joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9063086
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2ae1
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
mov eax, dword [esi + 4]
add eax, 0x78
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x13e8], edi
mov dword [ebp - 0x13e4], esi
call fcn.09029bb6
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x906310a
mov eax, dword [esi + 4]
push 0
push 0x753
push 0xb71b
push eax
call fcn.09029bb6
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.0900e991
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop ecx
div ecx
mov ecx, dword [ebp - 0x13d8]
add dword [ebp - 0x13d4], 0x8000
add dword [ebp - 0x13d8], 2
cmp dword [ebp - 0x13d4], 0xc800c
mov word [ecx], ax
jb 0x906312e
and dword [ebp - 0x13d8], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
jmp 0x906317f
mov edi, dword [ebp - 0x13e8]
mov esi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13dc], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13dc]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x906319d
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x906319b
push 0
mov eax, 0x504c4142
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, esi
call fcn.09029bb6
push 1
push 0x753
push dword [ebp - 0x13d8]
lea ecx, [ebp - 0x1408]
push dword [edi]
call fcn.09029bb6
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 1
call fcn.09005145
lea edi, [ebp - 0x13d0]
lea esi, [eax + 2]
mov dword [ebp - 0x13dc], 0x19
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [edi]
mov ecx, dword [edi + 4]
shr eax, 0x10
imul eax, eax, 0xff
add eax, 0x4000
shr eax, 0xf
mov byte [esi - 2], al
movzx eax, cx
push eax
mov dword [ebp - 0x13f0], ecx
call fcn.09029bb6
mov byte [esi - 1], al
movzx eax, word [ebp - 0x13ee]
push eax
call fcn.09029bb6
mov byte [esi], al
pop ecx
add esi, 3
add edi, 8
dec dword [ebp - 0x13d4]
pop ecx
jne 0x906323a
dec dword [ebp - 0x13dc]
jne 0x9063230
lea ecx, [ebp - 0x1408]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13d8], 0x753
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13d8], 0xb71b
jb 0x9063173
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.09029bb6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x906400a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2cd0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
mov eax, dword [edi + 4]
add eax, 0x78
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x13ec], esi
mov dword [ebp - 0x13e4], edi
call fcn.09029bb6
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x906408e
mov eax, dword [edi + 4]
push 0
push 0x9c4
push 0xf424
push eax
call fcn.09029bb6
add esp, 0x10
mov dword [esi], eax
mov ecx, edi
mov dword [ebp - 0x13f0], edi
call fcn.0900e991
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop esi
div esi
add dword [ebp - 0x13d4], 0x8000
mov word [ecx], ax
add ecx, 2
cmp dword [ebp - 0x13d4], 0xc800c
jb 0x90640ac
and dword [ebp - 0x13dc], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
mov esi, 0x4000
jmp 0x90640f2
mov edi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13d8], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13d8]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x9064110
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x906410e
push 0
push 0x434d594b
push 0x50524742
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, edi
call fcn.09029bb6
mov eax, dword [ebp - 0x13ec]
push 1
push 0x9c4
push dword [ebp - 0x13dc]
lea ecx, [ebp - 0x1404]
push dword [eax]
call fcn.09029bb6
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 1
call fcn.09005145
lea ecx, [ebp - 0x13d0]
add eax, 2
mov dword [ebp - 0x13d8], 0x19
mov dword [ebp - 0x13d4], ecx
mov dword [ebp - 0x13e8], 0x19
mov ecx, dword [ebp - 0x13d4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
movzx edx, di
imul edx, edx, 0xff
add edx, esi
shr edx, 0xf
mov byte [eax - 2], dl
shr edi, 0x10
mov edx, edi
imul edx, edx, 0xff
add dword [ebp - 0x13d4], 8
add edx, esi
shr edx, 0xf
mov byte [eax - 1], dl
movzx edx, cx
shr ecx, 0x10
imul edx, edx, 0xff
imul ecx, ecx, 0xff
add edx, esi
add ecx, esi
shr edx, 0xf
shr ecx, 0xf
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec dword [ebp - 0x13e8]
jne 0x90641bc
dec dword [ebp - 0x13d8]
mov ecx, dword [ebp - 0x13d4]
jne 0x90641ac
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13dc], 0x9c4
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13dc], 0xf424
jb 0x90640ec
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.09029bb6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90646d5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a2cd0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f8
call fcn.0909ea10
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
mov eax, dword [edi + 4]
add eax, 0x78
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x13ec], esi
mov dword [ebp - 0x13e4], edi
call fcn.09029bb6
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x9064759
mov eax, dword [edi + 4]
push 0
push 0x9c4
push 0xf424
push eax
call fcn.09029bb6
add esp, 0x10
mov dword [esi], eax
mov ecx, edi
mov dword [ebp - 0x13f0], edi
call fcn.0900e991
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x13d4], 0xc
mov eax, dword [ebp - 0x13d4]
push 0x18
xor edx, edx
pop esi
div esi
add dword [ebp - 0x13d4], 0x8000
mov word [ecx], ax
add ecx, 2
cmp dword [ebp - 0x13d4], 0xc800c
jb 0x9064777
and dword [ebp - 0x13dc], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13e0], eax
mov esi, 0x4000
jmp 0x90647bd
mov edi, dword [ebp - 0x13e4]
mov eax, dword [ebp - 0x13e0]
movzx eax, word [eax]
and dword [ebp - 0x13d4], 0
mov dword [ebp - 0x13d8], eax
lea eax, [ebp - 0x13cc]
xor ecx, ecx
mov dx, word [ebp - 0x13d8]
mov word [eax - 2], dx
mov edx, dword [ebp - 0x13d4]
movzx edx, word [ebp + edx*2 - 0x48]
mov word [eax], dx
mov dx, word [ebp + ecx*2 - 0x48]
mov word [eax + 2], dx
inc ecx
add eax, 8
cmp ecx, 0x19
jb 0x90647db
inc dword [ebp - 0x13d4]
cmp dword [ebp - 0x13d4], 0x19
jb 0x90647d9
push 0
push 0x434d594b
push 0x504c4142
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
mov ecx, edi
call fcn.09029bb6
mov eax, dword [ebp - 0x13ec]
push 1
push 0x9c4
push dword [ebp - 0x13dc]
lea ecx, [ebp - 0x1404]
push dword [eax]
call fcn.09029bb6
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 1
call fcn.09005145
lea ecx, [ebp - 0x13d0]
add eax, 2
mov dword [ebp - 0x13d8], 0x19
mov dword [ebp - 0x13d4], ecx
mov dword [ebp - 0x13e8], 0x19
mov ecx, dword [ebp - 0x13d4]
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
movzx edx, di
imul edx, edx, 0xff
add edx, esi
shr edx, 0xf
mov byte [eax - 2], dl
shr edi, 0x10
mov edx, edi
imul edx, edx, 0xff
add dword [ebp - 0x13d4], 8
add edx, esi
shr edx, 0xf
mov byte [eax - 1], dl
movzx edx, cx
shr ecx, 0x10
imul edx, edx, 0xff
imul ecx, ecx, 0xff
add edx, esi
add ecx, esi
shr edx, 0xf
shr ecx, 0xf
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
dec dword [ebp - 0x13e8]
jne 0x9064887
dec dword [ebp - 0x13d8]
mov ecx, dword [ebp - 0x13d4]
jne 0x9064877
lea ecx, [ebp - 0x1404]
mov byte [ebp - 4], 0
call fcn.09005177
add dword [ebp - 0x13dc], 0x9c4
add dword [ebp - 0x13e0], 2
cmp dword [ebp - 0x13dc], 0xf424
jb 0x90647b7
mov ecx, dword [ebp - 0x13e4]
or dword [ebp - 4], 0xffffffff
call fcn.09029bb6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9095fa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a3edd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb18
mov eax, dword [0x90de124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb24], eax
call fcn.09029bb6
add esp, 4
push eax
lea ecx, [ebp - 0xb20]
call fcn.09029bb6
push 0
push 0
mov eax, dword [ebp - 0xb20]
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push eax
push esi
mov dword [ebp - 4], 0
call fcn.09008249
add esp, 0x3c
push eax
lea ecx, [ebp - 0xb1c]
call fcn.09029bb6
mov byte [ebp - 4], 1
xor eax, eax
jmp 0x9096050
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x9096050
push 0
push 0x5058595a
push 0x67386b30
push pe_nt_image_headers32
lea ecx, [ebp - 0x918]
push ecx
mov ecx, dword [ebp - 0xb1c]
lea edx, [ebp - 0x118]
push edx
call fcn.09029bb6
movzx edi, word [ebp - 0x914]
movzx esi, word [ebp - 0x11c]
cmp esi, edi
ja 0x90960a5
push 0x6250726f
call fcn.09029bb6
sub esi, edi
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx*8 - 0x914]
cmp eax, edi
ja 0x90960c0
xor eax, eax
jmp 0x90960e9
movzx edx, word [ebp - 0x11c]
cmp eax, edx
jb 0x90960da
mov edx, 0x8000
mov word [ebp + ecx*2 - 0xb18], dx
jmp 0x90960f1
sub eax, edi
mov edx, esi
shr edx, 1
shl eax, 0xf
add eax, edx
xor edx, edx
div esi
mov word [ebp + ecx*2 - 0xb18], ax
inc ecx
cmp ecx, 0x100
jb 0x90960b0
lea ecx, [ebp - 0xb1c]
mov byte [ebp - 4], 0
call fcn.0900ec67
lea ecx, [ebp - 0xb20]
mov dword [ebp - 4], 0xffffffff
call fcn.09019001
mov esi, dword [ebp - 0xb24]
lea eax, [esi + 8]
push eax
push 0x260
mov dword [ebp - 0xb24], eax
call fcn.09029bb6
add esp, 8
mov dword [ebp - 0xb20], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909615b
push esi
mov ecx, eax
call fcn.09029bb6
mov esi, eax
mov dword [ebp - 0xb1c], esi
jmp 0x909616b
mov dword [ebp - 0xb1c], 0
mov esi, dword [ebp - 0xb1c]
fld qword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
fmul qword [0x90b4990]
mov ecx, dword [eax]
fldz
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 4]
fcomp st(1)
mov dword [esi + 0x54], edx
fnstsw ax
test ah, 0x41
jne 0x9096195
fsub qword [0x90aad88]
jmp 0x909619b
fadd qword [0x90aad88]
call fcn.0909e870
mov word [esi + 0x58], ax
mov eax, dword [ebp - 0xb1c]
lea edi, [esi + 0x5a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001690
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x414176
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x414185
pop dword [ebp - 0x28]
mov eax, 0x414185
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x506a297
add dword [ebp - 0x38], 0x494ba2b4
mov dword [ebp - 0x34], 0x447cc51c
sub dword [ebp - 0x34], 0x124978d7
mov dword [ebp - 0x30], 0x37fb1595
add dword [ebp - 0x30], 0x14512e99
mov dword [ebp - 0x2c], 0xf35633ca
add dword [ebp - 0x2c], 0xca9cc36
lea eax, [ebp - 0x38]
push eax
mov eax, 0x46838b93
sub eax, 0x46415b1f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xde37006f
sub dword [ebp - 0x38], 0x69c49719
mov dword [ebp - 0x34], 0x1d805783
add dword [ebp - 0x34], 0x23ec09f2
mov dword [ebp - 0x30], 0xcafde160
sub dword [ebp - 0x30], 0x678e74f4
mov dword [ebp - 0x2c], 0xbb3319e1
sub dword [ebp - 0x2c], 0xbb3319e1
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x43a04
push 0
call eax
mov ecx, 0x9fd2494a
sub ecx, 0x9fd1eae4
mov esi, eax
mov edi, 0x14f76bf1
sub edi, 0x14b427f1
add edi, dword [ebp - 0x28]
mov ebx, 0x21bd2add
sub ebx, 0xf6ad4753
mov dword [ebp - 0x20], 0xd63fd9d2
mov edx, dword [edi]
add dword [ebp - 0xc], 0x8b9a42c2
xor edx, ebx
sub dword [ebp - 0x20], 0xbfd465dc
mov dword [esi], edx
xor dword [ebp - 0x18], 0x73eb5941
add esi, 0xa2dd9f11
add esi, 0x5d2260f3
add edi, 0x5831f8f7
add edi, 0xa7ce070d
loop 0x41429d
add eax, 0x6f043c24
sub eax, 0x6f02cfb9
mov ebx, eax
add eax, 0xadd1e5b6
add eax, 0x522e1a4f
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x402a24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404490
test esi, esi
jne 0x402a5a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404580
jmp 0x402a78
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402938
mov edi, eax
test esi, esi
je 0x402a78
cmp dword [ebx], 0
je 0x402a78
dec esi
jmp 0x402a61
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4035d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x450020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403668
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403648
xor eax, eax
push ebp
push 0x403641
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403684
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403648
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x450020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x450020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404314
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x452048], 0
je 0x404375
cmp word [0x45221c], 0xd7b2
jne 0x40433d
cmp dword [0x452224], 0
jbe 0x40433d
mov eax, 0x452218
call dword [0x452234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x450070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40439c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x450030], 0
jne 0x404391
push 0
push 0x450068
push 0x450070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4056f0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405920
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405773
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405920
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405773
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40593c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4057fc
xor eax, eax
push ebp
push 0x4057f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405538
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4057da
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40595c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4057da
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4057fc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405916
cmp byte [ebp - 0xd], 0
jne 0x405843
cmp byte [ebp - 0x12], 0
je 0x405916
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40585c
dec ebx
cmp byte [ebx], 0x2e
je 0x40586b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40585b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405916
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4058a8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405916
cmp byte [ebp - 0xd], 0
je 0x405916
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405916
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405fe8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40604e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404700
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403194
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406038
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406055
lea eax, [ebp - 0x10]
call fcn.00404490
ret

Function at 0x40b070
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0a9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404580
jmp 0x40b0b2
mov eax, ebx
mov edx, esi
call fcn.004044e4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b0bc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0dd
mov al, byte [esp]
jmp 0x40b0df
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b764
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b5dc
mov eax, dword [0x451024]
cmp byte [eax], 0
je 0x40b7e0
mov eax, dword [0x450e48]
call fcn.00402e30
call fcn.00402864
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004088d0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b828
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b816
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x450df8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x452664]
call fcn.004054fc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret