joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e960
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x45eb35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x5c]
call fcn.0045e880
xor eax, eax
push ebp
push 0x45ea0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x5c], 0x3c
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004058b0
push eax
call sub.wininet.dll_InternetCrackUrlA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x4c]
call fcn.00405618
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x40]
call fcn.00405618
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x38]
call fcn.00405618
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x30]
call fcn.00405618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ea13
lea eax, [ebp - 0x5c]
call fcn.0045e900
ret

Function at 0x45f314
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xffffffc4
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a6c
mov eax, dword [ebp + 8]
push eax
call fcn.0045eea8
pop ecx
xor eax, eax
push ebp
push 0x45f39c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov dword [eax - 0x3c], 0x3c
mov eax, dword [ebp + 8]
add eax, 0xffffffc4
push eax
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
call fcn.004058b0
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp + 8]
add eax, 0xffffffc0
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
call fcn.00405618
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
mov edx, dword [ebp + 8]
mov dword [edx - 0x44], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f3a3
mov eax, dword [ebp + 8]
push eax
call fcn.0045ef30
pop ecx
ret

Function at 0x460750
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
call fcn.0046032c
test al, al
jne 0x46076f
mov dword [ebp - 4], 2
jmp 0x4607f1
xor eax, eax
mov dword [ebx + 0x45], eax
mov dword [ebp - 0xc], 0x10000
mov eax, dword [ebp - 0xc]
call fcn.00402f00
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4607ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x30]
mov eax, dword [eax*4 + 0x492fe8]
push eax
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
mov dword [ebx + 0x45], esi
test esi, esi
jne 0x4607c0
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 4], eax
jmp 0x4607d4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00460678
mov eax, ebx
call fcn.00460920
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4607f1
mov eax, dword [ebp - 8]
call fcn.00402f1c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x460920
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x460928
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x460ab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
cmp byte [edi + 0x30], 0
jne 0x460955
xor esi, esi
jmp 0x460a08
movzx ebx, byte [edi + 0x30]
cmp bl, 1
je 0x460963
cmp bl, 2
jne 0x46099d
lea eax, [ebp - 0xc]
movzx edx, bl
mov edx, dword [edx*4 + 0x492fe8]
call fcn.00405618
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.00409124
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0x66]
call fcn.00409124
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004059fc
dec eax
jne 0x460a08
xor esi, esi
jmp 0x460a08
cmp bl, 3
jne 0x460a08
lea eax, [ebp - 0x14]
mov edx, dword [0x492fec]
call fcn.00405618
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.00409124
lea eax, [ebp - 0x18]
mov edx, dword [0x492ff0]
call fcn.00405618
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.00409124
lea edx, [ebp - 0x1c]
mov eax, dword [edi + 0x66]
call fcn.00409124
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004059fc
dec eax
je 0x460a08
lea edx, [ebp - 0x20]
mov eax, dword [edi + 0x66]
call fcn.00409124
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004059fc
dec eax
je 0x460a08
xor esi, esi
test esi, esi
je 0x460a9b
mov eax, edi
call fcn.00460890
mov esi, eax
test esi, esi
jne 0x460a9b
mov esi, 1
mov eax, dword [edi + 0x66]
call fcn.004058b0
push eax
call sub.kernel32.dll_OutputDebugStringA
movzx eax, byte [edi + 0x30]
cmp al, 1
je 0x460a3c
cmp al, 2
jne 0x460a93
lea edx, [ebp - 0x24]
mov eax, dword [edi + 0x66]
call fcn.00409124
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004059fc
dec eax
jne 0x460a59
xor esi, esi
jmp 0x460a93
cmp byte [edi + 0x30], 3
jne 0x460a93
lea edx, [ebp - 0x28]
mov eax, dword [edi + 0x66]
call fcn.00409124
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004059fc
dec eax
je 0x460a93
lea edx, [ebp - 0x2c]
mov eax, dword [edi + 0x66]
call fcn.00409124
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.004059fc
dec eax
je 0x460a93
xor esi, esi
test esi, esi
jne 0x460a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460abd
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00405444
ret
Function at 0x47b41c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b560
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405474
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00409124
mov edx, dword [ebp - 0x4c]
mov eax, 0x47b574
call fcn.004059fc
test eax, eax
jle 0x47b53d
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a6c
lea eax, [ebp - 0x48]
call fcn.0044817c
xor eax, eax
push ebp
push 0x47b536
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x48], 0x3c
lea eax, [ebp - 0x48]
push eax
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
call fcn.004058b0
push eax
call sub.wininet.dll_InternetCrackUrlA
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 0x38]
call fcn.00405618
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0xc]
call fcn.00447a58
mov al, byte [0x47b584]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edx, 0x47b590
call fcn.0040e79c
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 8]
call fcn.00405474
mov al, byte [0x47b584]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edx, 0x47b574
call fcn.0040e79c
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 8]
call fcn.00405474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b53d
lea eax, [ebp - 0x48]
call fcn.0044828c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b567
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405444
lea eax, [ebp - 0xc]
call fcn.00405420
ret
Function at 0x47fc04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47fe63
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebp
push 0x47fe3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.004054b8
mov edx, dword [ebp - 0x14]
mov eax, 0x47fe7c
call fcn.004059fc
test eax, eax
jne 0x47fc6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fe48
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x47fe2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
push 0x47fe88
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x47fcb0
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fe48
xor eax, eax
push ebp
push 0x47fd1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 0x1f4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x225]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x47fe9c
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x47fd04
call fcn.00404dd8
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fe48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fd22
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fe6a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405444
ret

