joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d6f53
Capabilities:
Packed with generic packer

Disassembly:
push 0
jmp 0x6d6756
jmp 0x6d6af0
mov dword [esp + 0x28], eax
jmp 0x6d6a8a
call 0x6d675b
jmp 0x6d6cdb
call 0x6d677b
jmp 0x6d6d4e
mov dword [esp + 0x28], eax
jmp 0x6d6e86
mov dword [ecx + reloc.KERNEL32_GetModuleHandleA], 0x82444ff
mov dword [ecx + reloc.KERNEL32_GetModuleHandleA], 0x4c29d
jmp 0x6d6d96
pop ecx
sub ecx, 0x100124b9
mov dword [ecx + reloc.KERNEL32_GetModuleHandleA], eax
jmp 0x6d6aa5
je 0x6d6e03
jne 0x6d66d8
pop eax
sub eax, 0x89280df4
call dword [eax - 0x76d99659]
jmp 0x6d6d10
test eax, eax
jmp 0x6d6d28
je 0x6d65ea
jne 0x6d6d68
call fcn.006c96d6
jmp 0x6d6776
pop ecx
sub ecx, 0x1001257f
jmp 0x6d6f61
call 0x6d6d80
inc edi
je 0x6d6dbe
popal
jo 0x6d6de4
inc esi
imul ebp, dword [ebp + 0x4e], 0x57656d61
add byte [eax - 0x15], dl
lodsd eax, dword [esi]
movzx ebx, byte [eax]
add ebx, 0x18a01865
cmp ebx, 0x18a01931
jmp 0x6d6ccf
mov esi, edi
pushfd
not ecx
mov byte [esp], ah
jmp 0x6d6e47
jmp dword [esi - 0x79]
xchg ch, cl
xchg cx, si
lea esp, [esp + 2]
pop ecx
pushal
bswap esi
call fcn.006d6e16
pushal
cld
xchg edx, eax
cmc
add al, 0xb6
mov edx, 0xd1f7cc8a
mov cl, ah
not ecx
xchg ecx, esi
mov ch, byte [esp + 3]
lea esp, [esp + 2]
lea esi, [ecx + edi]
jmp 0x6d6e2e
add ebx, 0x285c28e4
jmp 0x6d6ea9
popal
push ebx
call 0x6d6e09
je 0x6d6f0d
jne 0x6d678f
call 0x6d6ea3
dec ecx
jae 0x6d6ef4
imul ebp, dword [esi + 0x64], reloc.KERNEL32_GetModuleHandleA
out dx, al
or al, 0
add byte [ebp - 0x7f], cl
sti
mov al, 0x29
pop esp
sub bl, ch
fsub st(0), st(0)
add byte [eax], al
add byte [eax], al
jmp 0x6d7e03
cmp ebx, 0x285c29b0
jmp 0x6d6e8d
mov dword [ecx + reloc.KERNEL32_GetModuleHandleA], 0x4c29d
movzx ebx, byte [eax]
jmp 0x6d6e6d
push 0
jmp 0x6d6fee
and al, 0xc
sub eax, 0xc74f0f78
jmp 0x6d6f44
call 0x6d6f53
push eax
push ebx
inc ecx
push eax
dec ecx
inc esp
dec esp
dec esp
add bl, ch
invalid
mov dword [ecx + reloc.KERNEL32_GetModuleHandleA], eax
mov dword [ecx + reloc.KERNEL32_GetModuleHandleA], 0x82444ff
jmp 0x6d6ec2
call 0x6d6ff3
jmp 0x6d8215
pop eax
test eax, eax
jmp 0x6d8169
call fcn.006d814d
dec edi
jo 0x6d81a7
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax - 0x18], dl
push eax
call fcn.006c96d6
invalid
lodsb al, byte [esi]
out dx, al
invalid
je 0x6d6ef2
jne 0x6d813a
dec ebx
xchg ebp, eax
dec edx
pop eax
sub eax, 0x928f1c17
call dword [eax - 0x6d7290ce]
jmp 0x6d80b6
Function at 0x6d8257
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x6d8006
call 0x6d6fa9
jmp 0x6d80a8
call 0x6d7093
jmp 0x6d81d8
mov dword [esp + 0x24], eax
jmp 0x6d82fc
cmp ebx, 0xc787b0c
je 0x6d7f98
jne 0x6d6f55
and al, 0x8d
and al, 3
mov byte [esp], dl
lea esp, [esp]
jmp 0x6d7fce
not esi
mov esi, 0x7750020c
mov si, 0x2572
jmp 0x6d7feb
lea esp, [esp + 1]
push esi
lea esi, [eax + ebx]
bswap esi
push bp
mov word [esp], di
jmp 0x6d7fb8
lea esi, [ebx*4]
push word [esp]
mov dword [esp], ebp
push bp
lea esi, [eax + ebp]
jmp 0x6d80e6
popal
inc dword [esp + 8]
call fcn.006d7fe5
lea esp, [esp + 2]
mov ebp, dword [esp + 4]
lea esi, [edx*4]
jmp 0x6d8073
not ebp
push di
mov byte [esp], dl
lea esi, [ebp - 0x1e]
mov word [esp], sp
pushfd
jmp 0x6d8010
mov si, bp
mov si, word [esp]
xchg esi, ebp
mov di, word [esp]
pop edi
mov ebp, ecx
jmp 0x6d8026
push cx
bswap esi
lea esp, [esp + 2]
mov esi, dword [esp + 8]
lea esp, [esp + 0xc]
jmp 0x6d80ca
lea esi, [edx + ebp]
lea esi, [eax + ebx]
bswap esi
lea esi, reloc.KERNEL32_GetModuleHandleA
lea esi, [ebp*4]
mov esi, dword [esp]
jmp 0x6d805c
lea esi, [eax*4]
xchg ebp, esi
mov esi, 0x127b0c73
push edi
not esi
mov si, 0x7b94
jmp 0x6d804a
pop eax
sub eax, 0xbc0c00e9
jmp 0x6d80d0
pushal
jmp 0x6d6fa4
call 0x6d80e0
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
into
in eax, 0x24
mov eax, 0x24348bf8
mov esi, dword [esp]
mov esi, dword [esp]
pop bp
lea ebp, [eax + edi]
lea ebp, reloc.KERNEL32_GetModuleHandleA
bswap esi
jmp 0x6d8091
push 0x4a954b31
pushfd
add dword [esp + 4], 0x737867f4
jmp 0x6d81b9
pushal
jmp 0x6d708e
xchg ah, al
mov al, byte [esp]
mov al, cl
mov eax, dword [esp]
push ebx
jmp 0x6d81fc
lea esp, [esp + 8]
sub eax, 0xc861fa2b
jmp 0x6d8247
call 0x6d8257
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
cmpsb byte [esi], byte es:[edi]
dec esp
pushal
enter 0xffffffffffffc085, 0xffffffffffffffe9
into
add byte [eax], al
add al, ch
sldt word [eax]
add byte [ebp + 0x6d], al
jo 0x6d82e1
jns 0x6d82b2
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add bl, ch
pushal
dec esi
cmp edx, dword es:[ebp*2 - reloc.KERNEL32_GetModuleHandleA]
pop ebp
cmp al, 1
adc byte [ebp + 0x18b60fc3], bl
add ebx, 0xc787a40
jmp 0x6d7f34
inc dword [esp + 8]
mov word [ecx + 0x10013fb3], 0xc39d
jmp 0x6d8319
jg 0x6d82a3
jg 0x6d82d0
jmp 0x5533d3fd
pop edi
jmp 0xd4faa060
sub ch, dh
invalid
popfd
ret
popal
inc dword [esp + 8]
jmp 0x6d82e5
cmp ebx, 0x4bcb2aec
jmp 0x6d833e
movzx ebx, byte [eax]
add ebx, 0x4bcb2a20
jmp 0x6d8303
je 0x6d8367
jne 0x6d70bc
add byte [ebx + 0x67a55633], ah
int1
push ecx
shl dword [eax + reloc.KERNEL32_GetModuleHandleA], 0xad
inc dword [esp + 8]
popfd
ret
invalid
Function at 0x6f43f2
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
movzx eax, byte [eax + 0xf]
rcl bh, cl
push ebp
jmp 0x6f44ab
sub bh, 4
jmp 0x6f43db
cmc
xchg ah, bl
not al
mov dword [ecx + 0xc], edx
neg di
jmp 0x6f4412
pushal
push dword [esp + 0xa]
mov bh, 0xaa
xor edx, eax
lea eax, [esi*4]
jmp 0x6f4428
xor edx, esi
bts esi, ecx
lea esi, reloc.KERNEL32_GetModuleHandleA
shl edx, 8
sub bp, 0x2b7a
jmp 0x6f4445
shl edx, 8
bsf bp, di
mov bl, byte [esp]
mov bh, 0x8c
jmp 0x6f4480

Function at 0x6f4d74
Capabilities:
Encrypt data using aes

Disassembly:
xchg ah, al
bt edi, eax
jmp 0x6c55e5
mov edi, dword [esp]
mov ax, bp
jmp 0x6f4c28
pushal
lea esp, [esp + 0x20]
cmp eax, 1
jmp 0x6f4e16
bt edx, edi
mov edi, 0x7c05b5c
jmp 0x6f4e8d
call 0x6f56cd
repe cmpsb byte [esi], byte es:[edi]
jmp 0x723cde
add dword [ebp - 4], 4
sub esp, 0x1f
mov word [esp + 3], si
mov byte [esp + 7], dh
lea esp, [esp + 3]
jmp 0x6f4c01
mov edi, dword [ecx - 8]
sub esp, 1
add esp, 0
lea esp, [esp + 1]
jmp 0x6f4bbb
mov eax, dword [esi]
pop esi
lea edi, reloc.KERNEL32_GetModuleHandleA
adc edi, ebx
shl di, cl
jmp 0x6f4bd5
mov dword [ecx - 8], eax
bsr ax, bx
clc
mov ah, 0xf9
xchg ah, al
jmp 0x6f4c30
mov dword [edx - 8], edi
call fcn.006f4c7b
or al, 0x89
sbb dword [eax - 0x75], edi
dec edi
invalid
push esi
mov esi, edx
lea esi, [esi - 8]
jmp 0x6f4bf1
mov eax, dword [edx - 4]
pushfd
add esp, 2
lea esp, [esp + 2]
jmp 0x6f4c0f
lea esp, [esp + 4]
sub edx, 0x10
pushfd
sub esp, 0xe
jmp 0x6f4db9
add esp, 0xf
lea esp, [esp + 3]
jmp 0x6f4e03
lea esp, [esp + 8]
jl 0x6c55da
not eax
mov al, 3
setne al
jmp 0x6f4e2c
cmp dword [ebp - 4], ebx
push sp
push word [esp]
mov byte [esp + 2], al
push dword [esp + 1]
jmp 0x6f4de0
jle 0x6c565c
sub esp, 0xd
lea esp, [esp + 1]
jmp 0x6f4e34
mov eax, dword [ebp - 8]
jmp 0x6c55ff
lea esp, [esp + 0xc]
lea ecx, [eax - 1]
mov edi, dword [esp]
sub esp, 3
mov byte [esp + 1], bl
jmp 0x6f4edb
bt ebx, edx
and edi, 0x633233a7
jmp 0x6f4eb5
mov ebx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
dec dl
setbe dh
not edx
mov edi, 0x27820a50
jmp 0x6f4e9e
movzx ebx, byte [esi + 0x11]
stc
bt edi, esi
lea edi, [esi*4]
jmp 0x6f4e70
add esi, 0x10
lea edi, reloc.KERNEL32_GetModuleHandleA
xchg dl, dh
lea edi, [edx + ebp]
jmp 0x6f4ec3
lea esp, [esp + 0x20]
mov ecx, 0xff
jmp 0x6c5630
mov edx, dword [esi]
cmc
jmp 0x6f4f0d
pushal
lea esp, [esp + 3]
mov dword [ebp - 4], ecx
lea edx, [ecx + ecx]
bswap edx
jmp 0x6f4e4a
mov edi, edx
call fcn.006f4eed
imul ecx, dword [eax + ebp*2], reloc.KERNEL32_GetModuleHandleA
call fcn.006d2466
mov bh, 0x32
mov al, byte [0xc68732c7]
dec esp
ret 0x54a5
scasd eax, dword es:[edi]
out 0xfa, eax
invalid
push 0x752078b9
call fcn.006d2466
loope 0x723d5d
jecxz 0x723c72
jne 0x723cb3
push edi
fimul dword [eax + 0x2f]
fisubr dword [esi + edi*8 + 0x68]
adc al, 0x78
and byte [ebp - 0x18], dh
out 0xfa, eax
jmp [eax - 0x15]
int1
inc edx
clc
cld
pop ecx
movq qword [ebx + 0x71], mm2
retf 0x8480
Function at 0x6f5236
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp]
lea esp, [esp + 2]
jmp 0x6f5276
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
lea ebx, [esi*4]
jmp 0x6f529a
and ebx, ecx
pushal
pop dword [esp + 0xb]
add esp, 0
jmp 0x6f525b
movzx ebx, byte [esi + 9]
call 0x6f5282
mov edx, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
cmc
clc
jmp 0x6f5372
and edx, ecx
call fcn.006f533c

Function at 0x6f53e6
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov bx, 0x349d
jmp 0x6f54b8
mov word [esp + 1], di
mov byte [esp + 1], al
push edx
lea esp, [esp + 0xc]
jmp 0x6f53c7
and edx, ecx
sub esp, 0x18
pop dword [esp + 0xa]
add esp, 1
mov byte [esp + 0xb], bh
jmp 0x6f541d
movzx ebx, byte [esi + 0xd]
sub esp, 0xa
mov word [esp + 6], ax
stc
lea esp, [esp + 2]
jmp 0x6f5442

Function at 0x6f546b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
bts edx, ebx
jmp 0x6f54a1
add esp, 0
lea esp, [esp]
jmp 0x6f5454
mov edx, dword [esi + 0xc]
cmc
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x6f548b

Function at 0x6f5527
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x6f5563
mov byte [esp + 1], cl
mov word [esp], cx
jmp 0x6f5510
push edi
mov edi, edx
lea edi, [edi*4]
lea edi, reloc.KERNEL32_GetModuleHandleA
jmp 0x6f556f
and edx, ecx
clc
sub esp, 1
lea esp, [esp + 1]
jmp 0x6f5549
mov edx, dword [edi]
pop edi
push si
lea esp, [esp + 1]
lea esp, [esp]
sub esp, 0xb
jmp 0x6f55b2
lea esp, [esp + 2]
jmp 0x6f55da
and ebx, ecx
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
push dx
jmp 0x6f559b
push word [esp + 0x22]
lea esp, [esp + 2]
jmp 0x6f562a
and edx, ecx
xor edi, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
pushal
push dword [esp + 1]
jmp 0x6f55c3
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esi + 0xc], edi
call fcn.006f563b
xchg esp, eax
add byte [esi + 0x59b400f1], dl
int3
lea esp, [esp + 0x24]
dec dword [ebp - 4]
pushfd
mov byte [esp], bh
push dword [esp + 1]
jmp 0x6f560b

Function at 0x6f563b
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, edi
jmp 0x6f55f5
mov edi, dword [edi*4 + reloc.KERNEL32_GetModuleHandleA]
sub esp, 0xf
lea esp, [esp + 3]
and edi, ecx
jmp 0x6f54e6
movzx ebx, byte [esi + 0xe]
call fcn.006f5527
and ebx, ecx
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
inc bx
lea ebx, [ecx - 0x40]
jmp 0x6f5540
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32_GetModuleHandleA
mov edi, dword [ebp]
pop ebp
jmp 0x6f5587
call fcn.006f570b
jne 0x6c5630
je 0x6c565c
stosb byte es:[edi], al
xor byte [esi + 0x178230c1], ah
mov word [edx], es
xchg esp, eax
push eax
and ecx, eax
out dx, eax
sbb byte [ebx + 0x74ff0fec], al
and al, 4
push word [esp + 7]
lea esp, [esp + 1]
jmp 0x6f54fe

Function at 0x6f570b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x10]
jmp 0x6f5640
Function at 0x4070d0
Capabilities:
Resolve dns

Disassembly:
inc esi
add al, 0x8b
dec ebp
or byte [ecx + 0x56318c31], cl
call dword [sym.imp.WSOCK32.dll_gethostbyname]
daa
ret
push ebp
mov ebp, esp
sub esp, 0x207
mov ecx, dword [ebp + 0xc]
push ebx
or al, 0x53
outsd dx, dword [esi]
xor ecx, dword [eax + 0x518bdd8b]
add al, 0x89
inc ebp
jl 0x407074
inc ebp
adc byte [edi - 0x77], dl
jne 0x4070db
mov dl, byte [ecx - 0x65]
push ecx
wait
jne 0x4070f0
test al, al
mov eax, ebx
sub byte [ecx + 0x75c8f075], cl
xchg byte [ecx + 0x7b0f0855], cl
stosb byte es:[edi], al
push ss
add byte [esi - 0x75], bh
pop ebp
fnstsw word [0x108b3c74]
hlt

Function at 0x41fa70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x41fa92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41fa99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41fa88
mov eax, 1
add ebx, ebx
jne 0x41faab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41faa0
jne 0x41fabc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41faa0
xor ecx, ecx
sub eax, 3
jb 0x41fad0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41fb42
mov ebp, eax
add ebx, ebx
jne 0x41fadb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41fae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41fb0c
inc ecx
add ebx, ebx
jne 0x41faf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41faed
jne 0x41fb09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41faed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41fb2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41fb1d
jmp 0x41fa8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41fb2c
add edi, ecx
jmp 0x41fa8e
pop esi
mov edi, esi
mov ecx, 0x638
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41fb4a
cmp byte [edi], 0
jne 0x41fb4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41fb4f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41fbbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f5b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f63c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41fb7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f640]
or eax, eax
je 0x41fbb8
mov dword [ebx], eax
add ebx, 4
jmp 0x41fb99
call dword [esi + 0x1f644]
popal
jmp 0x40e890
Function at 0x402f6c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040485c
test esi, esi
jne 0x402fa3
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.0040494c
jmp 0x402fc4
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402e08
mov dword [esp], eax
test esi, esi
je 0x402fc4
cmp dword [ebx], 0
je 0x402fc4
dec esi
jmp 0x402fab
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403284
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x537008], 0x8088405
inc edx
mov dword [ebx + 0x537008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403778
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x537024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403810
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4037f0
xor eax, eax
push ebp
push 0x4037e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40382c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4037f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x537024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x537024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404634
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x54904c], 0
je 0x404695
cmp word [0x549220], 0xd7b2
jne 0x40465d
cmp dword [0x549228], 0
jbe 0x40465d
mov eax, 0x54921c
call dword [0x549238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x537070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4046bc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x537034], 0
jne 0x4046b1
push 0
push 0x537068
push 0x537070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402ba8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x54904d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4047d8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406d94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406dfa
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404acc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040330c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406de4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e01
lea eax, [ebp - 0x10]
call fcn.0040485c
ret

Function at 0x409c58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d1c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409c71
test al, 0x10
jne 0x409c75
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40cd7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cdb5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040494c
jmp 0x40cdbe
mov eax, ebx
mov edx, esi
call fcn.004048b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cdc8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cde9
mov al, byte [esp]
jmp 0x40cdeb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d480
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d2e8
mov eax, dword [0x548ce4]
cmp byte [eax], 0
je 0x40d4fc
mov eax, dword [0x548860]
call fcn.004030b4
call fcn.00402d34
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409eb0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d544
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d532
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x5487a8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x549668]
call fcn.004061b4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40de18
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40deee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004048f4
lea eax, [ebp - 8]
call fcn.00404d6c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d1c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ded8
mov eax, ebx
call fcn.00402ba8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40ded1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d1c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40debb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40df00
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40debb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ded8
mov eax, dword [ebp - 0x10]
call fcn.00402bd8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40def5
lea eax, [ebp - 8]
call fcn.0040485c
ret

Function at 0x40e514
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e578
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404acc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004098b8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e57f
lea eax, [ebp - 0xc]
call fcn.0040485c
ret

Function at 0x40ed70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov eax, dword [0x5488bc]
cmp dword [eax], 0
je 0x40eda6
push 0xa
push 0x40edfc
mov eax, dword [0x5488bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x5488bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
jmp 0x40edf2
xor eax, eax
mov dword [esp], eax
mov eax, dword [0x548db4]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40edf2
mov ebx, dword [esp + 4]
push 0xa
push 0x40edfc
mov esi, dword [ebx + 4]
push esi
call sub.kernel32.dll_FindResourceA
push eax
push esi
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
cmp dword [esp], 0
jne 0x40edf2
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x40edbd
mov eax, dword [esp]
pop ecx
pop edx
pop esi
pop ebx
ret