joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x19], 0
je 0x40c34a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x439d20]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1a
jb 0x40c340
mov eax, ecx
ret

Function at 0x40c3f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x40c41a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x439d20]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x12
jb 0x40c410
mov eax, ecx
ret

Function at 0x40c470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x40c482
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x40c478
mov eax, ecx
ret

Function at 0x40cc60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40cd1a
cmp byte [esi + 0x3d], 0
je 0x40cd1a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40cd08
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40ccd0
sub eax, 1
je 0x40ccd4
sub eax, 2
jne 0x40cd08
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f73f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40ccf1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00419188
add esp, 0x10
cmp edi, eax
jne 0x40cd08
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f73f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f73f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040f73f
mov esp, ebp
pop ebp
ret
Function at 0x40ceb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cb60
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x439b88
call fcn.0040f94f
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040ee06
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420983
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004207f9
Function at 0x100054c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
push esi
push edx
push ecx
call fcn.10008002
and dword [esp + 0x28], 0
lea edi, [esi + 4]
mov dword [esp + 0x24], 0xe0903d
mov dword [esp + 0x30], 0x212a03
imul eax, dword [esp + 0x30], 0x27
mov dword [esp + 0x30], eax
shr dword [esp + 0x30], 8
or dword [esp + 0x30], 0x585d2b32
xor dword [esp + 0x30], 0x585a4f08
mov dword [esp + 0x18], 0x2a7ac8
or dword [esp + 0x18], 0x85d0f28f
xor dword [esp + 0x18], 0x85f35d28
mov ecx, dword [esi]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
add esp, 8
mov edx, esi
call fcn.10016f53
mov ebx, eax
mov dword [esp + 0x28], ebx
pop ecx
test ebx, ebx
je 0x100055b7
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x100055ae
mov ebx, dword [esp + 0x14]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x10005585
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x100066c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push dword [esp + 0x3c]
push ebp
push dword [esp + 0x3c]
push edx
push ecx
call fcn.10008002
mov dword [esp + 0x3c], 0xe8d183
xor esi, esi
mov dword [esp + 0x40], esi
add esp, 0x14
mov dword [esp + 0x38], 0x21619
xor dword [esp + 0x38], 0x332129ab
shr dword [esp + 0x38], 4
xor dword [esp + 0x38], 0x33233fb
mov dword [esp + 0x14], 0xb0eb84
shr dword [esp + 0x14], 6
xor dword [esp + 0x14], 0x10752
mov dword [esp + 0x10], 0x722bd8
xor dword [esp + 0x10], 0x10766bce
xor dword [esp + 0x10], 0x100bb5c0
mov eax, dword [ebp + 0x3c]
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov edi, dword [eax + ebp + 0x78]
add edi, ebp
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebp
mov dword [esp + 0x20], eax
add ecx, ebp
mov eax, dword [edi + 0x24]
add eax, ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
jmp 0x1000678b
mov eax, dword [ecx + ebx*4]
mov edx, dword [esp + 0x10]
add eax, ebp
mov ecx, dword [esp + 0x14]
push eax
call fcn.1000948b
xor eax, 0x2fc2921b
pop ecx
cmp eax, dword [esp + 0x3c]
je 0x10006792
mov ecx, dword [esp + 0x18]
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x10006767
jmp 0x100067be
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
movzx eax, word [eax + ebx*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, edi
jb 0x100067be
mov eax, dword [esp + 0x24]
mov eax, dword [eax + ebp + 0x7c]
add eax, edi
cmp esi, eax
jae 0x100067be
mov ecx, esi
call fcn.100235e3
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1000948b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push ebx
push edx
push ecx
call fcn.10008002
and dword [ebp - 0xc], 0
add esp, 0xc
and dword [ebp - 8], 0
xor edx, edx
mov dword [ebp - 0x10], 0x36a500
mov dword [ebp + 8], 0x432d0b
add dword [ebp + 8], 0xffff1d15
mov eax, dword [ebp + 8]
push 0x51
pop ecx
div ecx
mov dword [ebp + 8], eax
imul eax, dword [ebp + 8], 0x52
mov dword [ebp + 8], eax
xor dword [ebp + 8], 0x431b52
mov dword [ebp - 4], 0x802567
imul eax, dword [ebp - 4], 0x61
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x308e2c01
mov dword [ebp - 4], 0x6bd2d4
add dword [ebp - 4], 0xffff696a
xor dword [ebp - 4], 0x6b3c2e
cmp byte [ebx], 0
je 0x1000955d
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0x802567
imul eax, dword [ebp - 4], 0x61
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x308e2c01
mov cl, byte [ebp - 4]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0x6bd2d4
add dword [ebp - 4], 0xffff696a
xor dword [ebp - 4], 0x6b3c2e
shl esi, cl
mov cl, byte [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [ebx]
mov dword [ebp + 8], eax
add dword [ebp + 8], esi
shl edx, cl
add dword [ebp + 8], edx
sub dword [ebp + 8], edi
inc ebx
cmp byte [ebx], 0
jne 0x10009509
pop edi
pop esi
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f8d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push dword [esp + 0x20]
mov ebp, dword [esp + 0x20]
push ebp
push dword [esp + 0x20]
push ebx
push edx
push ecx
call fcn.10008002
mov dword [esp + 0x34], 0x9ed553
add esp, 0x18
shl dword [esp + 0x1c], 0xc
shl dword [esp + 0x1c], 7
xor dword [esp + 0x1c], 0xaa980005
mov ecx, dword [ebx + 0x3c]
mov eax, dword [esp + 0x1c]
add ecx, ebx
sub ebp, dword [ecx + 0x34]
mov edx, dword [ecx + eax*8 + 0x78]
mov dword [esp + 0x1c], ebp
add edx, ebx
mov ebp, dword [ecx + eax*8 + 0x7c]
add ebp, edx
mov dword [esp + 0xc], ebp
cmp edx, ebp
jae 0x1000f97f
push esi
push edi
mov edi, dword [edx + 4]
lea esi, [edx + 8]
add edi, edx
cmp esi, edi
jae 0x1000f976
mov ebp, dword [esp + 0x24]
movzx eax, word [esi]
mov ecx, eax
mov dword [esp + 0x10], 0x3000
and ecx, 0xfff
and eax, 0xf000
add ecx, dword [edx]
add ecx, ebx
cmp ax, word [esp + 0x10]
jne 0x1000f96b
add dword [ecx], ebp
add esi, 2
cmp esi, edi
jb 0x1000f946
mov ebp, dword [esp + 0x14]
add edx, dword [edx + 4]
cmp edx, ebp
jb 0x1000f936
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x10017634
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebp
push edx
push ecx
call fcn.10008002
mov dword [esp + 0x24], 0x6b8c76
add esp, 0x14
mov eax, dword [esp + 0x10]
xor edx, edx
xor esi, esi
push 0x31
pop ecx
div ecx
mov dword [esp + 0x10], eax
imul eax, dword [esp + 0x10], 0xc
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x1a56a4
mov dword [esp + 0x1c], 0xe477a0
imul eax, dword [esp + 0x1c], 0x5f
mov dword [esp + 0x1c], eax
xor dword [esp + 0x1c], 0x54c2b4d4
mov dword [esp + 0x34], 0x703201
shr dword [esp + 0x34], 0xa
add dword [esp + 0x34], 0xffff7f3d
xor dword [esp + 0x34], 0x22f5e817
xor dword [esp + 0x34], 0xdd0a1f86
mov dword [esp + 0x18], 0xe24f2e
add dword [esp + 0x18], 0x6a04
xor dword [esp + 0x18], 0xefee45
mov dword [esp + 0x14], 0x6a1730
add dword [esp + 0x14], 0xffffc38d
shl dword [esp + 0x14], 3
xor dword [esp + 0x14], 0x3433334
mov eax, dword [ebp + 0x3c]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ebx, dword [eax + ebp + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
jmp 0x10017748
push dword [esp + 0x14]
mov eax, dword [ecx + edi*4]
add eax, ebp
push eax
push dword [esp + 0x44]
push dword [esp + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x2c]
call fcn.10017e14
add esp, 0x10
test eax, eax
je 0x1001774f