Function at 0x482c2c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x482c5a
mov eax, ebx
call fcn.004836d0
cmp dword [ebx + 0x3c], 0
je 0x482c53
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x482ccb
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x482cbd
cmp dword [ebx + 8], 0
je 0x482c7c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x482c8e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x482cbd
cmp dword [ebx + 8], 0
je 0x482c6f
cmp eax, 3
je 0x482ca1
dec eax
jne 0x482c6f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x482c6f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x482c6f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x482ce9
cmp dword [ebx + 0x10], 0xcc
je 0x482ce9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00482cf4
pop ebx
ret
Function at 0x4649ed
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xb3233f88
cmp ebp, dword [edx + 0x53f2b5be]
mov ch, 0xf2
push ebx
xor dword [edx - 0x18], eax
jbe 0x4649f5
add al, byte [esi + 0x4e386cf1]
add eax, 0x8cfe8c99

Function at 0x466994
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x5bf6a113
and dword [ecx + 0x38ed1411], esp
call 0xdd4c9d8b
and dl, 0x86
test eax, 0x9444707f
adc ebx, dword [ebx - 0xf]
cmpsb byte [esi], byte es:[edi]
mov bh, 0xec
enter 0xffffffffffffcae4, 0x52
xchg edx, eax
das
pushal
imul esi, dword [ecx + 0x5e], 0xe
nop
je 0x4669af
outsd dx, dword [esi]
mov dword [0xb65413ce], eax
adc dword [ebx], eax
inc edx
xor byte [esi], dh
popal
invalid
jl 0x466907
push eax
les ecx, [0xa26217e8]
mov edx, 0xac027370
insb byte es:[edi], dx
xor dh, byte [edi]
mov al, byte [0xb158823a]
jmp 0x4669c6
cmp dl, al
adc bl, bl
xchg esp, eax
aas
jb 0x4669cf
dec ebp
pop esi
invalid
push esp
sub al, byte [esi - 0x727bc18e]
adc al, 0xea
movsb byte es:[edi], byte [esi]
js 0x466949
inc edi
jg 0x466a05
push ecx
mov eax, 0x5954d940
sbb ebp, ebx
lcall 0xb17c, 0x83e1a370
or eax, 0xc4468d2e
cmp dword [ecx + esi*4 + 0xd], 0x2e
lea eax, [esi - 0x3c]
jae 0x4669bf
in al, dx
popal
jecxz 0x466974
xlatb
shr byte [ebp - 0x4e], 1
lodsd eax, dword [esi]
insd dword es:[edi], dx
mov dl, 0xad
invalid
invalid
Function at 0x4691b2
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
sbb dword [eax], esi
aam 0x3c
sbb eax, 0xae8f9a61
cmc
invalid
das
mov al, 0x23
mov dl, 0xdf
cmp byte [ecx], 0x48
test byte [ebp - 0x508a88d7], 0xc
test al, 0x29
jb 0x4691bb
lea ebp, [ecx]
ja 0x469234
scasd eax, dword es:[edi]
or al, 0xa8
sub dword [edx - 0xa], esi
cmp byte [ebp - 0x7b], dh
jnp 0x4691f7
cld
jns 0x469152
cmp al, 0xd6
fnsave dword [esp + ebp + 0x12]
enter 0xffffffffffff962b, 0xffffffffffffffd9
retf
pop ebx
sbb dword [eax], ebx
clc
pop edi
push 0xffffffffffffffb8
and esi, dword [edi + 0x34]
outsd dx, dword [esi]
aas
sahf
pop edx
adc ecx, ecx
mov al, byte [0xf2e3e869]
sbb ah, byte [ecx - 0x24]
loopne 0x46928b
lds edi, [edx + edx*8 - 0x52c68840]
add eax, 0x60210ada
call 0x1a05b169
jg 0x4691b7
cmp dh, ch
jmp edx
insb byte es:[edi], dx
cmp al, 0x94
outsb dx, byte [esi]
mov edi, 0xf92f959a
mov al, byte [0x889f9d6c]
push ecx
aad 0xe5
add byte [ebx - 0x71], al
pop eax
jbe 0x4691fb
jl 0x4692b0
jle 0x4692cc
out dx, eax
xchg edx, eax
inc edx
mov eax, 0xabb4947e
or esp, edi
cli
sahf
lcall 0xf9d7, 0xc11a68d0
add eax, 0x7010ab77
xor dword [esi - 0x7c], 0xffffff9e
daa
sub byte [esi + esi], ch
imul esi, dword [ebx + 0x411c9a11], 0x58599c78
mov al, byte [ecx + esi*8]
pop ecx
cmp al, 0xc1
dec esp
mov ah, 0xba
sub al, 0x7b
inc ebp
test eax, 0x4f943b83
dec edi
sub dword [ebx - 0x320f8abf], 0x12eb7586
xor eax, 0x93cc99de
test byte [ebx + edx*8 - 0x4f], cl
invalid
jo 0x4692db
xor dword [edi], 0x634f98be
sub bl, byte [esi - 0x4d382e31]
out 0x58, eax
mov eax, 0x3f8fbe49
neg byte [ebp + 0x72]
cmp byte [edx + 0x5e], ch
cwde
push es
cmp dword [ecx + 0x2e], 0x76959502
lds edi, [eax + 0x1f]
jb 0x469284
pop ds
cld
cmp al, byte [edx - 0x3a]
add al, 0xbd
dec esi
or bh, byte [edx + 0x54]
push edx
pop ebp
push edx
xlatb
mov dl, 0xb0
pushfd
adc al, 0x73
sub al, 0x50
cmp esi, dword [esi + ebx + 0x3bb2a135]
push edi
pushal
xor edi, dword [esi]
ljmp 0x400b

Function at 0x47a328
Capabilities:
Encode data using xor

Disassembly:
adc edx, dword [ebx + 0x73]
invalid
clc
mov bh, 0xdc
or esp, eax
jp 0x47a2fd
jns 0x47a358
push edx
invalid
pushal
je 0x47a3b3
in al, dx
sar dword [ecx + 0x48790586], 1
rol dword [ecx], 0xab
pushfd
mov dh, 0xc8
cmp byte [eax - 0x449b789c], 0x95
xchg dword fs:[ebx + edi*4 - 0x6b], esp
jnp 0x47a39a
xor al, 0x39
push ebp
adc al, 0xd8
sbb eax, 0x59ad552
push ebx
adc al, 0xeb
test dword [edx + ebx*8 + 0x658bea26], esi
fcom st(1)
mov ecx, 0xaeade6c6
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
clc
pop edi
xlatb
jl 0x47a36a
ror dword [edi - 0x1a], 0xc7
sub esi, dword [eax - 0x482320]
jl 0x47a325
mov al, 0xe0
fdiv qword [edi + 0x44847cff]
inc esp
test eax, 0x4c2f05cd
inc esi
salc
invalid
movsb byte es:[edi], byte [esi]
or bh, byte [ecx + 0x15344531]
mov ch, 0xa3
invalid
Function at 0x47b651
Capabilities:
Encode data using xor

Disassembly:
sbb dh, byte [edx + 0xe]
invalid
fisub word [edi]
lcall 0xe052, 0xc5d85b91
scasb al, byte es:[edi]
add bl, byte [ebp + 0x5a]
mov eax, esi
and byte [edx + 0x2c], cl
lock and byte [edx + 0x2c], cl
pop esp
loope 0x47b65f
out dx, al
pop edi
enter 0x1c07, 0xffffffffffffffdf
sub esp, edi
xor eax, 0xfe230663
push ds
arpl word [edx], bp
lcall 0xe27d, 0xae9e8465
cli
dec esp
or byte [edx - 0x28], dl
jno 0x47b60c
das
jno 0x47b6c3
sal byte [ecx], 0x6f
push eax
and esp, dword [ebx - 0x45]
add ebp, dword [eax]
mul esi
inc esi
jo 0x47b6f9
js 0x47b6d7
stc
jns 0x47b675
insd dword es:[edi], dx
fimul word [edi - 0x692ec0a4]
adc dword [edi + 0x48d5a5f], eax
sub ah, byte [edi - 0x3d]
salc
imul esp, dword [ecx - 0x48], 0x4c
ret 0xa25d
ljmp 0x9911:0x66e83596
les ebx, [ebx - 0x69a8a58f]
pop eax
loopne 0x47b726
push ss
sbb bh, ch
mov ebp, 0xe315230
pop ds
pop ecx
ret
dec esp
or byte [esi + 0x292e341b], ah
test byte [eax], bl
outsb dx, byte [esi]
jns 0x47b726
xor al, 0x2e
sub dword [eax + ebx - 0x78da8692], eax
scasb al, byte es:[edi]
in eax, dx
sub edx, dword [eax - 9]
xchg dword [esi - 0x8afd413], ebp
or ebp, dword [edi - 0x2b]
xbegin 0xd553f10a
push 0xffffffffffffff83
lodsd eax, dword [esi]
leave
sub eax, 0xd834db8f
xor dh, bh
insb byte es:[edi], dx
arpl word [ecx + ecx*2 + 0x5e], bp
jo 0x47b6f4
xor ax, 0xc975
and byte [edx + 0x74], ah
sahf
mov ecx, 0x5ea69581
fist word [edi]
sub ah, bl
pop eax
and eax, 0x2e9cef24
pop ebp
shr dword [ebx], cl
lahf
dec edx
invalid

Function at 0x486205
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7be0d9e7
inc ebx
lodsd eax, dword [esi]
xor ebx, dword [edi]
xor eax, 0x750a4ed3
aad 0x23
inc esi
cmp byte [ebp - 0x2199cecb], cl
test dl, al
mov dh, 0xed
sub esp, dword [ecx - 0x4d30f5c]
test eax, 0x7d8580ce
insd dword es:[edi], dx
invalid

Function at 0x4864df
Capabilities:
Encode data using xor

Disassembly:
push esi
xchg ebp, eax
and byte [eax], ah
inc edi
adc al, 0xad
in eax, 0xa7
outsb dx, byte [esi]
or eax, 0xdd669463
xchg ebp, eax
enter 0x7fd9, 0xffffffffffffffb6
std
xlatb
push esi
inc esp
scasd eax, dword es:[edi]
jge 0x48651d
sar dword [esi], cl
dec ebx
mov esp, 0xf7171f33
dec ebx
in eax, 0x51
jae 0x486565
cmp byte [ebx - 0x2b58f81b], cl
mov edx, 0xe813205a
cmpsd dword [esi], dword es:[edi]
aas
retf
xor ah, 0xb7
ret
xlatb
pop ss
sal ebx, cl
and esp, ecx
mov ch, byte [esi + 0x5ff348d9]
mov dh, 0x78
mov al, byte [0x8062dd40]
mov dh, 0x98
add edx, dword [esi - 0x80]
or al, 0xe0
sbb byte [ecx + 0x1a], 0x94
std
cld
mov dl, byte [eax]
xor dword [eax + 0x1d1fb1d7], edx
mov ebp, 0x4bec5735
xchg esp, eax
xor dword [ecx - 0x5a], esp
add bl, dl
test al, 0xad
invalid

Function at 0x48d4a8
Capabilities:
Encode data using xor

Disassembly:
inc esi
xchg ecx, eax
lcall 0x142a, 0x524aae32
and dword [edx], ebx
out dx, eax
push edx
sub dl, byte [ecx]
sbb ch, bh
xor al, 0x76
mov fs, ecx
xchg edx, eax
enter 0xfffffffffffffba4, 1
mov esp, 0x693107b7
pop edi
push 0xffffffffffffff9f
jo 0x48d4ae
invalid
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x126c0f90
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x65c46f71
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402ec4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402f1d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d60
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d60
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402f07
inc ebx
jmp 0x402ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f24
lea eax, [ebp - 8]
call fcn.0040519c
ret

Function at 0x402f2c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040519c
test esi, esi
jne 0x402f63
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.0040528c
jmp 0x402f84
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d60
mov dword [esp], eax
test esi, esi
je 0x402f84
cmp dword [ebx], 0
je 0x402f84
dec esi
jmp 0x402f6b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403628
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x40363e
sub ecx, 2
jne 0x403660
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x403667
cmp edx, dword [ebx + 8]
je 0x403671
mov eax, 0x64
jmp 0x40366c
mov eax, 0x67
jmp 0x40366c
call sub.kernel32.dll_GetLastError
call fcn.00402ca0
pop ebx
ret

Function at 0x40412c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f5020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4041c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4041a4
xor eax, eax
push ebp
push 0x40419d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4041e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4041a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4f5020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f5020], ax
mov esp, ebp
pop ebp
ret
Function at 0x405018
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f704c], 0
je 0x405079
cmp word [0x4f7220], 0xd7b2
jne 0x405041
cmp dword [0x4f7228], 0
jbe 0x405041
mov eax, 0x4f721c
call dword [0x4f7238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4f5098
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4050a0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4f5030], 0
jne 0x405095
push 0
push 0x4f5090
push 0x4f5098
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4075a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x407606
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040541c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403a84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4075f0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40760d
lea eax, [ebp - 0x10]
call fcn.0040519c
ret