joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c6a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x423a88
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x43893c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 0
push 0x438768
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
mov esi, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x41c71b
cmp eax, 0xffffffff
je 0x41c73e
or eax, 0xffffffff
lock xadd dword [esi], eax
setne al
test al, al
jne 0x41c73e
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41c734
call fcn.004040d0
push 8
push dword [esi + 0xc]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMapDataBase::freeTree_struct_QMapNodeBase___int_]
push esi
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMapDataBase::freeData_struct_QMapDataBase__]
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4

Function at 0x41c760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x423a88
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x43893c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 1
push 0x438768
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___]
mov esi, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x41c7db
cmp eax, 0xffffffff
je 0x41c7fe
or eax, 0xffffffff
lock xadd dword [esi], eax
setne al
test al, al
jne 0x41c7fe
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41c7f4
call fcn.004040d0
push 8
push dword [esi + 0xc]
mov ecx, esi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMapDataBase::freeTree_struct_QMapNodeBase___int_]
push esi
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QMapDataBase::freeData_struct_QMapDataBase__]
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4
Function at 0x41dcd0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0xc
call fcn.0041d6e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x41dce8
mov eax, 0xfffff027
pop esi
ret
mov eax, dword [esp + 0xc]
push edi
push 0
push 4
push esi
push 0x41d950
mov dword [esi], eax
mov eax, dword [esp + 0x24]
push 0
push 0
mov dword [esi + 4], eax
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
test ecx, ecx
jne 0x41dd31
call dword [sym.imp.MSVCR120.dll__errno]
push esi
mov edi, dword [eax]
call fcn.0041d6c0
add esp, 4
cmp edi, 0x16
jbe 0x41dd43
pop edi
mov eax, 0xfffff01a
pop esi
ret
mov eax, dword [esp + 0xc]
xor edi, edi
push ecx
mov dword [eax], ecx
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
movzx eax, byte [edi + 0x41dd84]
jmp dword [eax*4 + 0x41dd70]

Function at 0x41ebc0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x40c
mov eax, dword [0x43893c]
xor eax, esp
mov dword [esp + 0x408], eax
lea eax, [esp + 0x278]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x41ed3c
push 0x43bf00
push eax
push str.0.0.0.0
call fcn.0041d6f0
add esp, 0xc
test eax, eax
je 0x41ec0c
call dword [sym.imp.MSVCR120.dll_abort]
push 0x43bee0
push 0
push 0x42a628
call fcn.0041d730
add esp, 0xc
test eax, eax
je 0x41ec2a
call dword [sym.imp.MSVCR120.dll_abort]
push esi
push edi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xffffffff
je 0x41ec9c
lea eax, [esp + 8]
mov dword [esp + 8], 0x274
push eax
lea eax, [esp + 0x10]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x41ed47
test dword [esp + 0xc], 0x20000
mov ecx, 1
mov eax, dword [0x43bf14]
cmove eax, ecx
push edi
mov dword [0x43bf14], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x41ecaf
jmp 0x41ed58
call esi
push eax
call fcn.0041eb90
add esp, 4
test eax, eax
je 0x41ed69
push 0
push 1
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x41ed16
lea eax, [esp + 8]
mov dword [esp + 8], 0x274
push eax
lea eax, [esp + 0x10]
push eax
push 0x2005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x41ed76
test dword [esp + 0xc], 0x20000
mov ecx, 1
mov eax, dword [0x43bf10]
cmove eax, ecx
push edi
mov dword [0x43bf10], eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x41ed25
jmp 0x41ed83
call esi
push eax
call fcn.0041eb90
add esp, 4
test eax, eax
je 0x41ed90
mov ecx, dword [esp + 0x410]
pop edi
pop esi
xor ecx, esp
call fcn.0041ef94
add esp, 0x40c
ret
push str.WSAStartup
push eax
call fcn.0041e180
push str.getsockopt
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0041e180
push str.closesocket
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0041e180
push str.socket
call esi
push eax
call fcn.0041e180
push str.getsockopt
call esi
push eax
call fcn.0041e180
push str.closesocket
call esi
push eax
call fcn.0041e180
push str.socket
call esi
push eax
call fcn.0041e180
int3
Function at 0x41ff80
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x41ffaa
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebp
push esi
seto cl
neg ecx
or ecx, eax
push edi
push ecx
call fcn.0041ee7e
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x14], 0
mov ebp, eax
mov dword [esp + 0x20], ebp
test ecx, ecx
jle 0x42004b
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov ebx, dword [eax + ebp]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.0041ee7e
add esp, 4
mov edi, eax
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [ebp - 4], edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
jl 0x41fff0
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push ebx
mov dword [ebp + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push dword [esp + 0x14]
call fcn.00405db0
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [esp + 0x10], esi
jle 0x420089
mov ecx, dword [ebp + esi*4]
test ecx, ecx
je 0x420089
push ecx
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
inc esi
add esp, 4
cmp esi, dword [esp + 0x10]
jl 0x420071
push ebp
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x402a2c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a69
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402a89
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404bf8
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402c50
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404978
test esi, esi
jne 0x402c86
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a68
jmp 0x402ca4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b04
mov edi, eax
test esi, esi
je 0x402ca4
cmp dword [ebx], 0
je 0x402ca4
dec esi
jmp 0x402c8d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x566008], 0x8088405
inc edx
mov dword [ebx + 0x566008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4038f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x566024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403988
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403968
xor eax, eax
push ebp
push 0x403961
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4039a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403968
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x566024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x566024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404758
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56a04c], 0
je 0x4047b9
cmp word [0x56a220], 0xd7b2
jne 0x404781
cmp dword [0x56a228], 0
jbe 0x404781
mov eax, 0x56a21c
call dword [0x56a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x566074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047e0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x566034], 0
jne 0x4047d5
push 0
push 0x56606c
push 0x566074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40492c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402820
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x56a04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4048f4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406530
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406760
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4065b3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406760
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4065b3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40677c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40663c
xor eax, eax
push ebp
push 0x406635
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406378
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40661a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40679c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40661a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40663c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406756
cmp byte [ebp - 0xd], 0
jne 0x406683
cmp byte [ebp - 0x12], 0
je 0x406756
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40669c
dec ebx
cmp byte [ebx], 0x2e
je 0x4066ab
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40669b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406756
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4066e8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406756
cmp byte [ebp - 0xd], 0
je 0x406756
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406756
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406efa
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404bf8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403358
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406ee4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f01
lea eax, [ebp - 0x10]
call fcn.00404978
ret

Function at 0x40d158
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d191
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a68
jmp 0x40d19a
mov eax, ebx
mov edx, esi
call fcn.004049cc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d1a4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d1c5
mov al, byte [esp]
jmp 0x40d1c7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e1d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e2a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404a10
lea eax, [ebp - 8]
call fcn.00404eb4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e64
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40e290
mov eax, ebx
call fcn.00402820
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40e289
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e64
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40e273
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40e2b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e273
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e290
mov eax, dword [ebp - 0x10]
call fcn.00402840
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e2ad
lea eax, [ebp - 8]
call fcn.00404978
ret
Function at 0x40e7fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e860
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404bf8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409a60
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e867
lea eax, [ebp - 0xc]
call fcn.00404978
ret

Function at 0x426e90
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00426c78
dec esi
jne 0x426eb2
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x428008
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x56a890
cmp dword [edi], 0
jne 0x428084
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x56a88c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x5666f0
mov ecx, 2
call fcn.00402ac4
mov edx, 0x427fe0
lea eax, [esi + 5]
call fcn.00428000
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00428000
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x428059
mov dword [0x56a88c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x428f28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404e54
mov eax, dword [ebp - 8]
call fcn.00404e54
xor eax, eax
push ebp
push 0x429025
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x428f79
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x428f79
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00404f04
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00404e64
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x42900a
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404e64
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x428ffa
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00404ff0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00404e64
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push ebx
mov eax, dword [ebx]
call fcn.00404c64
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404ec4
jmp 0x429001
mov eax, ebx
call fcn.00404978
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42902c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040499c
ret

Function at 0x429b0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e54
xor eax, eax
push ebp
push 0x429beb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x429c04
call fcn.00404fa8
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c64
dec eax
cmp ebx, eax
jne 0x429b6a
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c64
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404ec4
mov eax, dword [ebp - 4]
call fcn.00404c64
mov ebx, eax
test ebx, ebx
jle 0x429ba1
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
call fcn.00404ebc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 8]
dec ebx
jne 0x429b7f
mov eax, dword [ebp - 4]
call fcn.00404c64
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 8], 0
jle 0x429bd5
lea eax, [ebp - 4]
call fcn.00404ebc
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429bf2
lea eax, [ebp - 4]
call fcn.00404978
ret
Function at 0x429e9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404ff0
cmp dword [ebp - 4], 0
jle 0x429ed9
mov eax, ebx
call fcn.00404ebc
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
call fcn.00404c64
mov esi, eax
test esi, esi
jle 0x429f0d
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.00404ebc
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov edi, dword [ebp - 4]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 4]
dec esi
jne 0x429eed
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42aa30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00402ac4
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret