joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e00b3a7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
jne 0x2e00b3ba
push 0xd
pop eax
jmp 0x2e00b3e5
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x2e00b3bd
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x2e00bbc2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x2e006e74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.2e00b313
mov ebx, eax
cmp ebx, esi
je 0x2e00bc2d
lea ecx, [ebp - 0x20c]
call fcn.2e00b29e
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e005b14
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x2e00bc4b
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.2e00bbc2
cmp eax, esi
jne 0x2e00bc92
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x2e00bc35
lea ecx, [ebp - 0x20c]
call fcn.2e00b29e
push dword [ebp - 0x214]
mov ecx, edi
call fcn.2e00b217
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.2e00b29e
mov eax, esi
jmp 0x2e00bc1c
Function at 0x2e00c660
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x2e006e74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x224], ebx
mov dword [ebx], esi
cmp eax, esi
jne 0x2e00c692
mov dword [ebp - 0x210], esi
jmp 0x2e00c6a4
push 0xc8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x210], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x220], esi
call sub.MSVCR90.dll_memset
mov eax, dword [0x2e013160]
add esp, 0xc
lea edx, [ebp - 0x220]
push edx
mov dword [ebp - 0x218], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, esi
mov dword [ebp - 0x21c], eax
mov edi, 0x2e0130c0
jl 0x2e00c81a
mov eax, dword [ebp - 0x220]
cmp eax, esi
jne 0x2e00c70c
mov dword [ebp - 0x21c], 0x8000ffff
jmp 0x2e00c81a
mov ecx, dword [eax]
lea edx, [ebp - 0x228]
push edx
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0x20]
cmp eax, esi
mov dword [ebp - 0x21c], eax
jl 0x2e00c81a
cmp dword [ebp - 0x218], esi
je 0x2e00c768
push dword [ebp - 0x218]
mov ecx, edi
call fcn.2e00bff2
cmp dword [ebp - 0x210], esi
je 0x2e00c75e
push esi
push esi
push 0x184
push dword [ebp - 0x210]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov ecx, edi
call fcn.2e00bae3
mov dword [ebx], eax
cmp dword [ebp - 0x210], esi
je 0x2e00c81a
cmp dword [ebx], esi
jbe 0x2e00c81a
push dword [ebp - 0x210]
push 0x2e00bdc9
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x214], esi
cmp dword [ebx], esi
jbe 0x2e00c80f
push dword [ebp - 0x214]
mov ecx, edi
call fcn.2e00bb24
mov eax, dword [eax]
cmp eax, esi
jbe 0x2e00c7ff
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x2e00c7f9
xor eax, eax
push 0x104
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameW
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x180
push dword [ebp - 0x210]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x224]
inc dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebx]
jb 0x2e00c797
push dword [ebp - 0x210]
call fcn.2e00add1
mov ecx, edi
call fcn.2e002b07
mov eax, dword [ebp - 0x220]
pop edi
cmp eax, esi
pop esi
pop ebx
je 0x2e00c834
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
call fcn.2e005b14
leave
ret 8
Function at 0x2e00cae1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x2e006e74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [0x2e0130c4]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
xor esi, esi
mov edi, 0x2e0130c4
test eax, eax
jne 0x2e00cb69
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push esi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push 0x5c
push eax
call dword [sym.imp.MSVCR90.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, esi
je 0x2e00cb69
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x804]
push eax
mov ecx, edi
call fcn.2e004baa
push edi
lea ecx, [ebp - 0x808]
call fcn.2e00c233
mov eax, dword [ebp + 8]
dec eax
je 0x2e00cb85
dec eax
jne 0x2e00cbf9
push 0x2e005240
jmp 0x2e00cb8a
push 0x2e00abc0
lea ecx, [ebp - 0x808]
call fcn.2e004baa
push 0x40
lea eax, [ebp - 0x858]
push esi
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
mov dword [ebp - 0x818], esi
lea edi, [ebp - 0x814]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x85c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push dword [ebp - 0x808]
mov dword [ebp - 0x85c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x818]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x814]
call esi
push dword [ebp - 0x808]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e005b14
leave
ret 8
Function at 0x2e00da77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x2e006e74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x408], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x40c], eax
cmp eax, edi
jne 0x2e00dad0
call fcn.2e00b12b
mov esi, eax
jmp 0x2e00dbb1
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x2e00dae9
call fcn.2e00b12b
jmp 0x2e00dba3
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x2e00dadf
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x2e00db4e
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x2e00db2b
lea ecx, [ebp - 0x408]
call fcn.2e00ba91
mov esi, 0x8007000e
lea ecx, [ebp - 0x410]
call fcn.2e004f3f
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e005b14
leave
ret 0x10
push eax
lea ecx, [ebp - 0x408]
call fcn.2e00c609
cmp dword [ebp - 0x408], edi
jne 0x2e00db69
mov esi, 0x8007000e
jmp 0x2e00dba5
push esi
push dword [ebp - 0x408]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x2e00dadf
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x418]
call fcn.2e00d8ca
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x2e00db30
lea ecx, [ebp - 0x408]
call fcn.2e00ba91
jmp 0x2e00db30
Function at 0x2e00fea4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x2e00ff28
call fcn.2e0064ad
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x2e00fee2
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x2e00fee2
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x2e00fee2
mov eax, dword [ecx + 0x50]
jmp 0x2e00ff03
mov ecx, 0x4550
cmp dx, cx
jne 0x2e00ff0f
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x2e00ff0f
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x2e00ff0f
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x2e00ff13
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.2e0064f2
ret 4

Function at 0x2e01044b
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x2e0104ab
cmp eax, edi
je 0x2e0104ab
push edi
push edi
push edi
push 2
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
je 0x2e0104ab
cmp eax, edi
je 0x2e0104ab
push edi
push edi
push edi
push 4
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
inc eax
jmp 0x2e0104ad
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x401f30
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408054
call sym._EnterCriticalSection_4
mov ebx, dword [0x40804c]
sub esp, 4
test ebx, ebx
je 0x401f7b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f74
test esi, esi
je 0x401f74
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f50
mov dword [esp], 0x408054
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402160
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4021b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402288
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4021ee
cmp eax, 4
jne 0x402210
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4021fe
cmp edx, 4
je 0x4021fe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402160
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402e44
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x42f008], 0x8088405
inc edx
mov dword [ebx + 0x42f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403030
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x40304e
push dword [eax]
call sub.kernel32.dll_SetEndOfFile
dec eax
je 0x403058
jmp fcn.004026ec
mov eax, 0x67
jmp fcn.004026dc
ret

Function at 0x403974
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x42f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a0c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4039ec
xor eax, eax
push ebp
push 0x4039e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a28
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x42f024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x42f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40440c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x43604c], 0
je 0x40446d
cmp word [0x436220], 0xd7b2
jne 0x404435
cmp dword [0x436228], 0
jbe 0x404435
mov eax, 0x43621c
call dword [0x436238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42f0bc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404494
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x42f030], 0
jne 0x404489
push 0
push 0x42f0b4
push 0x42f0bc
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405c98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405dbc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c0f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405dbc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c0f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405dd8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405c98
xor eax, eax
push ebp
push 0x405c91
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004059d4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c76
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405df8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c76
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c98
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405db2
cmp byte [ebp - 0xd], 0
jne 0x405cdf
cmp byte [ebp - 0x12], 0
je 0x405db2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405cf8
dec ebx
cmp byte [ebx], 0x2e
je 0x405d07
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405cf7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405db2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405d44
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405db2
cmp byte [ebp - 0xd], 0
je 0x405db2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405db2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405fcc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406032
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004047f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040305c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40601c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406039
lea eax, [ebp - 0x10]
call fcn.00404588
ret
Function at 0x41cd50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x41ce95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0041ccf8
lea eax, [ebp - 8]
call fcn.0041ccf8
mov eax, dword [ebp - 0xc]
call fcn.00404588
cmp dword [ebp - 4], 0
je 0x41cdb4
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x41ceac
call fcn.00404894
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x41ceb8
call fcn.00404894
mov eax, dword [ebp - 0x1c]
call fcn.00404a48
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41ce6d
mov dword [ebp - 0x14], 0x4000
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00404bd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.00404aa0
mov edx, 1
dec edx
test eax, eax
je 0x41ce14
cmp edx, dword [eax - 4]
jb 0x41ce19
call fcn.00403a44
inc edx
lea eax, [eax + edx - 1]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41ce44
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x41ce6d
mov edx, dword [ebp - 0x14]
sub edx, 1
jno 0x41ce51
call fcn.00403a4c
lea eax, [ebp - 0x18]
call fcn.00404bd4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004045dc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ce9c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004045ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045ac
ret