joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4129eb
Capabilities:
Authenticate hmac

Disassembly:
push ebp
ret 0x8ce
push ebp
int3
mov esp, 0x7cd993e9
fldenv [edi + 0x5a528ec8]
pop eax
jle 0x412936
inc esi
dec ebx
fisubr word [esi - 0x500ca5c5]
add ebp, ecx
cmp edx, dword [edx]
insd dword es:[edi], dx
into
les edx, [ebx - 0x4af4856a]
mov dl, 0xb
add dword [0xb8a9a19], 0x61de6400
jecxz 0x412977
or esi, dword [ebp + 0x5810bb2]
sbb dword [edx + 0x64000b8a], ebx
fisub word [ecx - 0x1d]
invalid
out dx, eax
rcr byte [edx - 0x43], 6
mov bh, 0x70
insd dword es:[edi], dx
jle 0x41291a
sub byte [ebx], dh
dec esi
inc edi
scasd eax, dword es:[edi]
pop es
in eax, dx
sub edx, 0x4b9f62af
push ebp
and ecx, dword [esi]
push cs
not dword [ebx + 0x36]
je 0x412957
xchg dword [eax], ecx
sbb ah, ch
inc ecx
sahf
aad 5
xor al, 0x15
mov dword cs:[0x800b95bf], eax
add ebx, dword [eax]
pop ds
dec eax
cwde
sbb cl, byte [0x70d79629]
pop edi
cli
pop ds
mov ebp, ecx
mov ecx, 0x464eae0f
invalid
jnp 0xe95d28eb
sub bl, 0xe8
aam 0x64
xlatb
lahf
invalid

Function at 0x412a71
Capabilities:
Authenticate hmac

Disassembly:
dec ebp
add esi, ebp
mov bh, 0xbd
dec esp
mov ah, 0x88
dec dword [edi - 0x50]
xor dword [ebx], edx
jl 0x412a59
outsb dx, byte [esi]
test eax, 0x8e2f6a00
jmp 0x412a90
jmp edi
xchg edi, eax
adc eax, 0x7fde0f9a
out dx, al
inc edi
cmc
push ebx
mov bh, 0x9b
xchg ecx, eax
out 0x36, al
xchg byte [ecx + edi*4 + 0x7cfd2483], cl
push 0x8b0f225f
stosb byte es:[edi], al
xchg esp, eax
mov cl, byte [esi]
push cs
insd dword es:[edi], dx
loopne 0x412a1e
lds esp, [ecx + 0x60]
arpl word [edx], dx
adc eax, 0xa4c8f306
mov cl, 0x23
ja 0x412b05
mov ds, word [eax]
sub dl, byte [edx - 0x3a]
and al, 0xf6
or eax, 0x49b5be70
adc al, 0x3f
sbb dl, byte [ecx + ebx*8 - 0x51]
out dx, eax
stosb byte es:[edi], al
das
or edx, dword [esi + eax - 0x431bd983]
inc edi
cmp byte [edx - 1], cl
push ecx
sbb dword [edi], edi
jne 0x412af2
sub al, 0x5c
lds edx, [ecx + ebx*8]
cmp al, 0x33
xor bl, bl
ror dword [eax + 0x3341d9cc], 1
jne 0x412afd
jo 0x412b0d
or bh, dh
sbb esi, edx
fnstsw word [ebp + 0x51e01ad9]
invalid
pop esi
xor al, cl
push cs
fist dword [ebp + 0x6c57c3dc]
push edi
insb byte es:[edi], dx
xchg edi, eax
lodsd eax, dword [esi]
iretd
cmp dl, al
invalid
das
inc ebp
add byte [ebp - 0x505c0581], dl
rcr dword [edi + 0x281f4991], cl
int 0x6a
lodsd eax, dword [esi]
xchg ebp, eax
jg 0x412b0a
mov dword [0x919fd3af], eax
dec ecx
pop ds
sub ch, cl
push 0xffffffffffffffad
jno 0x412afa
insd dword es:[edi], dx
invalid

Function at 0x413e66
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x28]
call int.004129eb
lea ecx, [esi + 0x18]
call int.004129eb
mov ecx, esi
pop esi
jmp int.004129eb
Function at 0x417696
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4298b7
call fcn.0041a4dc
push ecx
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.00409720
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x4b38]
call fcn.00412503
lea ecx, [esi + 0x98d0]
call fcn.00412eff
lea ecx, [esi + 0xe65c]
mov byte [ebp - 4], 5
call fcn.0040ab0c
push 1
lea ecx, [esi + 0xe694]
mov byte [ebp - 4], 6
call fcn.00409720
lea eax, [esi + 0xe6a4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6b4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6c4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov dword [esi], eax
mov dword [esi + 0x4b34], ebx
mov byte [esi + 0x4c38], bl
mov byte [esi + 0x4c48], bl
mov byte [esi + 0x4c49], bl
mov byte [esi + 0x4c4a], bl
mov dword [esi + 0x1c], 1
call fcn.00411072
push ebx
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xe6d8], ebx
mov dword [esi + 0xe6dc], ebx
call fcn.004157db
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41a89a
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x1a
mov ah, al
shr bl, 1
stosd dword es:[edi], eax
and byte [edi + 0x6e00b76e], bl
aad 0x6e
outsb dx, byte [esi]
sub dl, dl
and dword [edx], edi
mov dh, 0x66
pop esi
pop si
xor dword es:[ecx], ecx
xor dword [ecx], ecx
mov dword [eax], esp
xchg ecx, eax
jecxz 0x41a91e
shr dword [ebx - 0x4e73bd2], 0x3d
mov dh, 0x26
loope 0x41a8b1
les ebx, cs:[eax]
sti
cmp eax, 0xeee126b6
lea edi, [edx - 0x44407f96]
sal byte [ebx + 0x5b], cl
adc al, 0xba
or ebx, ebx
jle 0x41a8a8
js 0x41a8e2
fbstp tbyte [eax + eax - 0x52]
dec eax
inc ebp
sbb dl, dh
je 0x41a8ae
and al, dh
jae 0x41a91e
cmp eax, edx
pop ss
push edx
or eax, 0x6ae04a7
and eax, 0x6788a9c5
outsb dx, byte [esi]
adc al, 0x58
call 0xf2168673
jge 0x41a8b8
ret 0x17f3
invalid
ljmp 0xd3ec:0x5511274b
jge 0x41a97b
push ss
adc ecx, dword [edi]
fild qword [ebp + 0x1109cdaf]
mov ds, eax
xchg esp, eax
dec ebp
test ecx, 0x61b72591
sub byte [ebp + 0x94f720], 0x52
lcall 0xb821, 0xc823190d
dec edx
invalid
not dword [eax + eax + 0x190d9a52]
and ecx, eax
and dword [eax - 0x6aa670b6], edi
push edi
inc edi
out 0xeb, al
jge 0x41a8ba
xor al, 0x72
inc esi
mov byte [0x32f4832f], al
xor esp, 0x32
xchg ah, bl
ror dword [esi], 0x12
dec edi
lahf
push esi
in eax, 0x6a
jecxz 0x41a9a9
mov al, 0xfe
cld
insd dword es:[edi], dx
and al, 0x57
ja 0x41a906
mov bh, 0xf2
add esi, esp
das
or byte [ebx + ebp + 0x2d], al
mov bl, 0x6d
out dx, eax
jo 0x41a938
jecxz 0x41a97e
mov dh, 0x80
aas
xchg esp, eax
jne 0x41a8fc
xchg edi, eax
cwde
xor al, 7
cmp ebp, dword [edi + edx*4 - 0x57b6b019]
dec ebx
xlatb
nop
pop esi
inc ebp
insd dword es:[edi], dx
rol byte [edi], cl
cmp al, 0xf9
shl byte [eax + ebx + 0x6a62982c], 0x48
sbb byte [eax + ebx*4], ch
bound ebp, qword [edx + 0x48]
sub al, ch
std
std
ljmp 0xb5af
and ah, byte [ebx + edi + 0x27e335e7]
add al, 0xb5
arpl dx, sp
dec ebp
xchg ah, dl
sbb dword ds:[edi - 0x20682b07], 0x3cc8705
rcr dword [ecx], 0x2f
loop 0x41a964
mov eax, 0x4756c7d6
pop esp
movsd dword es:[edi], dword [esi]
dec esp
adc dword [ecx + ebx*2], ebx
and byte [eax - 0x13425f20], bl
xchg esi, eax
mov cl, 0xef
invalid
Function at 0x403110
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x200c
call fcn.0040a5d0
mov eax, dword [0x450b14]
mov ecx, dword [0x450a88]
shr eax, 3
test eax, eax
jbe 0x403242
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403160
cmp dword [0x450b14], 0x959
jne 0x403224
push 0
lea eax, [esp + 0x420]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0xc20]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1820]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402b70
push 0x402b80
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00402f60
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403160
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
Function at 0x4071d3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440a30]
jne 0x4071dd
repz ret
jmp fcn.00409f6f

Function at 0x409aff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058c8
and dword [ebp - 4], 0
cmp dword [0x4418e0], 0
mov ebx, eax
jne 0x409bb0
push 0x402378
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409c61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40236c
push edi
call esi
test eax, eax
je 0x409c61
push eax
call fcn.00405856
mov dword [esp], 0x40235c
push edi
mov dword [0x4418e0], eax
call esi
push eax
call fcn.00405856
mov dword [esp], 0x402348
push edi
mov dword [0x4418e4], eax
call esi
push eax
call fcn.00405856
mov dword [esp], 0x40232c
push edi
mov dword [0x4418e8], eax
call esi
push eax
call fcn.00405856
pop ecx
mov dword [0x4418f0], eax
test eax, eax
je 0x409bb0
push 0x402314
push edi
call esi
push eax
call fcn.00405856
pop ecx
mov dword [0x4418ec], eax
mov eax, dword [0x4418ec]
cmp eax, ebx
je 0x409c08
cmp dword [0x4418f0], ebx
je 0x409c08
push eax
call fcn.004058d1
push dword [0x4418f0]
mov esi, eax
call fcn.004058d1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409c08
test edi, edi
je 0x409c08
call esi
test eax, eax
je 0x409bff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409bff
test byte [ebp - 0xc], 1
jne 0x409c08
or dword [ebp + 0x10], 0x200000
jmp 0x409c41
mov eax, dword [0x4418e4]
cmp eax, ebx
je 0x409c41
push eax
call fcn.004058d1
pop ecx
test eax, eax
je 0x409c41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409c41
mov eax, dword [0x4418e8]
cmp eax, ebx
je 0x409c41
push eax
call fcn.004058d1
pop ecx
test eax, eax
je 0x409c41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4418e0]
call fcn.004058d1
pop ecx
test eax, eax
je 0x409c61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409c63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026d0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026de
call dword [0x44001c]
or eax, eax
je 0x4026df
ret
mov al, 1
jmp fcn.0040275c

Function at 0x4026e8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026f6
call dword [0x440020]
or eax, eax
jne 0x4026f7
ret
mov al, 2
jmp fcn.0040275c

Function at 0x402700
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402738
test edx, edx
je 0x402722
push eax
mov eax, ecx
call dword [0x440024]
pop ecx
or eax, eax
je 0x402731
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040275c
mov dword [eax], edx
mov eax, ecx
call dword [0x440020]
or eax, eax
jne 0x40271b
ret
mov al, 1
jmp fcn.0040275c
test edx, edx
je 0x40274c
push eax
mov eax, edx
call dword [0x44001c]
pop ecx
or eax, eax
je 0x402731
mov dword [ecx], eax
ret

Function at 0x40275c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x441004]
test ecx, ecx
je 0x40276c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402785]
jns 0x402780
call fcn.00405e4c
mov eax, dword [eax + 4]
jmp fcn.004038c0

Function at 0x402ad4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b6c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b4c
xor eax, eax
push ebp
push 0x402b45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402dec
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402e06
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402e06
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402df2
mov al, 0xa
jmp fcn.0040275c
ret

Function at 0x402e38
Capabilities:
Terminate process

Disassembly:
cmp dword [0x441018], 0
je 0x402843
call dword [0x441018]
mov eax, 0xd2
jmp fcn.004038c0
push eax
push ecx
mov eax, dword [eax]
call fcn.00402e08
pop ecx
pop eax
je 0x402e47
jmp ebx
pop ecx
jmp 0x402834

Function at 0x403ef0
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403eb4
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403eb4
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403e9c
ret

Function at 0x403f98
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.0040275c
test ecx, ecx
je fcn.00403eb4
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403e9c
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret
Function at 0x404060
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40409f
cmp al, 0xb
je 0x40409f
cmp al, 0xc
je 0x4040a9
cmp al, 0xd
je 0x4040bc
cmp al, 0xe
je 0x4040da
cmp al, 0xf
je 0x40409f
cmp al, 0x11
je 0x40409f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040275c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40409f
jmp 0x4040ee
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4040a9
jmp 0x4040ee
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x404060
dec edi
jg 0x4040bf
pop ebp
jmp 0x4040ee
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404034
dec edi
jg 0x4040dd
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x404060

Function at 0x4040f4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40409f
cmp al, 0xb
je 0x40409f
cmp al, 0xc
je 0x4040a9
cmp al, 0xd
je 0x4040bc
cmp al, 0xe
je 0x4040da
cmp al, 0xf
je 0x40409f
cmp al, 0x11
je 0x40409f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040275c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40409f
jmp 0x4040ee
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4040a9
jmp 0x4040ee
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x404060
dec edi
jg 0x4040bf
pop ebp
jmp 0x4040ee
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404034
dec edi
jg 0x4040dd
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x404060
Function at 0x40412c
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x404212
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40417c
cmp al, 0xb
je 0x404196
cmp al, 0xc
je 0x4041ad
cmp al, 0xd
je 0x4041bc
cmp al, 0xe
je 0x4041da
cmp al, 0xf
je 0x4041f0
cmp al, 0x11
je 0x4041ff
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0040275c
cmp ecx, 1
mov eax, ebx
jg 0x40418d
call fcn.004038cc
jmp 0x40420e
mov edx, ecx
call fcn.004038f0
jmp 0x40420e
cmp ecx, 1
mov eax, ebx
jg 0x4041a4
call fcn.00403eb4
jmp 0x40420e
mov edx, ecx
call fcn.00403ecc
jmp 0x40420e
mov eax, ebx
add ebx, 0x10
call fcn.00404970
dec edi
jg 0x4041ad
jmp 0x40420e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.0040412c
dec edi
jg 0x4041bf
pop ebp
jmp 0x40420e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404100
dec edi
jg 0x4041dd
pop ebp
jmp 0x40420e
mov eax, ebx
add ebx, 4
call fcn.00405198
dec edi
jg 0x4041f0
jmp 0x40420e
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404b64
dec edi
jg 0x4041ff
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404214
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.0040412c

Function at 0x404220
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x40424c
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004027e8
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40428b
cmp cl, 0xb
je 0x40429c
cmp cl, 0xc
je 0x4042ad
cmp cl, 0xd
je 0x4042be
cmp cl, 0xe
je 0x4042de
cmp cl, 0xf
je 0x4042f7
cmp cl, 0x11
je 0x404308
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040275c
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403920
mov eax, 4
jmp 0x404319
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403ef0
mov eax, 4
jmp 0x404319
lea edx, [esi + eax]
add eax, ebx
call fcn.004045b8
mov eax, 0x10
jmp 0x404319
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.0040433c
pop eax
jmp 0x404319
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404220
pop eax
jmp 0x404319
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004051b0
mov eax, 4
jmp 0x404319
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404ba0
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x40423a
pop ecx
sub ecx, eax
jle 0x404335
lea edx, [ebx + eax]
add eax, esi
call fcn.004027e8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40433c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404382
cmp cl, 0xb
je 0x404399
cmp cl, 0xc
je 0x4043ad
cmp cl, 0xd
je 0x4043c1
cmp cl, 0xe
je 0x4043e2
cmp cl, 0xf
je 0x4043ff
cmp cl, 0x11
je 0x404413
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040275c
mov eax, ebx
mov edx, dword [esi]
call fcn.00403920
add ebx, 4
add esi, 4
dec ebp
jne 0x404382
jmp 0x404427
mov eax, ebx
mov edx, dword [esi]
call fcn.00403ef0
add ebx, 4
add esi, 4
dec ebp
jne 0x404399
jmp 0x404427
mov eax, ebx
mov edx, esi
call fcn.004045b8
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4043ad
jmp 0x404427
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.0040433c
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4043ca
jmp 0x404427
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404220
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4043e2
jmp 0x404427
mov eax, ebx
mov edx, dword [esi]
call fcn.004051b0
add ebx, 4
add esi, 4
dec ebp
jne 0x4043ff
jmp 0x404427
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404ba0
add ebx, 4
add esi, 4
dec ebp
jne 0x404413
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4045b8
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.0040275c
cmp eax, edx
je 0x404650
cmp word [eax], 8
jb 0x4045f0
push eax
push edx
cmp word [eax], 0x100
je 0x4045e6
cmp word [eax], 0x101
je 0x4045de
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4045ee
call dword [0x4413e4]
jmp 0x4045ee
add eax, 8
call fcn.004038cc
pop edx
pop eax
cmp word [edx], 8
jae 0x404607
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404622
cmp word [edx], 0x101
jne 0x40463c
push eax
call 0x4045f6
pop eax
jmp dword [0x4413ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x404633
mov ecx, dword [edx - 8]
inc ecx
jle 0x404633
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x40456c
ret
Function at 0x404dd8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404f94
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404e39
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404fb0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404eab
xor eax, eax
push ebp
push 0x404ea4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00404c30
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404e8d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404fd0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404eab
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404f8c
cmp byte [ebp - 0xd], 0
jne 0x404eed
cmp byte [ebp - 0x12], 0
je 0x404f8c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404f06
dec ebx
cmp byte [ebx], 0x2e
je 0x404f15
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404f05
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404f8c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404f42
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f8c
cmp byte [ebp - 0xd], 0
je 0x404f8c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f8c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4084d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408509
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039b4
jmp 0x408512
mov eax, ebx
mov edx, esi
call fcn.00403920
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4