joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e7180
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8649a8
push 0x4fd4d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4e723b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e723b
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x4e71e0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x1c]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e723b
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4e722f
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call fcn.004fb4da
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
call fcn.004e7250
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e73a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
call fcn.004e72c0
mov al, byte [esp + 4]
add esp, 4
test al, al
jne 0x4e73c4
xor eax, eax
add esp, 0x104
ret
push ebx
push esi
push edi
mov edi, str.NaturalSPI.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004fd6f7
add esp, 8
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x4e7414
xor eax, eax
add esp, 0x104
ret
push str.naturalspi
call fcn.004e7290
add esp, 4
mov dword [0x8e9440], eax
test eax, eax
jne 0x4e7447
push str.naturalspi
call fcn.004e7270
add esp, 4
mov dword [0x8e9440], eax
test eax, eax
jne 0x4e7447
add esp, 0x104
ret
lea ecx, [esp]
push ecx
mov ecx, 0x8e9338
call fcn.004e6b80
test eax, eax
je 0x4e746a
cmp eax, 0xfffffcde
je 0x4e746a
xor eax, eax
add esp, 0x104
ret
push str.NaturalWSPON
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add esp, 0x104
ret
Function at 0x4e7490
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x8e9440]
sub esp, 0x104
test eax, eax
je 0x4e74a8
push eax
call fcn.004e72b0
add esp, 4
lea eax, [esp]
push eax
call fcn.004e72c0
mov al, byte [esp + 4]
add esp, 4
test al, al
jne 0x4e74c6
xor eax, eax
add esp, 0x104
ret
push ebx
push esi
push edi
mov edi, str.NaturalSPI.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004fd6f7
add esp, 8
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x4e7516
xor eax, eax
add esp, 0x104
ret
push str.NaturalWSPOFF
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x8e9338
call fcn.004e6c10
add esp, 0x104
ret
Function at 0x4e7540
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x534b28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x8b5a3c]
push esi
mov dword [esp + 4], eax
mov eax, dword [0x8e9440]
mov dword [esp + 0x14], 0
test eax, eax
jbe 0x4e76b5
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jbe 0x4e7679
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
push ecx
call ebp
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x30]
mov bx, ax
push edx
and ebx, 0xffff
call ebp
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
push ebp
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
and eax, 0xffff
push 0
push esi
mov dword [esp + 0x40], eax
call fcn.004e7260
mov eax, dword [esp + 0x20]
push eax
push 4
push esi
call fcn.004e7260
push ebx
push 8
push esi
call fcn.004e7260
mov ecx, dword [esp + 0x50]
push ecx
push 0xc
push esi
call fcn.004e7260
mov edx, dword [esp + 0x64]
push edx
push 0x10
push esi
call fcn.004e7260
add esp, 0x3c
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
and ebp, 0xffff
and edi, 0xffff
push ebp
push eax
push edi
push ecx
lea edx, [esp + 0x20]
push str.NaturalSetReconn_TRUE:___s:_d_____s:_d__n
push edx
call fcn.0051c77a
mov eax, dword [esp + 0x28]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0051f3a9
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x20]
and eax, 0xffff
push edx
push eax
push ecx
lea edx, [esp + 0x14]
push str.NaturalSetReconn_FALSE:___s:_d_____s:_d__n
push edx
call fcn.0051c77a
mov eax, dword [esp + 0x1c]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0051f3a9
mov ecx, dword [esp + 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4e79c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4e7a26
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4e7a26
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4e7a07
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4e7db0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4e7de8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4e8a10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4e8a59
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4e8ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x534da0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004e8a80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004e8b00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004e8b00
lea ecx, [esi + 0xc]
call fcn.0051f334
lea ecx, [esi + 0x10]
call fcn.0051f334
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004ea090
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004ea090
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004ea090
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0051f3a9
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0051f3a9
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4ea520
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0xc]
push 4
push eax
push 0xffffff7f
push 0xffff
push esi
mov byte [esp + 0x1f], 1
mov word [esp + 0x20], 0
mov word [esp + 0x22], 0
call edi
lea ecx, [esp + 0xb]
push 1
push ecx
push 8
push 0xffff
push esi
call edi
mov eax, 0xbb8
push 0
lea edx, [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0
push edx
lea eax, [esp + 0x1c]
push 0xc
push eax
lea ecx, [esp + 0x24]
push 0xc
push ecx
push 0x98000004
push esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x44], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
lea edx, [esp + 0xb]
push 1
push edx
push 0xa
push 0
push esi
call edi
lea eax, [esp + 0xb]
push 1
push eax
push 0x20
push 0xffff
push esi
call edi
lea ecx, [esp + 0xb]
push 1
push ecx
push 1
push 0
push esi
call edi
lea edx, [esp + 0xb]
push 1
push edx
push 4
push 0xffff
push esi
call edi
pop edi
pop esi
add esp, 0x14
ret

Function at 0x4edad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x535118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004edec0
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x90166c
call fcn.004fd793
mov ecx, dword [0x8649f0]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.004eb240
mov esi, 0x864a48
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4edb77
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4edb6e
cmp al, 0xff
je 0x4edb6e
dec al
mov byte [ecx], al
jmp 0x4edb77
push ecx
call fcn.0051f113
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0051a600
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x4edbbd
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4edbb4
cmp al, 0xff
je 0x4edbb4
dec al
mov byte [ecx], al
jmp 0x4edbbd
push ecx
call fcn.0051f113
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004fd81a
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4fd6f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4fd717
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ff085
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4fd73a
test byte [esp + 8], 2
je 0x4fd73a
call fcn.004ff0f8
mov dword [eax], 0xd
call fcn.004ff101
mov dword [eax], 5
jmp 0x4fd713
xor eax, eax
ret
Function at 0x514ad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x536ab0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.005098d2
mov eax, dword [0x868b98]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.00509804
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.005155a0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x514b77
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x514b6e
cmp al, 0xff
je 0x514b6e
dec al
mov byte [ecx], al
jmp 0x514b77
push ecx
call fcn.0051f113
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x514ba8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x514b9f
cmp al, 0xff
je 0x514b9f
dec al
mov byte [ecx], al
jmp 0x514ba8
push ecx
call fcn.0051f113
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x5218a5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5218dd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0051f850
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0051f828
jmp 0x5218e9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x523116
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x523158
call fcn.00529aff
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x523158
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x52314f
xor eax, eax
jmp 0x523160
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00523166
pop edi
pop esi
pop ebx
ret 4

Function at 0x52a02f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x52a05d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x52a07b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00529f95
jmp 0x52a07b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x52a07b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00529f95
test edi, edi
mov eax, edi
jne 0x52a065
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x52cdcd
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x52cdf5
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x52ce06
push 2
call edi
test ax, ax
jge 0x52ce06
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00520eda
cmp dword [esi + 0x30], ebx
jne 0x52cee0
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.00520eda
cmp eax, dword [esp + 0x34]
jne 0x52cee0
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x52ce7c
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x52cec1
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x52cee0
cmp eax, 0x205
je 0x52cee0
cmp eax, 0x201
je 0x52cee0
cmp eax, 0x204
je 0x52cee0
cmp eax, ebx
jne 0x52cea7
cmp dword [esp + 0x1c], 0x1b
je 0x52cee0
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x90441c]
jbe 0x52ced6
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x52ce39
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x539640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x906020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x5396d8
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x5396b8
xor eax, eax
push ebp
push 0x5396b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x5396f4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5396b8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
ret
mov ax, word [0x906020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x906020], ax
mov esp, ebp
pop ebp
ret
Function at 0x53a404
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x917044], 0
je 0x53a465
cmp word [0x917218], 0xd7b2
jne 0x53a42d
cmp dword [0x917220], 0
jbe 0x53a42d
mov eax, 0x917214
call dword [0x917230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x906090
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x53a48c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x906030], 0
jne 0x53a481
push 0
push 0x906088
push 0x906090
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret
Function at 0x53c304
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x53c36a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0053a7f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00539234
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x53c354
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c371
lea eax, [ebp - 0x10]
call fcn.0053a588
ret

Function at 0x540790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jle 0x5407c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0053a678
jmp 0x5407d2
mov eax, ebx
mov edx, esi
call fcn.0053a5dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5407dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jle 0x5407fd
mov al, byte [esp]
jmp 0x5407ff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x541c58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x541cbc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0053a7f8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_GetACP
mov edx, eax
pop eax
call fcn.0053dc20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x541cc3
lea eax, [ebp - 0xc]
call fcn.0053a588
ret
Function at 0x542d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x90633c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x542e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x542dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x542e5f
dec edx
je 0x542ea0
jmp 0x542efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x542efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret