joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x40db1e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x40dae0
mov eax, dword [edi]
jmp 0x40dc09
cmp eax, 0x4e0
jb 0x40dc09
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x40db40
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x40db90
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e702
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040e6de
pop esi
leave
ret 8
Function at 0x40ecc9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
push 0x105
call fcn.0040e7b6
mov edi, eax
test edi, edi
jne 0x40ecf0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, esi
jmp 0x40ed39
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
je 0x40ed34
test al, 0x10
je 0x40ed34
test eax, 0x400
je 0x40ed30
push 0x2000000
push 0x80
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0040ed3f
push dword [ebp - 4]
mov esi, eax
call fcn.0040e7f2
test esi, esi
jne 0x40ed34
xor edx, edx
jmp 0x40ed36
mov edx, ebx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x40f9cc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fa0b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fa0b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fa0b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fa0b
cmp dword [ecx + 0x74], 0xe
jbe 0x40fa0b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10020adc
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10020b8b
call fcn.1001d6c0
mov ecx, dword [0x10064ce0]
cmp ecx, 2
je 0x10020b0a
xor eax, eax
cmp ecx, 1
sete al
jmp 0x10020c05
push 0x10064a20
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
push ecx
push ecx
call fcn.1001dd8a
call fcn.1001a689
sub esp, 0xc
call fcn.1001d100
mov eax, dword [ebp + 8]
push 0x10008cdc
mov dword [0x10064cf4], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008b0c
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008aa4
mov dword [0x10064cec], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008ad4
mov dword [0x10064cf0], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008d18
mov dword [0x10064ce8], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x10064ce4], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x100645a4], eax
mov cl, 1
jmp 0x10020b92
cmp eax, 2
jne 0x10020b99
xor cl, cl
call fcn.1001478b
jmp 0x10020c02
cmp eax, 3
jne 0x10020bb1
call fcn.1001d7e2
xor cl, cl
call fcn.10013a9f
call fcn.1001d880
jmp 0x10020c02
test eax, eax
jne 0x10020c02
mov ecx, dword [0x10064ce0]
cmp ecx, 2
jne 0x10020afd
mov cl, 1
call fcn.10013a9f
call fcn.1001d7e2
call fcn.1001d880
mov eax, dword [0x100645a4]
cmp eax, 0xffffffff
je 0x10020bed
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
or dword [0x100645a4], 0xffffffff
call fcn.1001ddb5
push 0x10064a20
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
call fcn.1001cf6c
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x10029b25
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10029b61
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
in al, 0x2b
call fcn.100296d6
push eax
push esi
push dword [ebp + 8]
call fcn.1002968b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100296c6
in eax, 0xf9
pop esp

Function at 0x10029b47
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
invalid
Function at 0x10029da9
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10029d7a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10029d75
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10029d5f
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
push edi
xor al, 3
into
push edi
xor al, 3
into
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10029d67
cmp edx, ebx
jne 0x10029eb5
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10029d36
add eax, dword [eax + 4]
jmp 0x10029d23
mov dword [ebp + 0xc], ebx
jmp 0x10029d85
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10029d9d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10029dbb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10029e19
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10029e00
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10029e09
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10029e13
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10029df5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10029d7f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10029e66
dec eax
je 0x10029e5d
sub eax, 3
je 0x10029e54
mov dword [ebp - 4], 0x40
jmp 0x10029e83
mov dword [ebp - 4], 4
jmp 0x10029e69
mov dword [ebp - 4], 0x20
jmp 0x10029e69
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10029eb5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10029e35
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100296c6
cmpsd dword ss:[esi], dword es:[edi]
sbb eax, 0x1475ff91
push 1
push esi
call edi
mov eax, esi
jmp 0x10029ec1
Function at 0x10029f11
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
lodsb al, byte [esi]
cld
invalid
call dword [eax - 0x18]
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002968b
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
ror byte [ebp - 0x33243], 0xff

Function at 0x10029fa1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x33243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.100296d6
pop ecx
push eax
push dword [ebp + 0x18]
jne 0x1002a081
push dword [ebp + 0x14]
call fcn.1002968b
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
invalid
test dword [edx], ebx
cld

Function at 0x1002a28f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.100296d6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002968b
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.100296c6
pop edx
jo 0xffd8f87
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
invalid
test ebp, esi
Function at 0xd3e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d3e200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd3e0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3e0c2
add dl, dl
jne 0xd3e0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3e134
xor eax, eax
add dl, dl
jne 0xd3e0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3e1d5
add dl, dl
jne 0xd3e0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd3e12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd3e0cd
mov eax, 1
add dl, dl
jne 0xd3e142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd3e139
sub eax, ebx
mov ebx, 1
jne 0xd3e180
mov ecx, 1
add dl, dl
jne 0xd3e166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3e171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd3e15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd3e0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd3e197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3e1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd3e18e
cmp eax, 0x7d00
jae 0xd3e1c5
cmp eax, 0x500
jb 0xd3e1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd3e0cd
cmp eax, 0x7f
ja 0xd3e1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd3e0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd3e1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd3e0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4cf020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4032c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032a8
xor eax, eax
push ebp
push 0x4032a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4032e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4cf020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4cf020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403fd4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d304c], 0
je 0x404035
cmp word [0x4d3220], 0xd7b2
jne 0x403ffd
cmp dword [0x4d3228], 0
jbe 0x403ffd
mov eax, 0x4d321c
call dword [0x4d3238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4cf06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40405c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4cf030], 0
jne 0x404051
push 0
push 0x4cf064
push 0x4cf06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405984
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bb4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bb4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bd0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405a90
xor eax, eax
push ebp
push 0x405a89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004057cc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a6e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405bf0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a6e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a90
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405baa
cmp byte [ebp - 0xd], 0
jne 0x405ad7
cmp byte [ebp - 0x12], 0
je 0x405baa
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405af0
dec ebx
cmp byte [ebx], 0x2e
je 0x405aff
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405aef
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405baa
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405b3c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405baa
cmp byte [ebp - 0xd], 0
je 0x405baa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405baa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40627c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4062e2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004043c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d70
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4062cc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062e9
lea eax, [ebp - 0x10]
call fcn.00404150
ret

Function at 0x40c1c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c1f9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404240
jmp 0x40c202
mov eax, ebx
mov edx, esi
call fcn.004041a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c20c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c22d
mov al, byte [esp]
jmp 0x40c22f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c8b4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c72c
mov eax, dword [0x4d2a34]
cmp byte [eax], 0
je 0x40c930
mov eax, dword [0x4d24f0]
call fcn.00402b34
call fcn.00402920
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004092a4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c978
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c966
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4d2438]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4d3668]
call fcn.00405790
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d244
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d31a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004041e8
lea eax, [ebp - 8]
call fcn.00404660
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404610
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d304
mov eax, ebx
call fcn.004027b8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d2fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404610
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d2e7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d32c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d2e7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d304
mov eax, dword [ebp - 0x10]
call fcn.004027d8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d321
lea eax, [ebp - 8]
call fcn.00404150
ret

Function at 0x40d970
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d9d4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004043c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408ca8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d9db
lea eax, [ebp - 0xc]
call fcn.00404150
ret

Function at 0x425c78
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4d3888
cmp dword [edi], 0
jne 0x425cf4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4d3884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4cf5d0
mov ecx, 2
call fcn.004029b4
mov edx, 0x425c50
lea eax, [esi + 5]
call fcn.00425c70
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00425c70
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x425cc9
mov dword [0x4d3884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427370
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x427376
ret