joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101d440f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101d4ecd
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x101d444b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x10208938], 0x370c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x10208934], 0x1fed
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x101d44b9
jmp 0x101d4566
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x10208934], 0x1415
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x39]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x40]
add edx, 1
mov ah, byte [ebp - 0x41]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x48], edx
jne 0x101d451c
mov al, byte [ebp - 0x41]
test al, 1
jne 0x101d4496
jmp 0x101d44f6
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x4c]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edx
jb 0x101d454a
jmp 0x101d44b9
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x58]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x39], bh
mov byte [ebp - 0x41], cl
je 0x101d44ed
jmp 0x101d44c4
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x48], edx
jmp 0x101d451c
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
jmp 0x101d454a
Function at 0x101d4578
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x10208938]
add edi, 0x53c
mov dword [0x10208938], edi
mov dword [0x10208940], 0
mov byte [0x10208944], 0
mov dword [0x1020893c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101d467d
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10208948], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x10208940]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10208948], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x10208940], edx
mov dword [0x10208934], 0x918
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10208944], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x10208934], 0x16c8
mov cl, byte [0x10208944]
mov esi, dword [0x10208940]
mov byte [ebx + esi], cl
mov esi, dword [0x1020893c]
add esi, 1
mov dword [0x1020893c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x101d45ca
mov dword [0x10208934], 0x26c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov dword [0x10208938], 0x1e35
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10208938]
add eax, 0x325
mov dword [0x10208938], eax
mov eax, dword [0x1020893c]
add eax, 1
mov dword [0x1020893c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101d467d
mov dword [0x10208934], 0x182
xor eax, eax
mov dword [0x1020893c], 0
mov dword [ebp - 0x20], eax
jmp 0x101d45ca
Function at 0x101d46da
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101d471d
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jge 0x101d4733
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x101d4706
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x101d4760
jmp 0x101d474f
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
xor eax, eax
mov dword [0x10208934], 0x982
mov dword [ebp - 0x20], eax
jmp 0x101d4747
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101d474f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101d474f
mov eax, dword [0x10208934]
add eax, 0xfffff36e
mov dword [0x10208934], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff6
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x64
jne 0x101d474f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x101d474f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101d474f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x101d4747
jmp 0x101d474f
Function at 0x101d4b51
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1020893c], 0
mov dword [0x10208940], 0
mov dword [0x1020894c], 0
mov dword [0x10208934], 0x53e
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x101d4ca1
jmp 0x101d4bcd
mov eax, dword [0x10208940]
mov ecx, dword [0x1020893c]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x10208938], 0xb88
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1020893c], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10208940], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10208944], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x10208934]
add edx, 0x20cc
mov dword [0x10208934], edx
mov cl, byte [0x10208944]
mov edx, dword [0x10208940]
mov byte [edi + edx], cl
mov edx, dword [0x1020893c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10208940]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1020894c], ebx
mov dword [0x10208934], 0x395
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
jne 0x101d4bb6
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d4d9b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x10208938]
mov edi, esi
add edi, 0xffffdf43
mov dword [0x10208934], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edx
jmp 0x101d4e67
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.101d4ca9
mov eax, dword [ebp - 0x40]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xc0
mov dword [eax + 0xc0], 0x4550
add eax, 0xffc00000
mov dword [0x10208934], 0x21cb
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x40], eax
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x26ba
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x40]
mov dword [edx + 0x3c], esi
cmp esi, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x101d4e5d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x54
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov cl, byte [eax + 0x101d6624]
mov dl, byte [eax + 0x101d65f5]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x38], eax
jne 0x101d4e67
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffe336
mov dword [0x10208938], ecx
mov dword [ebp - 0x4c], eax
call fcn.101d47e4
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
call fcn.101d50f9
cmp eax, 0
mov dword [ebp - 0x3c], eax
jne 0x101d4dd0
xor eax, eax
add esp, 0x54
pop esi
pop edi
pop ebp
ret
Function at 0x401168
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xffffffbc
mov ebx, 0xa
push esp
call sub.kernel32.dll_GetStartupInfoA
test byte [esp + 0x2c], 1
je fcn.00401183
jmp loc.00419750

