joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401060
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, ebx
mov esi, eax
xor esi, esi
xor ebx, eax
xor eax, eax
mov esi, esi
xor esi, esi
mov esi, esi
mov esi, ebx
dec edi
sbb edx, 0x6b
mov eax, 0x13
bswap ebx
ror eax, 0x7c
bswap edx
not esi
rcl eax, 5
rcr eax, 0xd4
not edx
add eax, 0xbb
inc ebx
bswap ebx
imul ebx
dec eax
bswap esi
neg ebx
sbb ebx, 0xc6
inc ebx
sbb esi, 0xe2
or ebx, 0x50
dec ebx
add edx, 0xa2
not eax
and edi, 0x4a
add eax, 0xe8
neg edi
rol edx, 0xf8
ror esi, 0x90
not ebx
not ebx
inc eax
neg esi
imul esi
inc edx
neg edx
add edi, 0x53
dec eax
or esi, 0x5f
dec ebx
sub eax, 0x9c
add ebx, 0x17
mov eax, 0x39
rcl eax, 0xfb
imul esi
sbb edi, 0xe3
inc eax
sbb ebx, 0xfa
ror eax, 0x54
sbb ebx, 0xbd
xor ecx, ecx
xor edi, edi
xor ebx, ebx
xor eax, ebx
mov ebx, ebx
xor esi, eax
mov esi, ebx
mov esi, esi
inc edx
sbb eax, 0x30
inc eax
sub eax, 0xe3
neg ebx
bswap edx
not eax
dec ebx
sbb edx, 0xdc
and edx, 0x67
dec edi
mov esi, 0xc2
or edx, 0xb
or ebx, 0xd0
not edx
sbb edx, 0x5a
and eax, 0xd6
rol ebx, 0x7a
bswap eax
neg edx
rcr edx, 0x39
rol ebx, 0xdc
imul edx
add edx, 0x38
neg esi
neg eax
neg edx
bswap edx
sub edi, 0x4e
inc ebx
add ebx, 0xc7
not edi
dec edx
neg ebx
rol eax, 5
inc edx
ror esi, 0xee
rol esi, 0x21
rcl edx, 0x34
not esi
ror esi, 0x77
neg esi
rcl esi, 0xc5
bswap edi
inc edx
rol ebx, 0xe3
neg ebx
sub ebx, 0xd8
rcr edi, 0xd9
dec ebx
xor ebx, esi
xor eax, ebx
xor esi, esi
xor eax, ebx
mov ebx, ebx
xor esi, ebx
xor ebx, ebx
xor esi, esi
mov ebx, eax
mov ecx, dword [ebp + 0xc]
neg edi
not edx
ror edi, 0xef
and esi, 0x22
sbb esi, 0x48
neg edx
mov ebx, 0x93
imul eax
dec esi
add ebx, 0x26
rcr edi, 0x2a
dec ebx
and edi, 0x48
sub ebx, 0xec
rcr edx, 0x66
rcr esi, 0x14
imul edi
ror eax, 0x24
imul esi
sbb esi, 7
rcr eax, 0x95
bswap ebx
dec esi
rol esi, 0x69
sbb ebx, 0x7b
imul edi
rcr esi, 0xc1
bswap edx
or edx, 0xe8
rcr edx, 0xd
neg edi
bswap edx
dec eax
and edi, 0x82
dec edx
mov edx, 0xf0
mov eax, 0x2f
dec esi
sbb esi, 0x8d
imul esi
rcr edx, 0x5c
dec ebx
add esi, 0x88
ror esi, 0x28
add eax, 0xde
rcr edi, 0x3f
inc ebx
inc edx
imul ebx
ror edi, 0x2e
mov edi, dword [ebp + 8]
xor esi, esi
xor esi, ebx
xor ebx, esi
xor esi, eax
mov ebx, eax
mov eax, esi
mov esi, esi
xor eax, eax
mov ebx, eax
not byte [edi]
xor esi, esi
mov ebx, esi
mov esi, ebx
xor eax, ebx
xor esi, ebx
mov ebx, esi
xor ebx, eax
mov eax, esi
mov ebx, ebx
xor eax, esi
xor esi, esi
xor eax, eax
add byte [edi], 0xff
sub byte [edi], 0x4a
mov esi, eax
xor eax, ebx
xor eax, esi
xor ebx, esi
xor eax, esi
xor esi, esi
mov esi, esi
mov esi, eax
mov ebx, eax
imul byte [edi]
inc edi
loop 0x40124d
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40272c
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40273a
call dword [0x4bb024]
or eax, eax
je 0x40273b
ret
mov al, 1
jmp fcn.004027b8

