joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65a060
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x65a080
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x65ae60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x65ae80
mov eax, dword [esp]
mov edx, dword [0x39965c]
test edx, edx
je 0x65aef8
xor ebx, ebx
mov ecx, dword [0x399660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x65aed0
inc ebx
cmp edx, ebx
jne 0x65aec0
jmp 0x65aef8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x65aef8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x399664]
call fcn.00658a80
add esp, 0x20
test edi, edi
je 0x65af02
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x65af0e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x65b1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x65b1f0
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x698232ac]
xor ecx, eax
mov ebx, ecx
and ebx, 0x5f
add ebx, ebx
xor ecx, 0xa0
sub ebx, ecx
mov byte [esp + eax + 0x698232ac], bl
inc eax
cmp eax, 0x967dcd58
jne 0x65b270
mov eax, dword [esp]
mov edi, dword [0x39965c]
test edi, edi
je 0x65b2e5
xor ebx, ebx
mov ebp, dword [0x399660]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x65b2c1
inc ebx
cmp edi, ebx
jne 0x65b2b0
jmp 0x65b2e5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x65b2e5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x399664]
call fcn.00658a80
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4027d4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027e2
call dword [fcn.007ea01c]
or eax, eax
je 0x4027e3
ret
mov al, 1
jmp fcn.00402854

Function at 0x4027ec
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027fa
call dword [fcn.007ea020]
or eax, eax
jne 0x4027fb
ret
mov al, 2
jmp fcn.00402854

Function at 0x402804
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x40283c
test edx, edx
je 0x402826
push eax
mov eax, ecx
call dword [fcn.007ea024]
pop ecx
or eax, eax
je 0x402835
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402854
mov dword [eax], edx
mov eax, ecx
call dword [fcn.007ea020]
or eax, eax
jne 0x40281f
ret
mov al, 1
jmp fcn.00402854
test edx, edx
je 0x402850
push eax
mov eax, edx
call dword [fcn.007ea01c]
pop ecx
or eax, eax
je 0x402835
mov dword [ecx], eax
ret

Function at 0x402854
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x843004]
test ecx, ecx
je 0x402864
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40287d]
jns 0x402878
call fcn.004072d8
mov eax, dword [eax + 4]
jmp fcn.00403de4

Function at 0x402898
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.004072d8
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4028ad
ret
xor eax, eax
jmp fcn.00402854

Function at 0x402934
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402971
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call sub.KERNEL32.DLL_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x402991
lea eax, [esp + 0x108]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.004040a0
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x402b44
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402b73
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f58
jmp 0x402b91
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402a78
mov edi, eax
test ebx, ebx
je 0x402b91
cmp dword [esi], 0
je 0x402b91
dec ebx
jmp 0x402b7a
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x84303c], 0x8088405
inc edx
mov dword [0x84303c], edx
mul edx
mov eax, edx
ret

Function at 0x402e78
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x84303c], 0x8088405
inc edx
mov dword [0x84303c], edx
fld qword [0x7ea02c]
push 0
push edx
fild qword [esp]
add esp, 8
fscale
fstp st(1)
ret
Function at 0x403154
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x7ea000]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031ec
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4031cc
xor eax, eax
push ebp
push 0x4031c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403208
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031cc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x7ea000]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x7ea000], ax
mov esp, ebp
pop ebp
ret

Function at 0x4033c4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4033de
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4033de
mov ecx, dword [ecx - 0x18]
test ecx, ecx
jne 0x4033ca
mov al, 0xa
jmp fcn.00402854
ret

Function at 0x403410
Capabilities:
Terminate process

Disassembly:
cmp dword [0x84301c], 0
je 0x402cc3
call dword [0x84301c]
mov eax, 0xd2
jmp fcn.00403de4
push eax
push ecx
mov eax, dword [eax]
call fcn.004033e0
pop ecx
pop eax
je 0x40341f
jmp ebx
pop ecx
jmp 0x402cb4

Function at 0x403428
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.004033e0
mov eax, ebx
pop ebx
jne 0x40343d
pop ecx
jmp 0x402cb4
ret

Function at 0x403cc0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x843480
mov esi, 0x843030
mov edi, 0x843034
cmp byte [ebx + 0x24], 0
jne 0x403cef
cmp dword [edi], 0
je 0x403cef
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403cde
cmp dword [0x843038], 0
je 0x403d36
call fcn.00403c3c
cmp byte [0x843040], 0
je 0x403d1c
mov edx, 0x7ea034
mov eax, 0x843214
call fcn.00406a1c
call fcn.0040699f
jmp 0x403d2f
push 0
push 0x7ea054
push 0x7ea034
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
mov dword [0x843038], eax
cmp byte [ebx + 0x24], 2
jne 0x403d46
cmp dword [esi], 0
jne 0x403d46
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403af4
cmp byte [ebx + 0x24], 1
jbe 0x403d56
cmp dword [esi], 0
je 0x403d73
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403d73
call fcn.00405e04
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 8]
cmp edx, dword [eax + 4]
je 0x403d73
push edx
call sub.KERNEL32.DLL_FreeLibrary
call fcn.00403acc
cmp byte [ebx + 0x24], 1
jne 0x403d81
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403d8c
call fcn.00403c8c
cmp dword [ebx], 0
jne 0x403d99
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403d36

Function at 0x403dd8
Capabilities:
Terminate process

Disassembly:
mov dword [0x843030], eax
jmp fcn.00403cc0
Function at 0x403e28
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027d4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x843041], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403df0
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404598
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.0040455c
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.0040455c
push ecx
push edx
push eax
call sub.OLEAUT32.DLL_SysReAllocStringLen
test eax, eax
je 0x404544
ret

Function at 0x404640
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402854
test ecx, ecx
je fcn.0040455c
push ecx
push edx
push eax
call sub.OLEAUT32.DLL_SysReAllocStringLen
test eax, eax
je 0x404544
ret

Function at 0x40468c
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
test edx, edx
je 0x4046bf
push edx
cmp cx, word [edx]
je 0x4046b8
cmp cx, word [edx + 2]
je 0x4046b5
cmp cx, word [edx + 4]
je 0x4046b2
cmp cx, word [edx + 6]
je 0x4046af
add edx, 8
jmp 0x404693
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.00404640

Function at 0x4046f4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x404708
push eax
push 0
call sub.OLEAUT32.DLL_SysAllocStringLen
test eax, eax
je 0x404544
ret

Function at 0x404750
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x40476e
push eax
mov ecx, dword [edx - 4]
shr ecx, 1
push ecx
push edx
call sub.OLEAUT32.DLL_SysAllocStringLen
pop edx
test eax, eax
je 0x404544
mov dword [edx], eax
ret

Function at 0x40479c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4047d6
cmp al, 0xb
je 0x4047d6
cmp al, 0xc
je 0x4047e0
cmp al, 0xd
je 0x4047f3
cmp al, 0xe
je 0x404811
cmp al, 0xf
je 0x4047d6
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402854
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4047d6
jmp 0x404825
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4047e0
jmp 0x404825
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.0040479c
dec edi
jg 0x4047f6
pop ebp
jmp 0x404825
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404770
dec edi
jg 0x404814
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40482c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.0040479c
Function at 0x404864
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40489e
cmp al, 0xb
je 0x4048b5
cmp al, 0xc
je 0x4048cc
cmp al, 0xd
je 0x4048db
cmp al, 0xe
je 0x4048f9
cmp al, 0xf
je 0x40490f
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402854
cmp ecx, 1
mov eax, ebx
jg 0x4048ac
call fcn.00403e74
jmp 0x40491c
mov edx, ecx
call fcn.00403e98
jmp 0x40491c
cmp ecx, 1
mov eax, ebx
jg 0x4048c3
call fcn.0040455c
jmp 0x40491c
mov edx, ecx
call fcn.00404574
jmp 0x40491c
mov eax, ebx
add ebx, 0x10
call fcn.00405748
dec edi
jg 0x4048cc
jmp 0x40491c
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404864
dec edi
jg 0x4048de
pop ebp
jmp 0x40491c
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404838
dec edi
jg 0x4048fc
pop ebp
jmp 0x40491c
mov eax, ebx
add ebx, 4
call fcn.00405eb8
dec edi
jg 0x40490f
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404924
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404864

Function at 0x40495c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404994
cmp al, 0xb
je 0x4049a3
cmp al, 0xc
je 0x4049b2
cmp al, 0xd
je 0x4049c1
cmp al, 0xe
je 0x4049df
cmp al, 0xf
je 0x4049f5
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402854
mov eax, dword [ebx]
add ebx, 4
call fcn.004042a4
dec edi
jg 0x404994
jmp 0x404a02
mov eax, ebx
add ebx, 4
call fcn.00404750
dec edi
jg 0x4049a3
jmp 0x404a02
mov eax, ebx
add ebx, 0x10
call fcn.00405750
dec edi
jg 0x4049b2
jmp 0x404a02
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40495c
dec edi
jg 0x4049c4
pop ebp
jmp 0x404a02
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404930
dec edi
jg 0x4049e2
pop ebp
jmp 0x404a02
mov eax, dword [ebx]
add ebx, 4
call fcn.00405f18
dec edi
jg 0x4049f5
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40495c
Function at 0x404a08
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404994
cmp al, 0xb
je 0x4049a3
cmp al, 0xc
je 0x4049b2
cmp al, 0xd
je 0x4049c1
cmp al, 0xe
je 0x4049df
cmp al, 0xf
je 0x4049f5
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402854
mov eax, dword [ebx]
add ebx, 4
call fcn.004042a4
dec edi
jg 0x404994
jmp 0x404a02
mov eax, ebx
add ebx, 4
call fcn.00404750
dec edi
jg 0x4049a3
jmp 0x404a02
mov eax, ebx
add ebx, 0x10
call fcn.00405750
dec edi
jg 0x4049b2
jmp 0x404a02
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40495c
dec edi
jg 0x4049c4
pop ebp
jmp 0x404a02
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404930
dec edi
jg 0x4049e2
pop ebp
jmp 0x404a02
mov eax, dword [ebx]
add ebx, 4
call fcn.00405f18
dec edi
jg 0x4049f5
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40495c

Function at 0x404a14
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404a40
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402a38
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404a72
cmp cl, 0xb
je 0x404a83
cmp cl, 0xc
je 0x404a94
cmp cl, 0xd
je 0x404aa5
cmp cl, 0xe
je 0x404ac5
cmp cl, 0xf
je 0x404ade
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402854
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403ec8
mov eax, 4
jmp 0x404aed
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404598
mov eax, 4
jmp 0x404aed
lea edx, [esi + eax]
add eax, ebx
call fcn.00404d90
mov eax, 0x10
jmp 0x404aed
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404b10
pop eax
jmp 0x404aed
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404a14
pop eax
jmp 0x404aed
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405ed0
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404a2e
pop ecx
sub ecx, eax
jle 0x404b09
lea edx, [ebx + eax]
add eax, esi
call fcn.00402a38
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404b10
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404b4d
cmp cl, 0xb
je 0x404b61
cmp cl, 0xc
je 0x404b75
cmp cl, 0xd
je 0x404b89
cmp cl, 0xe
je 0x404baa
cmp cl, 0xf
je 0x404bc7
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402854
mov eax, ebx
mov edx, dword [esi]
call fcn.00403ec8
add ebx, 4
add esi, 4
dec ebp
jne 0x404b4d
jmp 0x404bd9
mov eax, ebx
mov edx, dword [esi]
call fcn.00404598
add ebx, 4
add esi, 4
dec ebp
jne 0x404b61
jmp 0x404bd9
mov eax, ebx
mov edx, esi
call fcn.00404d90
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404b75
jmp 0x404bd9
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404b10
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404b92
jmp 0x404bd9
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404a14
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404baa
jmp 0x404bd9
mov eax, ebx
mov edx, dword [esi]
call fcn.00405ed0
add ebx, 4
add esi, 4
dec ebp
jne 0x404bc7
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x404d90
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402854
cmp eax, edx
je 0x404e00
cmp word [eax], 8
jb 0x404db5
push eax
push edx
cmp word [eax], 0x100
je 0x404dab
push eax
call sub.OLEAUT32.DLL_VariantClear
jmp 0x404db3
add eax, 8
call fcn.00403e74
pop edx
pop eax
cmp word [edx], 8
jae 0x404dcc
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x404dec
mov edx, dword [edx + 8]
or edx, edx
je 0x404de3
mov ecx, dword [edx - 8]
inc ecx
jle 0x404de3
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.OLEAUT32.DLL_VariantCopyInd
or eax, eax
jne 0x404d54
ret

Function at 0x40514c
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.00405eb8
cmp word [edx], 0xd
je 0x40517e
cmp word [edx], 9
je 0x40517e
cmp word [edx], 0x400d
je 0x405174
cmp word [edx], 0x4009
jne fcn.00404d4c
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00405ed0
mov edx, dword [edx + 8]
jmp fcn.00405ed0

Function at 0x4052bc
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0x100
jne fcn.00404d90
cmp word [eax], 8
jb 0x4052d6
push eax
push edx
call fcn.00404d5c
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov dword [eax], ecx
jmp fcn.004046c8
Function at 0x4055a8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x405385
cmp eax, 0x100
jne 0x4053d7
mov eax, 8
cmp edx, 0x11
jbe 0x405397
cmp edx, 0x100
jne 0x4053d7
mov edx, 8
mov al, byte [eax + 0x7ea06c]
mov dl, byte [edx + 0x7ea06c]
movzx ecx, byte [edx + eax*8 + 0x7ea080]
call dword [ecx*4 + 0x4053b6]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp 0x404d54
mov ecx, 0
jmp 0x40535c

Function at 0x40564c
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x405672
cmp eax, 0x100
jne case.0x405698.0
mov eax, 8
cmp edx, 0x11
jbe 0x405684
cmp edx, 0x100
jne case.0x405698.0
mov edx, 8
mov al, byte [eax + 0x7ea06c]
mov dl, byte [edx + 0x7ea06c]
movzx ecx, byte [edx + eax*8 + 0x7ea080]
jmp dword [ecx*4 + 0x40569f]
pop edi
pop esi
jmp 0x404d54
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404fb8
xchg edi, eax
call fcn.00404fb8
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00405058
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00405058
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.004050b4
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.004050b4
fld xword [esp]
add esp, 0xc
jmp 0x4056f7
mov eax, edi
mov edx, esi
call fcn.004055e4
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00405024
xchg edi, eax
call fcn.00405024
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x405b30
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405ccc
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x405be0
xor eax, eax
push ebp
push 0x405bd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x405bc2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405cec
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405be0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405cc1
cmp byte [ebp - 0xd], 0
jne 0x405c22
cmp byte [ebp - 0x12], 0
je 0x405cc1
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlen
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c3b
dec ebx
cmp byte [ebx], 0x2e
je 0x405c4a
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c3a
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405cc1
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c77
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cc1
cmp byte [ebp - 0xd], 0
je 0x405cc1
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cc1
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405eec
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00405eb8
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x405f06
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x405f15
mov al, 0x17
jmp fcn.00402854
ret

Function at 0x405f80
Capabilities:
Terminate process

Disassembly:
test eax, eax
jns 0x405f9a
mov ecx, dword [0x843014]
test ecx, ecx
je 0x405f93
mov edx, dword [esp]
call ecx
mov al, 0x18
jmp fcn.00402854
ret