Function at 0x4011cc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, 0x40c5d0
cmp dword [esi], 0
jne 0x401212
push 0x644
push 0
call sub.kernel32.dll_LocalAlloc
mov ecx, eax
test ecx, ecx
jne 0x4011ef
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x40c5cc]
mov dword [ecx], eax
mov dword [0x40c5cc], ecx
xor edx, edx
mov eax, edx
jmp loc.0041ac10
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x4012dc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov edi, ebx
mov esi, dword [edx]
mov eax, dword [ebx + 8]
cmp esi, eax
jb 0x401360
mov ecx, esi
add ecx, dword [edx + 4]
mov ebp, eax
add ebp, dword [ebx + 0xc]
cmp ecx, ebp
ja 0x401360
cmp esi, eax
jne 0x40131d
mov eax, dword [edx + 4]
add dword [ebx + 8], eax
mov eax, dword [edx + 4]
sub dword [ebx + 0xc], eax
cmp dword [ebx + 0xc], 0
jne 0x40135c
mov eax, ebx
call fcn.00401254
jmp 0x40135c
mov ecx, esi
mov edi, dword [edx + 4]
add ecx, edi
jmp 0x41940e
mov al, 1
jmp 0x401368
mov ebx, dword [ebx]
cmp edi, ebx
jne 0x4012e7
xor eax, eax
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b7c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
xor edi, edi
mov eax, dword [ebx]
test eax, 0x80000000
je 0x401b97
and eax, 0x7ffffffc
add edi, eax
add ebx, eax
mov eax, dword [ebx]
test al, 2
jne 0x401bae
mov esi, ebx
mov eax, esi
call fcn.004019fc
mov eax, dword [esi + 8]
add edi, eax
jmp 0x414b28
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x401c64
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov ebx, edi
mov dword [ebx + 8], esi
mov eax, ebx
add eax, esi
sub eax, 0xc
mov dword [eax + 8], esi
cmp esi, 0x1000
jg 0x401cb9
mov edx, esi
test edx, edx
jns 0x401c8b
add edx, 3
sar edx, 2
mov eax, dword [0x40c60c]
mov eax, dword [eax + edx*4 - 0xc]
test eax, eax
jne 0x401cab
mov eax, dword [0x40c60c]
mov dword [eax + edx*4 - 0xc], ebx
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
jmp 0x401ce5
mov edx, dword [eax]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
jmp 0x401ce5
cmp esi, 0x3c00
jl 0x401cce
mov edx, esi
mov eax, edi
call fcn.00401bb4
test al, al
jne 0x401ce5
mov eax, dword [0x40c600]
mov dword [0x40c600], ebx
mov edx, dword [eax]
mov dword [ebx + 4], eax
mov dword [ebx], edx
jmp 0x414ba2
pop edi
pop esi
pop ebx
ret

Function at 0x401cec
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x40c604], 0
jle 0x401d35
cmp dword [0x40c604], 0xc
jge 0x401d0a
mov dword [0x40c5b0], 7
jmp 0x401d35
mov eax, dword [0x40c604]
or eax, 2
mov edx, dword [0x40c608]
mov dword [edx], eax
mov eax, dword [0x40c608]
add eax, 4
call fcn.00401ac0
xor eax, eax
mov dword [0x40c608], eax
xor eax, eax
jmp 0x416028
ret
Function at 0x402518
Capabilities:
Packed with generic packer

Disassembly:
push ebx
test eax, eax
jle 0x402532
call dword [0x40b030]
mov ebx, eax
test ebx, ebx
jne 0x402534
mov al, 1
jmp loc.0041a02f
xor ebx, ebx
mov eax, ebx
pop ebx
ret

Function at 0x402600
Capabilities:
Packed with generic packer

Disassembly:
and eax, 0x7f
mov edx, dword [esp]
jmp loc.00417c72

Function at 0x402774
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403dcc
test esi, esi
jne 0x4027aa
push 0x105
jmp loc.00413235
jmp loc.004147c7

Function at 0x402ad0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x14c
jmp loc.00417342

Function at 0x402c40
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov ax, word [ebx + 4]
cmp ax, 0xd7b1
jb 0x402c7f
cmp ax, 0xd7b3
ja 0x402c7f
and ax, 0xd7b2
cmp ax, 0xd7b2
jne 0x402c67
mov eax, ebx
call dword [ebx + 0x1c]
mov esi, eax
test esi, esi
jne 0x402c72
mov eax, ebx
call dword [ebx + 0x24]
mov esi, eax
test esi, esi
je 0x402c91
mov eax, esi
call fcn.0040262c
jmp 0x402c91
cmp ebx, 0x40c038
je 0x402c91
mov eax, 0x67
jmp 0x4136ca
mov eax, esi
pop esi
pop ebx
ret

Function at 0x402cb4
Capabilities:
Packed with generic packer

Disassembly:
cmp word [eax + 4], 0xd7b1
jne 0x402cd9
mov edx, dword [eax + 0xc]
cmp edx, dword [eax + 0x10]
jae 0x402cd9
add edx, dword [eax + 0x14]
jmp loc.0041a5b9
mov al, 1
ret
push eax
call fcn.00402db0
pop edx
cmp ah, 0x1a
je 0x402cd6
dec dword [edx + 0xc]
xor eax, eax
ret

Function at 0x402cec
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
mov ax, word [ebx + 4]
cmp ax, 0xd7b0
jbe 0x402d26
cmp ax, 0xd7b3
ja 0x402d26
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetFileSize
jmp loc.0041b05d
jmp loc.00416c68

Function at 0x402d58
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40b008], 0x8088405
inc edx
mov dword [ebx + 0x40b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402ea8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, edx
call fcn.00403dcc
sub esp, 0x100
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.00402e9c
mov eax, esi
mov edx, esp
call fcn.00404020
cmp byte [esp], 0xff
jne 0x402f09
mov eax, ebx
mov edx, esp
jmp loc.00418475
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4030c8
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, edx
xor edx, edx
jmp loc.00416452

Function at 0x4030d4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push eax
test eax, eax
je 0x40314a
xor eax, eax
xor ebx, ebx
jmp loc.00419720
inc esi
jmp 0x403153
pop ebx
sub esi, ebx
jmp 0x40319f
mov dword [edx], esi
pop edi
pop esi
pop ebx
ret
Function at 0x403300
Capabilities:
Packed with generic packer

Disassembly:
push ebx
xor ebx, ebx
push 0
call sub.user32.dll_GetKeyboardType
cmp eax, 7
jne 0x40332b
push 1
call sub.user32.dll_GetKeyboardType
and eax, 0xff00
cmp eax, 0xd00
je 0x403329
jmp loc.00413b4e
mov bl, 1
mov eax, ebx
pop ebx
ret

Function at 0x403330
Capabilities:
Packed with generic packer
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033a8
xor eax, eax
push ebp
push 0x4033a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40b014]
jmp loc.00415763

Function at 0x4033a8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033a8
xor eax, eax
push ebp
push 0x4033a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40b014]
jmp loc.00415763

Function at 0x403468
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.00403473
mov dl, 1
jmp loc.00414807

Function at 0x403558
Capabilities:
Packed with generic packer

Disassembly:
push edx
push ecx
push ebx
test dl, dl
jl 0x403562
call dword [eax - 0xc]
jmp loc.0041a2ee

Function at 0x4035d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40b018], 1
jbe fcn.004035ea
push 0
push 0
push 0
push 0xeedfadf
jmp loc.00417c07

Function at 0x403628
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40b018], 1
jbe 0x403638
push eax
push ebx
jmp loc.00419ea6
ret

Function at 0x4036a0
Capabilities:
Packed with generic packer

Disassembly:
push eax
push edx
cmp byte [0x40b018], 1
jbe fcn.004036bb
push esp
push 2
push 0
push 0xeedfae3
jmp loc.004160b6

Function at 0x4038a8
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
mov ecx, dword [esp + 8]
jmp loc.00414a66

Function at 0x403a00
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
lea eax, [ebp - 0xc]
jmp loc.0041a57b
Function at 0x403bd4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40c034], 0
je 0x403c35
cmp word [0x40c208], 0xd7b2
jne fcn.00403bfd
cmp dword [0x40c210], 0
jbe fcn.00403bfd
mov eax, 0x40c204
jmp loc.0041968e
cmp byte [0x40b020], 0
jne fcn.00403c51
push 0
push 0x40b078
push 0x40b080
push 0
jmp loc.00416168

Function at 0x403d44
Capabilities:
Packed with generic packer

Disassembly:
pop dword [0x40b004]
jmp loc.0041682b

Function at 0x403d88
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402518
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x40c035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403d50
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x403e64
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x403e72
mov ecx, dword [edx - 8]
inc ecx
jle 0x403e72
lock inc dword [edx - 8]
xchg dword [eax], edx
test edx, edx
je 0x403e8c
mov ecx, dword [edx - 8]
dec ecx
jl 0x403e8c
lock dec dword [edx - 8]
jne 0x403e8c
lea eax, [edx - 8]
jmp 0x416777
ret

Function at 0x403e90
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
jle 0x403eb8
push eax
add eax, 0xa
and eax, 0xfffffffe
push eax
jmp loc.00416398
xor eax, eax
ret

Function at 0x403ebc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
mov eax, edi
call fcn.00403e90
mov ecx, edi
mov edi, eax
test esi, esi
je fcn.00403edd
mov edx, eax
mov eax, esi
jmp loc.004188a7

Function at 0x403fe4
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
test edx, edx
je 0x404017
push edx
cmp cx, word [edx]
je 0x404010
cmp cx, word [edx + 2]
je 0x40400d
cmp cx, word [edx + 4]
je 0x40400a
cmp cx, word [edx + 6]
je 0x404007
add edx, 8
jmp 0x403feb
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp 0x41547b

Function at 0x40445c
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x404470
jmp loc.0041a71a
ret

Function at 0x404498
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.004130d2

Function at 0x4047fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404862
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040402c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030d4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40484c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404869
lea eax, [ebp - 0x10]
call fcn.00403dcc
ret