Function at 0x402744
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402752
call dword [0x4bb028]
or eax, eax
jne 0x402753
ret
mov al, 2
jmp fcn.004027b8

Function at 0x40275c
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402794
test edx, edx
je 0x40277e
push eax
mov eax, ecx
call dword [0x4bb02c]
pop ecx
or eax, eax
je 0x40278d
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.004027b8
mov dword [eax], edx
mov eax, ecx
call dword [0x4bb028]
or eax, eax
jne 0x402777
ret
mov al, 1
jmp fcn.004027b8
test edx, edx
je 0x4027a8
push eax
mov eax, edx
call dword [0x4bb024]
pop ecx
or eax, eax
je 0x40278d
mov dword [ecx], eax
ret

Function at 0x4027b8
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x4be004]
test ecx, ecx
je 0x4027c8
pop edx
call ecx
dec eax
mov al, byte [eax + 0x4027e1]
jns 0x4027dc
call fcn.00406468
mov eax, dword [eax + 4]
jmp fcn.00403bbc

Function at 0x4027fc
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00406468
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x402811
ret
xor eax, eax
jmp fcn.004027b8

Function at 0x402928
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402957
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cb0
jmp 0x402975
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004028b0
mov edi, eax
test ebx, ebx
je 0x402975
cmp dword [esi], 0
je 0x402975
dec ebx
jmp 0x40295e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402dd4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402db4
xor eax, eax
push ebp
push 0x402dad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402df0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402db4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x40305c
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x403076
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x403076
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x403062
mov al, 0xa
jmp fcn.004027b8
ret
Function at 0x4030a8
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4be01c], 0
je 0x402a23
call dword [0x4be01c]
mov eax, 0xd2
jmp fcn.00403bbc
push eax
push ecx
mov eax, dword [eax]
call fcn.00403078
pop ecx
pop eax
je 0x4030b7
jmp ebx
pop ecx
jmp 0x402a14

Function at 0x4030c0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00403078
mov eax, ebx
pop ebx
jne 0x4030d5
pop ecx
jmp 0x402a14
ret

Function at 0x40392c
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, 0x4be4a4
lea edi, [ebp - 0x3c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop dword [0x4be4c4]
pop dword [0x4be4c0]
mov dword [0x4be4b8], ebp
mov dword [0x4be4bc], ebx
mov dword [0x4be4ac], eax
mov dword [0x4be4b4], edx
lea ecx, [ebp - 0x3c]
mov dword [0x4be4a4], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x403975
mov ecx, dword [eax]
mov dword [0x4be4b0], ecx
call fcn.00403824
mov eax, dword [ebp + 0xc]
inc eax
mov byte [0x4be4c8], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [0x4be4cc], edx
je 0x403998
call dword [ecx + eax*4]
mov edx, dword [esp + 4]
test edx, edx
je 0x4039a5
mov eax, dword [ebp + 0xc]
call edx
cmp dword [0x4be020], 0
jne 0x4039bb
mov byte [0x4be028], 1
fnstcw word [section.DATA]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00403a90
call fcn.004038cc
ret 4

Function at 0x403a90
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4be4a4
mov esi, 0x4be038
mov edi, 0x4be03c
cmp byte [ebx + 0x24], 0
jne 0x403abf
cmp dword [edi], 0
je 0x403abf
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403aae
cmp dword [0x4be040], 0
je 0x403b0f
call fcn.00403a0c
cmp byte [0x4be048], 0
je 0x403aec
mov edx, 0x4bb034
mov eax, 0x4be21c
call fcn.00405c80
call fcn.00405c03
jmp 0x403b08
cmp byte [0x4bb010], 0
jne 0x403b08
push 0
push 0x4bb054
push 0x4bb034
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x4be040], eax
cmp byte [ebx + 0x24], 2
jne 0x403b1f
cmp dword [esi], 0
jne 0x403b1f
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040386c
cmp byte [ebx + 0x24], 1
jbe 0x403b2f
cmp dword [esi], 0
je 0x403b4c
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403b4c
call fcn.00405668
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403b4c
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403844
cmp byte [ebx + 0x24], 1
jne 0x403b5a
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403b65
call fcn.00403a5c
cmp dword [ebx], 0
jne 0x403b72
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403b0f

Function at 0x403bb0
Capabilities:
Terminate process

Disassembly:
mov dword [0x4be038], eax
jmp fcn.00403a90

Function at 0x40425c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404220
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404220
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x404208
ret
Function at 0x404304
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.004027b8
test ecx, ecx
je fcn.00404220
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404208
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404344
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x404358
push eax
push 0
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404208
ret

Function at 0x4043a0
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x4043be
push eax
mov ecx, dword [edx - 4]
shr ecx, 1
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
pop edx
test eax, eax
je 0x404208
mov dword [edx], eax
ret

Function at 0x4043ec
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40442b
cmp al, 0xb
je 0x40442b
cmp al, 0xc
je 0x404435
cmp al, 0xd
je 0x404448
cmp al, 0xe
je 0x404466
cmp al, 0xf
je 0x40442b
cmp al, 0x11
je 0x40442b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027b8
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40442b
jmp 0x40447a
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404435
jmp 0x40447a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4043ec
dec edi
jg 0x40444b
pop ebp
jmp 0x40447a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043c0
dec edi
jg 0x404469
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4043ec

Function at 0x404480
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40442b
cmp al, 0xb
je 0x40442b
cmp al, 0xc
je 0x404435
cmp al, 0xd
je 0x404448
cmp al, 0xe
je 0x404466
cmp al, 0xf
je 0x40442b
cmp al, 0x11
je 0x40442b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027b8
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40442b
jmp 0x40447a
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404435
jmp 0x40447a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4043ec
dec edi
jg 0x40444b
pop ebp
jmp 0x40447a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043c0
dec edi
jg 0x404469
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4043ec
Function at 0x4044b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x40459e
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404508
cmp al, 0xb
je 0x404522
cmp al, 0xc
je 0x404539
cmp al, 0xd
je 0x404548
cmp al, 0xe
je 0x404566
cmp al, 0xf
je 0x40457c
cmp al, 0x11
je 0x40458b
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.004027b8
cmp ecx, 1
mov eax, ebx
jg 0x404519
call fcn.00403bc8
jmp 0x40459a
mov edx, ecx
call fcn.00403bec
jmp 0x40459a
cmp ecx, 1
mov eax, ebx
jg 0x404530
call fcn.00404220
jmp 0x40459a
mov edx, ecx
call fcn.00404238
jmp 0x40459a
mov eax, ebx
add ebx, 0x10
call fcn.00404eac
dec edi
jg 0x404539
jmp 0x40459a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004044b8
dec edi
jg 0x40454b
pop ebp
jmp 0x40459a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.0040448c
dec edi
jg 0x404569
pop ebp
jmp 0x40459a
mov eax, ebx
add ebx, 4
call fcn.00405730
dec edi
jg 0x40457c
jmp 0x40459a
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.004050f0
dec edi
jg 0x40458b
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4045a0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004044b8

Function at 0x4045d8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404615
cmp al, 0xb
je 0x404624
cmp al, 0xc
je 0x404633
cmp al, 0xd
je 0x404642
cmp al, 0xe
je 0x404660
cmp al, 0xf
je 0x404676
cmp al, 0x11
je 0x404685
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027b8
mov eax, dword [ebx]
add ebx, 4
call fcn.00403ffc
dec edi
jg 0x404615
jmp 0x404692
mov eax, ebx
add ebx, 4
call fcn.004043a0
dec edi
jg 0x404624
jmp 0x404692
mov eax, ebx
add ebx, 0x10
call fcn.00404eb4
dec edi
jg 0x404633
jmp 0x404692
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4045d8
dec edi
jg 0x404645
pop ebp
jmp 0x404692
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004045ac
dec edi
jg 0x404663
pop ebp
jmp 0x404692
mov eax, dword [ebx]
add ebx, 4
call fcn.00405764
dec edi
jg 0x404676
jmp 0x404692
mov eax, dword [ebx]
add ebx, 4
call fcn.00405154
dec edi
jg 0x404685
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4045d8
Function at 0x404698
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404615
cmp al, 0xb
je 0x404624
cmp al, 0xc
je 0x404633
cmp al, 0xd
je 0x404642
cmp al, 0xe
je 0x404660
cmp al, 0xf
je 0x404676
cmp al, 0x11
je 0x404685
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027b8
mov eax, dword [ebx]
add ebx, 4
call fcn.00403ffc
dec edi
jg 0x404615
jmp 0x404692
mov eax, ebx
add ebx, 4
call fcn.004043a0
dec edi
jg 0x404624
jmp 0x404692
mov eax, ebx
add ebx, 0x10
call fcn.00404eb4
dec edi
jg 0x404633
jmp 0x404692
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4045d8
dec edi
jg 0x404645
pop ebp
jmp 0x404692
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004045ac
dec edi
jg 0x404663
pop ebp
jmp 0x404692
mov eax, dword [ebx]
add ebx, 4
call fcn.00405764
dec edi
jg 0x404676
jmp 0x404692
mov eax, dword [ebx]
add ebx, 4
call fcn.00405154
dec edi
jg 0x404685
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4045d8

Function at 0x4046a4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4046d0
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402870
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40470f
cmp cl, 0xb
je 0x404720
cmp cl, 0xc
je 0x404731
cmp cl, 0xd
je 0x404742
cmp cl, 0xe
je 0x404762
cmp cl, 0xf
je 0x40477b
cmp cl, 0x11
je 0x40478c
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004027b8
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403c1c
mov eax, 4
jmp 0x40479d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040425c
mov eax, 4
jmp 0x40479d
lea edx, [esi + eax]
add eax, ebx
call fcn.00404a68
mov eax, 0x10
jmp 0x40479d
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004047c0
pop eax
jmp 0x40479d
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004046a4
pop eax
jmp 0x40479d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405748
mov eax, 4
jmp 0x40479d
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040512c
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4046be
pop ecx
sub ecx, eax
jle 0x4047b9
lea edx, [ebx + eax]
add eax, esi
call fcn.00402870
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4047c0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404806
cmp cl, 0xb
je 0x40481d
cmp cl, 0xc
je 0x404831
cmp cl, 0xd
je 0x404845
cmp cl, 0xe
je 0x404866
cmp cl, 0xf
je 0x404883
cmp cl, 0x11
je 0x404897
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004027b8
mov eax, ebx
mov edx, dword [esi]
call fcn.00403c1c
add ebx, 4
add esi, 4
dec ebp
jne 0x404806
jmp 0x4048ab
mov eax, ebx
mov edx, dword [esi]
call fcn.0040425c
add ebx, 4
add esi, 4
dec ebp
jne 0x40481d
jmp 0x4048ab
mov eax, ebx
mov edx, esi
call fcn.00404a68
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404831
jmp 0x4048ab
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004047c0
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x40484e
jmp 0x4048ab
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004046a4
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404866
jmp 0x4048ab
mov eax, ebx
mov edx, dword [esi]
call fcn.00405748
add ebx, 4
add esi, 4
dec ebp
jne 0x404883
jmp 0x4048ab
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.0040512c
add ebx, 4
add esi, 4
dec ebp
jne 0x404897
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x404a68
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004027b8
cmp eax, edx
je 0x404b00
cmp word [eax], 8
jb 0x404aa0
push eax
push edx
cmp word [eax], 0x100
je 0x404a96
cmp word [eax], 0x101
je 0x404a8e
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x404a9e
call dword [0x4be3e8]
jmp 0x404a9e
add eax, 8
call fcn.00403bc8
pop edx
pop eax
cmp word [edx], 8
jae 0x404ab7
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404ad2
cmp word [edx], 0x101
jne 0x404aec
push eax
call 0x404aa6
pop eax
jmp dword [0x4be3f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x404ae3
mov ecx, dword [edx - 8]
inc ecx
jle 0x404ae3
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404a1c
ret

Function at 0x404e78
Capabilities:
Terminate process

Disassembly:
push eax
cmp word [eax], 8
jb 0x404e86
push edx
call fcn.00404a24
pop edx
xor eax, eax
test edx, edx
je 0x404ea2
mov eax, dword [edx - 4]
shr eax, 1
je 0x404ea2
push eax
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404208
pop edx
mov word [edx], 8
mov dword [edx + 8], eax
ret
Function at 0x405370
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40552c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4053d1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405548
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405443
xor eax, eax
push ebp
push 0x40543c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004051c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405425
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405568
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405443
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405524
cmp byte [ebp - 0xd], 0
jne 0x405485
cmp byte [ebp - 0x12], 0
je 0x405524
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40549e
dec ebx
cmp byte [ebx], 0x2e
je 0x4054ad
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40549d
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405524
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4054da
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405524
cmp byte [ebp - 0xd], 0
je 0x405524
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405524
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40afe0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b019
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403cb0
jmp 0x40b022
mov eax, ebx
mov edx, esi
call fcn.00403c1c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b02c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b04d
mov al, byte [esp]
jmp 0x40b04f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x416a14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x416a1a
ret

Function at 0x419318
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x419369
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x419350
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x419340
jmp 0x419369
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x419351
pop ebx
mov esp, ebp
pop ebp
ret