mov ecx, dword [esp + 0x20]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x1001771d
jmp 0x10017775
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x10017775
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov ecx, dword [ecx + ebp + 0x7c]
add ecx, ebx
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1001834f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
push edi
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edx
push ecx
call fcn.10008002
mov dword [esp + 0x28], 0x3c08fc
add esp, 0x14
shl dword [esp + 0x14], 6
xor edx, edx
or dword [esp + 0x14], 0x810c5e3
xor dword [esp + 0x14], 0xf12ffe2
mov dword [esp + 0x24], 0xa9fbb3
add dword [esp + 0x24], 0x50d4
xor dword [esp + 0x24], 0xa6d57a
mov dword [esp + 0x18], 0xabf3a8
or dword [esp + 0x18], 0x32ff755b
xor dword [esp + 0x18], 0x32ff490c
mov dword [esp + 0x3c], 0x17d934
add dword [esp + 0x3c], 0xffff40c6
shl dword [esp + 0x3c], 3
or dword [esp + 0x3c], 0x427098e
xor dword [esp + 0x3c], 0x4b92666
mov dword [esp + 0x20], 0xf41669
add dword [esp + 0x20], 0x7ca
xor dword [esp + 0x20], 0xfb13a9
mov dword [esp + 0x2c], 0x832d2e
add dword [esp + 0x2c], 0xffff4e33
xor dword [esp + 0x2c], 0x8d753d
mov dword [esp + 0x28], 0xf1f06a
imul eax, dword [esp + 0x28], 0x5e
push 0x13
pop ecx
mov dword [esp + 0x28], eax
xor dword [esp + 0x28], 0x58dedbbf
mov dword [esp + 0x1c], 0x39926
shl dword [esp + 0x1c], 0xf
mov eax, dword [esp + 0x1c]
div ecx
mov dword [esp + 0x1c], eax
xor dword [esp + 0x1c], 0xac12da8
mov dword [esp + 0x10], 0x8d23e1
add dword [esp + 0x10], 0xffff63e2
shl dword [esp + 0x10], 8
imul eax, dword [esp + 0x10], 0x6e
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x625f0c83
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esp + 0x14]
add eax, ebx
mov edx, dword [eax + ecx*8 + 0x78]
test edx, edx
je 0x10018509
cmp dword [eax + ecx*8 + 0x7c], 0
je 0x10018509
lea esi, [edx + ebx]
jmp 0x10018502
add eax, ebx
push eax
push dword [esp + 0x24]
push dword [esp + 0x44]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
call fcn.1002308c
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x10018514
mov edi, dword [esi]
mov ebp, dword [esi + 0x10]
add edi, ebx
add ebp, ebx
jmp 0x100184f9
jns 0x100184ca
movzx edx, ax
jmp 0x100184cf
lea edx, [ebx + 2]
add edx, eax
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.1002247c
add esp, 0x10
test eax, eax
je 0x10018514
mov ecx, dword [esp + 0x14]
add edi, 4
mov dword [ebp], eax
add ebp, 4
mov eax, dword [edi]
test eax, eax
jne 0x100184c3
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x10018493
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
xor eax, eax
jmp 0x1001850c
Function at 0x10018518
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
push dword [esp + 0x28]
push ebx
push edx
push ecx
call fcn.10008002
mov dword [esp + 0x24], 0xe8ed67
xor edx, edx
imul eax, dword [esp + 0x24], 0x75
push 0xd
pop ecx
mov dword [esp + 0x24], eax
shr dword [esp + 0x24], 4
xor dword [esp + 0x24], 0x6ad2a93
mov dword [esp + 0x3c], 0xc4a0ed
xor dword [esp + 0x3c], 0xc09ae0bc
shr dword [esp + 0x3c], 9
mov eax, dword [esp + 0x3c]
div ecx
mov dword [esp + 0x3c], eax
xor dword [esp + 0x3c], 0xf7204
mov eax, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
xor edx, eax
mov dword [esp + 0x28], eax
mov eax, edx
mov dword [esp + 0x2c], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov edi, edx
and cl, 3
cmovne edi, eax
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
add esp, 0x10
mov edx, edi
call fcn.10016f53
mov ebp, eax
pop ecx
test ebp, ebp
je 0x100185f7
shr edi, 2
xor eax, eax
lea ecx, [esi + edi*4]
xor edi, edi
mov edx, ecx
sub edx, esi
add edx, 3
shr edx, 2
cmp esi, ecx
cmova edx, eax
test edx, edx
je 0x100185ed
mov ecx, ebp
sub ecx, esi
mov eax, dword [esi]
xor eax, dword [esp + 0x14]
inc edi
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp edi, edx
jb 0x100185dc
test ebx, ebx
je 0x100185f7
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10020ad3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
push esi
push edx
push ecx
call fcn.10008002
and dword [esp + 0x34], 0
lea edi, [esi + 4]
mov dword [esp + 0x28], 0x69c8b
mov dword [esp + 0x2c], 0xde1591
mov dword [esp + 0x30], 0x759a50
mov dword [esp + 0x1c], 0x9648c4
xor dword [esp + 0x1c], 0x1b43ba07
xor dword [esp + 0x1c], 0x1bdbd063
mov dword [esp + 0x3c], 0x98047e
add dword [esp + 0x3c], 0xbc8b
imul eax, dword [esp + 0x3c], 0x5a
mov dword [esp + 0x3c], eax
xor dword [esp + 0x3c], 0x35b53ed9
mov eax, dword [esi]
mov ebp, dword [edi]
add edi, 4
xor ebp, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
lea esi, [ebp + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
add esp, 8
lea edx, [esi + esi]
call fcn.10016f53
mov ebx, eax
mov dword [esp + 0x34], ebx
pop ecx
test ebx, ebx
je 0x10020be7
shr esi, 2
xor eax, eax
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x10020be1
mov ebx, dword [esp + 0x14]
xor ebp, ebp
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [edx], ax
mov eax, ecx
shr eax, 8
lea edx, [edx + 8]
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [edx - 4], ax
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, esi
jb 0x10020ba4
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x18]
xor eax, eax
mov word [ebx + ebp*2], ax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x10022ae7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push ecx
call fcn.10008002
mov dword [ebp - 4], 0x10d369
add esp, 0x10
add dword [ebp - 4], 0xffff0602
add dword [ebp - 4], 0x96cc
shl dword [ebp - 4], 0xa
xor dword [ebp - 4], 0x41c0dd0b
cmp dword [ecx + 4], 0x40
jae 0x10022b25
xor eax, eax
jmp 0x10022b4e
mov ecx, dword [ecx]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10022b21
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10022b21
movzx edx, word [eax + 0x18]
mov ecx, dword [ebp - 4]
push esi
xor esi, esi
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d9020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031d8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4031b8
xor eax, eax
push ebp
push 0x4031b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x4d9020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d9020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f6c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4dc04c], 0
je 0x403fcd
cmp word [0x4dc220], 0xd7b2
jne 0x403f95
cmp dword [0x4dc228], 0
jbe 0x403f95
mov eax, 0x4dc21c
call dword [0x4dc238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d906c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d9030], 0
jne 0x403fe9
push 0
push 0x4d9064
push 0x4d906c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4059bc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405a3f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405a3f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c08
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405ac8
xor eax, eax
push ebp
push 0x405ac1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405804
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405aa6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405c28
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405aa6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ac8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405be2
cmp byte [ebp - 0xd], 0
jne 0x405b0f
cmp byte [ebp - 0x12], 0
je 0x405be2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405b28
dec ebx
cmp byte [ebx], 0x2e
je 0x405b37
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405b27
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405be2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405b74
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405be2
cmp byte [ebp - 0xd], 0
je 0x405be2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405be2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret