joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5a3c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c5a518
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc5a3ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc5a3da
add dl, dl
jne 0xc5a3f9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc5a44c
xor eax, eax
add dl, dl
jne 0xc5a406
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc5a4ed
add dl, dl
jne 0xc5a415
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc5a420
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc5a42b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc5a436
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc5a442
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc5a3e5
mov eax, 1
add dl, dl
jne 0xc5a45a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc5a465
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc5a451
sub eax, ebx
mov ebx, 1
jne 0xc5a498
mov ecx, 1
add dl, dl
jne 0xc5a47e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc5a489
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc5a475
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc5a3e5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc5a4af
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc5a4ba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc5a4a6
cmp eax, 0x7d00
jae 0xc5a4dd
cmp eax, 0x500
jb 0xc5a4d8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc5a3e5
cmp eax, 0x7f
ja 0xc5a4e0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc5a3e5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc5a50e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc5a3e5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4033a1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x4033ce
mov ecx, dword [0x7ca2d8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x79fc08], eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004034cc
cmp eax, edi
jl 0x4034c5
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x40a594]
call ebx
test eax, eax
je 0x4034c2
cmp dword [ebp - 4], esi
jne 0x4034c2
push dword [ebp + 8]
add dword [0x79fc08], esi
call fcn.004034cc
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x4034c5
cmp dword [ebp + 0x10], edi
jne 0x403491
cmp dword [ebp + 8], edi
jle 0x4034bd
mov esi, 0x79bbc4
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403441
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x40a594]
call ebx
test eax, eax
je 0x4034c2
cmp edi, dword [ebp - 4]
jne 0x4034c2
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40348d
cmp dword [ebp + 0x14], edi
jne 0x40348d
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x79fc08], eax
cmp dword [ebp + 8], 0
jg 0x403434
jmp 0x4034bd
push 0xfffffffffffffffe
jmp 0x4034c4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40349c
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a594]
call ebx
test eax, eax
je 0x4034c2
mov eax, dword [ebp - 4]
add dword [0x79fc08], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4034c5
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4034cc
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x79fc08]
mov ebx, eax
sub esi, dword [0x4152fc]
add ebx, 0x1f4
add esi, dword [esp + 0x38]
cmp esi, edi
jle 0x4036ca
push dword [0x7a7c14]
call fcn.0040370d
push edi
push edi
push dword [0x4152fc]
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x7a7c10], esi
mov dword [0x79fc04], edi
mov eax, dword [0x79fc0c]
mov ebp, 0x4000
sub eax, dword [0x7a7c14]
cmp eax, ebp
jg 0x403540
mov ebp, eax
mov esi, 0x79bbc4
push ebp
push esi
call fcn.004036db
test eax, eax
je 0x40368b
add dword [0x7a7c14], ebp
mov dword [0x415300], esi
mov dword [0x415304], ebp
cmp dword [0x7ca288], edi
je 0x4035fe
cmp dword [0x7ca320], edi
jne 0x4035fe
cmp dword [esp + 0x10], edi
je 0x4035cb
mov eax, dword [0x7a7c10]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
sub eax, dword [0x79fc08]
push 1
push edi
push edi
sub eax, dword [esp + 0x44]
push edi
add eax, dword [0x4152fc]
mov dword [0x79fc04], eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x4035fe
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
jmp 0x4035ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x4035fe
mov eax, dword [0x7ca284]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402fdb
push edi
push 0x6f
push dword [0x7ca280]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x415300
mov dword [0x415308], 0x793bc4
mov dword [0x41530c], 0x8000
call fcn.004065a4
test eax, eax
jl 0x4036d6
mov esi, dword [0x415308]
mov eax, 0x793bc4
sub esi, eax
je 0x403665
lea ecx, [esp + 0x14]
push edi
push ecx
push esi
push eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403690
cmp esi, dword [esp + 0x14]
jne 0x403690
add dword [0x4152fc], esi
cmp dword [0x415304], edi
jne 0x403566
jmp 0x403671
cmp dword [0x415304], edi
jne 0x4036d6
cmp ebp, edi
je 0x4036d6
mov eax, dword [0x79fc08]
mov ecx, eax
sub ecx, dword [0x4152fc]
add ecx, dword [esp + 0x38]
test ecx, ecx
jle 0x403694
jmp 0x40352a
or eax, 0xffffffff
jmp 0x4036cc
push 0xfffffffffffffffe
jmp 0x4036d8
push edi
push edi
push eax
push dword [0x40a594]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
cmp esi, edi
je 0x4036ca
mov eax, dword [0x7a7c10]
push edi
push edi
push 0x113
push esi
mov dword [0x79fc04], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
push 0xfffffffffffffffd
pop eax
jmp 0x4036cc
Function at 0x403dea
Capabilities:
Identify system language via api

Disassembly:
push ecx
cmp byte [0x7fb000], 0
push ebx
push ebp
push esi
push edi
mov ebx, pe_overlay
mov ebp, 0x7fb000
je 0x403e0a
push ebp
call fcn.004060a6
jmp 0x403e10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 0x10], eax
xor esi, esi
mov edi, dword [0x7ca2c4]
mov eax, edi
dec edi
test eax, eax
je 0x403e6c
mov eax, dword [0x7ca288]
mov ecx, dword [eax + 0x64]
mov edx, ecx
imul ecx, edi
neg edx
add ecx, dword [0x7ca2c0]
mov ax, word [esp + 0x10]
mov esi, ecx
xor ax, word [ecx]
and eax, ebx
test ax, ax
je 0x403e54
mov eax, edi
dec edi
add ecx, edx
test eax, eax
jne 0x403e38
jmp 0x403e6c
mov eax, dword [esi + 2]
mov dword [0x7c6260], eax
mov eax, dword [esi + 6]
mov dword [0x7ca328], eax
lea eax, [esi + 0xa]
mov dword [0x7c625c], eax
cmp dword [0x7c625c], 0
jne 0x403e87
cmp bx, 0xffff
jne 0x403e83
mov ebx, 0x3ff
jmp 0x403e16
xor ebx, ebx
jmp 0x403e16
movzx eax, word [esi]
push eax
push ebp
call fcn.0040608d
push 0xfffffffffffffffe
push 0x7c6280
call fcn.0040614e
push eax
push dword [0x7b3c28]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x7ca2ac]
mov esi, dword [0x7ca2a8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403edb
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403ed4
push eax
push ebx
call fcn.0040614e
add esi, edi
add ebx, edi
dec ebp
jne 0x403ec7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405948
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x7b8c50], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x40596c
test al, 0x10
jne 0x40596f
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x7b8c50
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40599a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405a29
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405d0f
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x405a5d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7ca308], eax
jmp 0x405c26
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x405a7b
test eax, eax
je 0x405baa
test byte [ebp + 0xc], 2
je 0x405baa
mov esi, 0x7b4c50
push edi
push esi
call fcn.00406130
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405a9b
push str..
push esi
call ebx
jmp 0x405aa1
push edi
call fcn.00405c74
push 0x40a228
push edi
call ebx
push edi
call fcn.00406141
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ba0
cmp byte [ebp - 0x118], 0x2e
jne 0x405aef
cmp byte [ebp - 0x117], 0x2e
je 0x405b83
cmp byte [ebp - 0x117], 0
je 0x405b83
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.00406130
test byte [ebp - 0x144], 0x10
je 0x405b1a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b83
push dword [ebp + 0xc]
push edi
call fcn.00405a29
jmp 0x405b83
push edi
push str.Delete:_DeleteFile___s__
call fcn.004064d4
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405b7b
test byte [ebp + 0xc], 4
push edi
je 0x405b67
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.004064d4
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405423
push 0
push edi
call fcn.00405e6c
jmp 0x405b83
push str.Delete:_DeleteFile_failed___s__
call fcn.004064d4
inc dword [0x7ca308]
pop ecx
pop ecx
jmp 0x405b83
push edi
push 0xfffffffffffffff2
call fcn.00405423
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405acc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405baa
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x405c26
cmp dword [ebp - 4], esi
push edi
jne 0x405bcc
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.004064d4
inc dword [0x7ca308]
pop ecx
pop ecx
jmp 0x405c26
call fcn.004064f0
test eax, eax
je 0x405c26
push edi
call fcn.00405c2c
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.004064d4
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405c1e
test byte [ebp + 0xc], 4
push edi
je 0x405c17
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.004064d4
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405423
push esi
push edi
call fcn.00405e6c
jmp 0x405c26
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405bbd
push edi
push 0xffffffffffffffe5
call fcn.00405423
pop edi
pop esi
leave
ret 8
Function at 0x405d0f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7b6c50
push esi
call fcn.00406130
push esi
call fcn.00405cc0
test eax, eax
jne 0x405d2e
xor eax, eax
jmp 0x405d7d
test byte [0x7ca290], 0x80
je 0x405d42
mov cl, byte [eax]
test cl, cl
je 0x405d2a
cmp cl, 0x5c
je 0x405d2a
mov edi, eax
sub edi, esi
push esi
call fcn.00406141
cmp eax, edi
push esi
jle 0x405d67
call fcn.004064f0
test eax, eax
je 0x405d5f
test byte [eax], 0x10
je 0x405d2a
push esi
call fcn.00405c74
jmp 0x405d46
call fcn.00405c2c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405df4
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405e23
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405e68
mov eax, edi
dec edi
test eax, eax
jne 0x405e2e
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405e62
Function at 0x405e6c
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405ea4
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405ea4
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405fe9
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x7b95d8], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x7b95d8
je 0x405ee8
push 1
push 0
push esi
call fcn.00405df4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405fef
cmp eax, edi
jg 0x405fef
mov esi, 0x7b91d8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405fef
cmp eax, edi
jg 0x405fef
push esi
push ebp
push str._s_s_r_n
push 0x7b8dd8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405fe9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x405fd1
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x405fc5
push str._Rename__r_n
push edi
call fcn.00405d82
test eax, eax
jne 0x405ff6
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.00406130
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x7b8dd8
push eax
call fcn.00405dce
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x7ca310]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40a9d8
push eax
call fcn.00405d82
test eax, eax
je 0x405fac
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x40601f
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x406012
sub eax, edi
jmp 0x405fae
Function at 0x406023
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406087
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406076
cmp dword [ebp + 0x14], 1
je 0x406078
cmp dword [ebp + 0x14], 2
je 0x406078
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406436
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40645b
mov eax, dword [0x40a8d4]
cmp eax, 0xffffffff
je 0x406452
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8d4], 0xffffffff
jmp 0x4064cf
cmp dword [0x7ba1e0], ebx
je 0x4064cf
cmp byte [0x7b9de0], bl
je 0x40649a
cmp dword [0x40a8d4], 0xffffffff
jne 0x4064a3
push 4
push 0x40000000
push 0x7b9de0
call fcn.00405df4
cmp eax, 0xffffffff
mov dword [0x40a8d4], eax
je 0x4064cf
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8d4], 0xffffffff
je 0x4064cf
push esi
mov esi, 0x7be220
push 0x40aaa8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00406141
push eax
push esi
push dword [0x40a8d4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40652e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x7b99dc], esi
push edi
jne 0x406568
mov ecx, 0x7b99d8
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406544
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x7b9dd8
jl 0x40653f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40659d
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7b99d8]
xor eax, esi
inc ecx
dec edx
jne 0x406580
pop edi
pop esi
not eax
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402a30
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043cc
test esi, esi
jne 0x402a66
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004044bc
jmp 0x402a84
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402944
mov edi, eax
test esi, esi
je 0x402a84
cmp dword [ebx], 0
je 0x402a84
dec esi
jmp 0x402a6d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4034d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46e00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403568
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403548
xor eax, eax
push ebp
push 0x403541
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403584
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403548
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46e00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46e00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404250
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x470048], 0
je 0x4042b1
cmp word [0x47021c], 0xd7b2
jne 0x404279
cmp dword [0x470224], 0
jbe 0x404279
mov eax, 0x470218
call dword [0x470234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46e054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042d8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46e01c], 0
jne 0x4042cd
push 0
push 0x46e074
push 0x46e054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40b464
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b49d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044bc
jmp 0x40b4a6
mov eax, ebx
mov edx, esi
call fcn.00404420
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b4b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4d1
mov al, byte [esp]
jmp 0x40b4d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bb58
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b9d0
mov eax, dword [0x46f908]
cmp byte [eax], 0
je 0x40bbc5
mov eax, dword [0x46f73c]
call fcn.00402dec
call fcn.00402870
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408c30
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc0c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bbfb
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46f6f4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x470714]
call fcn.00405b18
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c928
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c98c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404634
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004086e4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c993
lea eax, [ebp - 0xc]
call fcn.004043cc
ret