmp dh, byte [edi + 0x3a]
fstp xword [edx]
int1
cmp dh, bh
cmp cl, byte [ecx]
cmp ebx, dword [esi]
push ds
cmp ecx, dword [ebx + 0x3b]
pop edi
cmp edx, dword [ebx - 0x4ac460c5]
cmp edx, ecx
cmp ebx, ebp
cmp ebp, edi
cmp edi, ebp
cmp eax, dword [esp + edi]
push cs
cmp al, 0x13
cmp al, 0x2f
cmp al, 0x52
cmp al, 0xb8
cmp al, 0xc8
cmp al, 0xd0
cmp al, 0xe0
cmp al, 0xe5
cmp al, 4
cmp eax, 0x3d1c3d14
sub al, 0x3d
xor dword [0x3df33d98], edi
or al, 0x3e
pop ss
je 0x75562172
test byte [esi], bh
invalid
cld
xor esi, dword [ebp + 0x34]
push ss
xor eax, 0x359a353a
loopne 0x755621b3
das
xor byte ss:[esi], 0xdc
add dword ss:[edi], esi
push esp
aaa
jno 0x755621c1
mov ah, 0x37
mov ebx, 0xc937c237
aaa
cmp bh, byte [ecx]
cmp dword [si - 0x40c7], edx
cmp eax, ebx
cmp edx, esp
cmp esp, ebp
cmp ecx, esi
cmp edx, eax
cmp bl, cl
cmp ah, bl
cmp ch, cl
cmp ah, byte [ebx + edi + 0x3bfb3bd6]
sbb eax, 0xb03c313c
cmp al, 0xb0
cmp al, 0xd1
cmp al, 0x83
cmp eax, 0x3d9f3d96
movsd dword es:[edi], dword [esi]
cmp eax, 0x3df53dbe
invalid
cmp eax, 0x3dff3df5
or dword [esi], edi
sbb byte [esi], bh
mov edi, dword [esi]
test al, 0x3e
mov al, 0x3e
mov eax, 0x463ee03e
aas
dec ebx
aas
push edx
aas
invalid
Function at 0x10008060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
push 0x11
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.1004c280
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100080e9
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.1004c260
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x10
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.1004c280
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000815b
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.1004c260
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x12
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0xc4
call fcn.1004c280
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100081cd
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.1004c260
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100081d5
mov esp, ebp
pop ebp
ret
Function at 0x10015682
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x5c]
mov dword [ebp - 4], eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100156d4
mov eax, 0x1005c03e
jmp 0x10015798
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fmul qword [0x1005c015]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x1005c015]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.10001fa4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.1004bef0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1001572b
push ebx
call fcn.1004b142
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x1005bfcf]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.10001fa4
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10015754
add eax, 8
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10015779
mov eax, 0x1005c03e
jmp 0x10015798
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10015793
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1004b13c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10015798
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100157a9
push ebx
call fcn.1004b142
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c040
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.1004da96
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1004c0aa
push esi
lea edi, [eax + 0x400]
call fcn.1004da8b
push edi
call fcn.1004da96
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1004c07a
push esi
xor edi, edi
call dword [0x1005f648]
add esp, 4
test eax, eax
je 0x1004c0c6
push eax
push esi
call fcn.1004d680
add esp, 8
mov edi, eax
push esi
call fcn.1004da8b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1004d010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x1004d031
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1004d08b
inc edi
cmp edi, esi
jl 0x1004d025
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x1004d0c0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1004d07a
cmp byte [eax], bl
je 0x1004d095
cmp byte [eax + 1], bl
je 0x1004d09e
cmp byte [eax + 2], bl
je 0x1004d0a8
cmp byte [eax + 3], bl
je 0x1004d0b4
add eax, 4
cmp eax, edi
jb 0x1004d051
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x4033a8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404ff4
test esi, esi
jne 0x4033de
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004050e4
jmp 0x4033fc
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004032ac
mov edi, eax
test esi, esi
je 0x4033fc
cmp dword [ebx], 0
je 0x4033fc
dec esi
jmp 0x4033e5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x495020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404058
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404038
xor eax, eax
push ebp
push 0x404031
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404074
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404038
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x495020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x495020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404e74
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49804c], 0
je 0x404ed5
cmp word [0x498220], 0xd7b2
jne 0x404e9d
cmp dword [0x498228], 0
jbe 0x404e9d
mov eax, 0x49821c
call dword [0x498238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404efc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49502c], 0
jne 0x404ef1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4066c4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4068f4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406747
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4068f4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406747
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406910
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4067d0
xor eax, eax
push ebp
push 0x4067c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406500
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4067ae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406930
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4067ae
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067d0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4068ea
cmp byte [ebp - 0xd], 0
jne 0x406817
cmp byte [ebp - 0x12], 0
je 0x4068ea
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406830
dec ebx
cmp byte [ebx], 0x2e
je 0x40683f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40682f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4068ea
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40687c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4068ea
cmp byte [ebp - 0xd], 0
je 0x4068ea
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4068ea
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret