joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43b820
mov ebx, ecx
mov esi, edx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test edi, edi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x43b0b7
js 0x43b123
movzx eax, byte [0xc87948]
mov eax, dword [0xc879c8]
test eax, eax
jne 0x43b09d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x43b0ab
mov dword [0xc879c8], eax
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x43b0bc
mov ecx, 1
mov edx, edi
call fcn.00449730
mov eax, 1
push edi
push esi
mov dword [ebp - 0x20], eax
push eax
call fcn.0043c450
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x43b0ed
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], ebx
call fcn.0043b160
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp + 8]
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
mov esi, dword [ebp - 0x20]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 0
mov dword [eax + ecx*4 + 4], edi
mov dword [eax + ecx*4 + 8], esi
mov dword [eax + ecx*4 + 0xc], edi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040ff20
nop dword [eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 8], 0
je 0x43b14e
push dword [ebp - 0x20]
push 0
push dword [0xc879c8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0xc
pop ebp
ret

Function at 0x44008f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4400ce
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4400ce
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4400ce
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4400ce
cmp dword [ecx + 0x74], 0xe
jbe 0x4400ce
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x442ac3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x442b60
push ebx
push esi
call fcn.00442a8c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00442a20
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x442b0d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x442b5f
push edi
push eax
call fcn.004436e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x442b2d
call fcn.00441581
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x442b5e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00442a20
add esp, 0x20
test eax, eax
jne 0x442b4c
push edi
call fcn.00441581
jmp 0x442b54
push ebx
call fcn.00441581
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x443e5d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xc800f0
push 0xc800e8
push str.FlsAlloc
push 0x1f
call fcn.00443d1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443e91
push dword [ebp + 8]
mov ecx, esi
call dword [0x44b204]
call esi
jmp 0x443e97
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x443edb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xc80100
push 0xc800f8
push str.FlsGetValue
push 0x21
call fcn.00443d1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443f12
push dword [ebp + 8]
mov ecx, esi
call dword [0x44b204]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x443f1a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xc80108
push 0xc80100
push str.FlsSetValue
push 0x22
call fcn.00443d1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443f54
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x44b204]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x44a450
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x44a4c1
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x44a4f8
cmp dword [esp + 4], 0
je 0x44a4df
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44a50b
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0xc879dc]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0xc879dc], esi
jne 0x44a4a0
mov byte [0xc879d8], 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x44a4ef
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x44a54c
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x44a4e3
mov edi, dword [esp]
jmp 0x44a4ef
mov edi, dword [esi]
jmp 0x44a4ee
mov edi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.0044a580
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0xc7db04
mov dword [esp + 8], 0xc7dacc
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0xc7b5b0
mov dword [esp + 0x14], 0
call fcn.004497d0
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0xc7dacc
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0xc7b5b0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0044a5b0
int3
Function at 0x9142a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9142aa
pushal
call 0x9142b0
pop ebp
sub ebp, 0x10
sub ebp, 0x5142a0
jmp 0x9142c6
mov eax, 0x5142a0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f0
mov edx, 0xfe7a3bec
xor byte [eax], dl
inc eax
dec ecx
jne 0x9142dd
jmp 0x9142f0
and dword [bx + 0x65], esp
shr ah, 1
in al, dx
in al, dx
insd dword es:[edi], dx
sub eax, 0xececec14
out dx, eax
and dword [edx + ebp*8 - 0x14], edx
in al, dx
in al, dx
push esi
invalid
Function at 0x40189d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edx, dword [0x403050]
mov ebx, eax
add edx, eax
mov eax, 0x403054
call fcn.004017e0
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x40277c
push edx
sub edi, fcn.00401f26
push edi
xor eax, eax
push fcn.00401f26
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401907
mov eax, fcn.00401f26
mov ebx, esi
mov edx, edi
call fcn.004017e0
mov edx, 0x1c000
mov eax, 0x403054
mov ebx, esi
call fcn.004010f2
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401dfd
Capabilities:
Check if file exists
Check mutex on windows
Get common file path

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x460, 0
lea ebx, [ebp - 0x258]
push ebx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHFOLDER.DLL_SHGetFolderPathW]
push 0x104
lea ebx, [ebp - 0x460]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
lea ebx, [ebp - 0x460]
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push ebx
mov byte [ebp - 8], 0
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ebx, [ebp - 0x258]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push ebx
lea ebx, [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
lea ebx, [ebp - 0x10]
push ebx
lea ebx, [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebx
push ebx
push ebx
sub esi, 5
mov byte [ebp - 0x50], 0
call dword [sym.imp.SHLWAPI.DLL_PathCombineA]
mov eax, esi
jmp 0x401666

Function at 0x44015a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x440168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x44014a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x440145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x440145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x6a2b55d9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x45a56008
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x414de4
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], eax
or edx, esi
add edi, 4
add esi, 0x942b482e
dec ebx
mov esi, ebx
cmp edi, ecx
jne fcn.00414de4
add edx, esi
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x636a608f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x17445232
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40349c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404de4
test esi, esi
jne 0x4034d2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404ed4
jmp 0x4034f0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403340
mov edi, eax
test esi, esi
je 0x4034f0
cmp dword [ebx], 0
je 0x4034f0
dec esi
jmp 0x4034d9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403e78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x445020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403f10
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ef0
xor eax, eax
push ebp
push 0x403ee9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403f2c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ef0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x445020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x445020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404bb0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x447044], 0
je 0x404c11
cmp word [0x447218], 0xd7b2
jne 0x404bd9
cmp dword [0x447220], 0
jbe 0x404bd9
mov eax, 0x447214
call dword [0x447230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404c38
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x44502c], 0
jne 0x404c2d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404d68
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x445030], 0
je 0x404d8e
mov edx, esi
mov eax, ebx
call dword [0x445030]
jmp 0x404d9d
mov eax, 8
call fcn.00402fe0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x447045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404d30
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4066bc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4068ec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40673f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4068ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40673f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406908
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4067c8
xor eax, eax
push ebp
push 0x4067c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004064f8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4067a6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406928
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4067a6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4068e2
cmp byte [ebp - 0xd], 0
jne 0x40680f
cmp byte [ebp - 0x12], 0
je 0x4068e2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406828
dec ebx
cmp byte [ebx], 0x2e
je 0x406837
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406827
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4068e2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406874
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4068e2
cmp byte [ebp - 0xd], 0
je 0x4068e2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4068e2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4067c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4068ec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40673f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4068ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40673f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406908
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4067c8
xor eax, eax
push ebp
push 0x4067c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004064f8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4067a6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406928
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4067a6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4068e2
cmp byte [ebp - 0xd], 0
jne 0x40680f
cmp byte [ebp - 0x12], 0
je 0x4068e2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406828
dec ebx
cmp byte [ebx], 0x2e
je 0x406837
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406827
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4068e2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406874
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4068e2
cmp byte [ebp - 0xd], 0
je 0x4068e2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4068e2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a984
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40a9d6
test eax, edx
je 0x40a9d9
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40a999
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40a9bf
add ecx, 4
js 0x40a9af
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40a9bc
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40a9e5
test edx, edx
jne 0x40a98c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b12c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405290
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40b14a
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x40b16b
cmp ebx, 3
je 0x40b16b
cmp ebx, 0x7b
je 0x40b16b
mov eax, esi
call fcn.0040b0ec
test al, al
jne 0x40b16f
xor eax, eax
jmp 0x40b171
mov al, 1
pop esi
pop ebx
ret

Function at 0x40e908
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e941
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404ed4
jmp 0x40e94a
mov eax, ebx
mov edx, esi
call fcn.00404e38
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e954
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e976
movzx eax, byte [esp]
jmp 0x40e978
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40f154
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40efcc
mov eax, dword [0x446c5c]
cmp byte [eax], 0
je 0x40f1d0
mov eax, dword [0x446afc]
call fcn.004035e8
call fcn.004031ac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040b378
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40f218
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40f206
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x446ad0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4497f0]
call fcn.004064a0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret