joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ccd84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4ccdfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4ccde6
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4ccdc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cce03
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4cd4b4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cd564
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xc8
mov eax, ebx
call fcn.00404358
mov eax, dword [ebp - 8]
call fcn.00402768
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407890
xor eax, eax
push ebp
push 0x4cd547
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4cd531
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404550
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.0040914c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004043ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd54e
mov eax, dword [ebp - 4]
call fcn.00402788
ret

Function at 0x4cd730
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4e4584
xor eax, eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + eax*4 + 0x5ec], ecx
inc eax
cmp eax, 0x65
jne 0x4cd73b
xor edi, edi
push 0x40
mov eax, dword [ebx]
mov ecx, dword [eax + 0x3d4]
mov dl, 1
mov eax, dword [0x418a80]
call fcn.0041d5ac
mov ebp, eax
mov eax, dword [ebx]
mov dword [eax + 0x790], ebp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp + 4]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov eax, dword [ebx]
mov dword [eax + 0x798], esi
test esi, esi
je 0x4cd7b0
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebp, eax
mov eax, dword [ebx]
mov dword [eax + 0x79c], ebp
test ebp, ebp
je 0x4cd7b0
mov edi, 1
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cddd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4cde4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4cde36
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4cde19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cde53
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4cde5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.0040a108
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ce0e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4ce15c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4ce146
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4ce129
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce163
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4ce16c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffca0
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4ce24e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ce227
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x209]
mov edx, dword [ebp - 4]
call fcn.00409fb4
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402944
lea eax, [ebp - 0x309]
mov edx, dword [ebp - 8]
call fcn.00409fb4
lea eax, [ebp - 0x350]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ea4
mov dword [ebp - 0x350], 0x44
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x350]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x209]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4ce219
xor ebx, ebx
call fcn.00403da0
jmp 0x4ce233
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce22e
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce255
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040437c
ret
Function at 0x4d09d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d0b7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 8
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov edx, 0x4d0b94
call fcn.00404764
je 0x4d0b62
mov eax, dword [ebp - 4]
mov edx, 0x4d0ba0
call fcn.00404764
jne 0x4d0a58
push 1
push 0
push 0
lea ecx, [ebp - 8]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
call fcn.00404818
push eax
push 0x4d0ba4
mov eax, esi
call fcn.0045d65c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d0b62
mov eax, dword [ebp - 4]
mov edx, 0x4d0bb4
call fcn.00404764
jne 0x4d0a83
lea ecx, [ebp - 0xc]
mov edx, 0xa
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00433774
jmp 0x4d0b62
mov eax, dword [ebp - 4]
mov edx, 0x4d0bc0
call fcn.00404764
jne 0x4d0ade
lea ecx, [ebp - 0x10]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00433774
push 1
push 0
push 0
lea ecx, [ebp - 0x14]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404818
push eax
push 0x4d0ba4
mov eax, esi
call fcn.0045d65c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d0b62
mov eax, dword [ebp - 4]
mov edx, 0x4d0bcc
call fcn.00404764
jne 0x4d0b62
push 4
lea ecx, [ebp - 0x18]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00404818
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4e2150]
mov eax, dword [eax]
call fcn.00476e38
mov eax, dword [ebp - 0x1c]
call fcn.00404818
mov ecx, eax
mov eax, dword [0x4e2150]
mov eax, dword [eax]
pop edx
call fcn.004774b4
cmp eax, 6
jne 0x4d0b62
push 1
push 0
push 0
lea ecx, [ebp - 0x20]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404818
push eax
push 0x4d0ba4
mov eax, esi
call fcn.0045d65c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0b84
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.0040437c
ret

Function at 0x4d18d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4d1948
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4d1932
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4d1915
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d194f
lea eax, [ebp - 4]
call fcn.00404358
ret
Function at 0x4d36cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4d3744
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4d372e
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4d3711
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d374b
lea eax, [ebp - 4]
call fcn.00404358
ret
Function at 0x401af0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcA]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x411360], 0x40e050
mov dword [0x410bf8], 0x4112f0
mov ecx, dword [esp + 0xd4]
mov dword [0x4112f0], 0x84
push ecx
push ebx
push 0x4112f0
mov dword [0x411354], 0x300
call fcn.00401df0
mov ebp, dword [sym.imp.KERNEL32.dll_HeapCreate]
push ebx
push ebx
push ebx
call ebp
mov dword [0x411308], eax
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x3c]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x40], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x4c], 2
jne 0x401bac
cmp dword [esp + 0x40], 5
jae 0x401c0f
mov eax, dword [esp + 0x2c]
cmp eax, 1
jbe 0x401c0f
lea edx, [eax + eax]
or ecx, 0xffffffff
xor eax, eax
test edx, 0x80000000
jne 0x401bcf
shl edx, 1
shr ecx, 1
inc eax
cmp eax, 0x20
jl 0x401bbd
mov edx, dword [0x411308]
shr ecx, 1
mov dword [0x411364], ecx
lea ecx, [ecx*4 + 4]
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x411368], eax
xor esi, esi
push ebx
push ebx
push ebx
call ebp
mov ecx, dword [0x411368]
inc esi
mov dword [ecx + esi*4 - 4], eax
mov eax, dword [0x411364]
cmp esi, eax
jbe 0x401bf4
jmp 0x401c1b
mov dword [0x411368], ebx
mov dword [0x411364], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xc
mov dword [0x411374], eax
mov dword [0x411378], ebx
call fcn.004065d3
add esp, 4
cmp eax, ebx
je 0x401c44
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x401c46
xor eax, eax
cmp eax, ebx
mov dword [0x411378], eax
je 0x401c55
mov dword [0x41137c], ebx
mov edx, dword [esp + 0xe0]
mov eax, dword [esp + 0xdc]
push edx
push eax
call fcn.00401040
mov ecx, dword [0x410bf8]
add esp, 8
add ecx, 0x1c
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41137c]
cmp eax, ebx
je 0x401c9d
cmp dword [eax + 4], ebx
jle 0x401c9d
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x41137c]
mov esi, eax
cmp esi, ebx
je 0x401cb3
mov ecx, esi
call fcn.00402430
push esi
call fcn.00405f00
add esp, 4
mov ecx, dword [0x410bf8]
mov dword [0x41137c], ebx
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x411378]
cmp esi, ebx
je 0x401ce3
mov ecx, esi
call fcn.00402450
push esi
call fcn.00405f00
add esp, 4
push 0x4112f0
call fcn.00401f60
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret 0x10
Function at 0x403090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x4030b2
mov dl, byte [esp + 0x10]
mov ecx, dword [esp + 8]
push ebx
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, esi
jl 0x4030a4
pop ebx
pop esi
ret 0xc
Function at 0x403a10
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x1a8], 0
call fcn.00403920
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov edx, dword [esi + 0x1cc]
push 0
push edx
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x1cc]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xc8
push 1
push eax
call edi
mov ecx, dword [esi + 0x1cc]
push 0
push 0xc8
push 2
push ecx
call edi
pop edi
pop esi
ret
Function at 0x405c80
Capabilities:
Create process on windows

Disassembly:
push str.Microsoft_Internet_Explorer
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ecx, dword [esp + 4]
push 0
push 0
push 0
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10690
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x10610
call dword [sym.imp.ntoskrnl.exe_vsprintf]
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, 0x10610
add eax, 0xffffffff
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 1]
mov byte [ebp - 9], dl
inc dword [ebp - 8]
cmp byte [ebp - 9], 0
jne 0x106c7
mov edi, dword [ebp - 8]
mov ax, word [section.PAGE]
mov word [edi], ax
push 0x10610
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10a90
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push 0x10a40
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x22
lea ecx, [ebp - 0x24]
push ecx
push 0x14
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x10adb
mov eax, dword [ebp - 0x18]
jmp 0x10b50
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
or ecx, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 8], eax
push 0x10a68
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x10]
mov dword [edx + 0x10], ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x10b4e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [ebp - 0x18]
jmp 0x10b50
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10c40
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push 0x10c20
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8

Function at 0x10f05
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10604]
test eax, eax
mov ecx, 0xbb40
je 0x10f1c
cmp eax, ecx
jne 0x10f3f
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x10604
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x10604], eax
jne 0x10f3f
mov eax, ecx
mov dword [0x10604], eax
not eax
mov dword [section..data], eax
pop ebp
jmp 0x10ba0
Function at 0x50802f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x50851020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x50802fe8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x50802fc8
xor eax, eax
push ebp
push 0x50802fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x50803004
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50802fc8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x50851020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x50851020], ax
mov esp, ebp
pop ebp
ret

Function at 0x50803c94
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50853048], 0
je 0x50803cf5
cmp word [0x5085321c], 0xd7b2
jne 0x50803cbd
cmp dword [0x50853224], 0
jbe 0x50803cbd
mov eax, 0x50853218
call dword [0x50853234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x5085106c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x50803d1c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x50851030], 0
jne 0x50803d11
push 0
push 0x50851064
push 0x5085106c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x50805070
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x508052a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x508050f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x508052a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x508050f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x508052bc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x5080517c
xor eax, eax
push ebp
push 0x50805175
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.50804eb8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x5080515a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x508052dc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x5080515a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5080517c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x50805296
cmp byte [ebp - 0xd], 0
jne 0x508051c3
cmp byte [ebp - 0x12], 0
je 0x50805296
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x508051dc
dec ebx
cmp byte [ebx], 0x2e
je 0x508051eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x508051db
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x50805296
inc ebx
cmp byte [ebp - 0x12], 0
je 0x50805228
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x50805296
cmp byte [ebp - 0xd], 0
je 0x50805296
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x50805296
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret