joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46be30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x26c
mov dword [esp + 0x264], edi
mov edi, eax
mov dword [esp + 0x25c], ebx
mov dword [esp + 0x260], esi
mov dword [esp + 0x268], ebp
cmp byte [eax + 0x1d0], 0
je 0x46be82
xor eax, eax
mov ebx, dword [esp + 0x25c]
mov esi, dword [esp + 0x260]
mov edi, dword [esp + 0x264]
mov ebp, dword [esp + 0x268]
add esp, 0x26c
ret
lea ebx, [esp + 0x50]
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [eax + 0x70]
mov dword [esp + 0x14], str.CurrentJoystickSettings
lea ebp, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaResourcesJoystick
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
mov dword [esp + 0x3c], eax
call eax
sub esp, 0x14
test eax, eax
jne 0x46be5d
mov dword [esp + 0x10], str.OEMName
mov eax, dword [edi + 0x1c8]
mov dword [esp + 0x4c], 0x100
mov dword [esp + 8], str.Joystick_d_s
mov dword [esp + 4], 0x100
add eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x150]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0x38], eax
call eax
sub esp, 0x18
mov edi, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], eax
call eax
sub esp, 4
test edi, edi
mov ecx, dword [esp + 0x30]
jne 0x46be5d
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [esp + 0x3c]
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x2c]
jne 0x46be5d
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0x4c], pe_nt_image_headers32
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.OEMName
mov dword [esp], eax
call dword [esp + 0x38]
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [esp + 0x34]
xor eax, eax
sub esp, 4
test ebx, ebx
sete al
jmp 0x46be5f
Function at 0x475850
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x475860
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x47585d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x475880
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4758b8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4758ae
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4758ba
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4758a0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x475e00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xaaf024
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xaaf03c]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 4
test ebx, ebx
je 0x475e55
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x475e4e
test esi, esi
je 0x475e4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x475e30
mov dword [esp], 0xaaf024
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4760e0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x476114
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0xaaf044], eax
call fcn.00486100
test eax, eax
sete al
movzx eax, al
mov dword [0x4e8ab4], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x476103

Function at 0x4761b0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], eax
mov eax, dword [0xaaf044]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4761d0
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x476230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4e8ab4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
test eax, eax
mov dword [esp + 0x28], ebp
js 0x4762e0
test eax, eax
jne 0x476280
mov eax, dword [0xaaf048]
mov dword [0xaaf048], ebx
mov dword [ebx], eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [0xaaf044]
call esi
mov dword [esp], ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xaaf044]
mov dword [ebx], ebp
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x476265
mov edx, esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
jmp edx
call fcn.00476120
mov eax, dword [0x4e8ab4]
jmp 0x476254

Function at 0x4762f0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 8
mov edx, dword [0x4e8ab4]
mov eax, dword [esp + 0x10]
test edx, edx
mov ebx, dword [eax]
js 0x476320
test edx, edx
jne 0x476313
mov dword [0xaaf048], ebx
add esp, 8
pop ebx
ret
add esp, 8
mov eax, ebx
pop ebx
jmp fcn.004761b0
call fcn.00476120
mov edx, dword [0x4e8ab4]
jmp 0x476304

Function at 0x476520
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x4e8ab4]
mov edi, dword [esp + 0x40]
test eax, eax
js 0x476603
test eax, eax
mov esi, dword [0xaaf048]
jne 0x4765a1
test esi, esi
mov dword [esp + 0x2c], esi
je 0x476595
mov ecx, esi
lea ebx, [esp + 0x2c]
nop
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x476587
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call eax
cmp eax, 6
je 0x4765d0
cmp eax, 8
jne 0x4765f7
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x2c], ecx
jne 0x476550
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov esi, dword [0xaaf044]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x476541
mov eax, dword [esp + 0x2c]
mov edx, ebx
mov dword [edi + 0xc], 0
mov dword [esp + 0x2c], esi
mov dword [edi + 0x10], eax
mov eax, edi
call fcn.00476040
cmp eax, 7
jne 0x47659a
mov eax, ebx
call fcn.004761e0
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.00476120
mov eax, dword [0x4e8ab4]
jmp 0x476537
Function at 0x4766d0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x4e8ab4]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x47674b
test edx, edx
mov esi, dword [0xaaf048]
jne 0x476725
mov ecx, dword [ebx + 0xc]
mov eax, ebx
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
test ecx, ecx
jne 0x476715
call fcn.00476040
cmp eax, 7
je 0x47671c
nop
lea esi, [esi]
call sub.msvcrt.dll_abort
call fcn.00476330
jmp 0x476706
mov eax, esi
nop
call fcn.004761e0
mov esi, dword [0xaaf044]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x4766ee
call fcn.00476120
mov edx, dword [0x4e8ab4]
jmp 0x4766e4

Function at 0x476760
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x476792
mov dword [esp], ebx
call fcn.00476520
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov edx, dword [0x4e8ab4]
test edx, edx
js 0x476800
test edx, edx
mov esi, dword [0xaaf048]
jne 0x4767d0
lea edx, [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x1c], esi
call fcn.00476330
cmp eax, 7
je 0x4767c0
call sub.msvcrt.dll_abort
nop
lea eax, [esp + 0x1c]
call fcn.004761e0
lea esi, [esi]
mov esi, dword [0xaaf044]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4767a6
call fcn.00476120
mov edx, dword [0x4e8ab4]
jmp 0x47679c

Function at 0x476d50
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret

Function at 0x476d90
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x476db5
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax
Function at 0x5b9e60
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
mov eax, dword [0x7c9028]
mov edx, dword [0x7c902c]
mov dword [esp + 4], 0
lea ecx, [eax + eax]
mov eax, dword [0xbc3068]
or ecx, edx
mov dword [esp], ecx
fild qword [esp]
test eax, eax
fadd qword [0x7c9040]
fstp qword [0x7c9040]
jne 0x5b9f14
push esi
push 0
call sub.comdlg32.dll_ChooseColorA
push str.Crypt32.dll
mov dword [0x7c9e2c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CertCloseStore
push eax
mov dword [0xbc3068], eax
call esi
mov edx, dword [0xbc3068]
push str.CertEnumCertificatesInStore
push edx
mov dword [0xbc3064], eax
call esi
mov dword [0xbc3054], eax
mov eax, dword [0xbc3068]
push str.CertFreeCertificateContext
push eax
call esi
mov ecx, dword [0xbc3068]
push str.PFXImportCertStore
push ecx
mov dword [0xbc304c], eax
call esi
mov edx, dword [0xbc3068]
push str.CryptAcquireCertificatePrivateKey
push edx
mov dword [0xbc3060], eax
call esi
mov dword [0xbc3050], eax
pop esi
add esp, 8
ret

Function at 0x68ecb8
Capabilities:
Encode data using xor

Disassembly:
ja 0x68ec46
xchg esi, eax
xor dl, byte [esi - 0x4d]
idiv dword [ebp + 0x71330072]
xchg esp, eax
xchg edx, eax
adc dword [eax + 0x7d96c623], 0xb
jl 0x68ecb3
leave
clc
jmp 0x8ba08461
sbb edi, dword [esi + 0x1c2973bc]
arpl word [edi + ecx*2 + 0x54], dx
pop edi
fsubr dword [ebp + 0x6d]
xchg ebx, eax
outsb dx, byte [esi]
and dword [edx + 0x41], ecx
lodsd eax, dword [esi]
sub eax, 0xc38b208f
arpl word [esi], sp
or ch, byte [edx]
push ds
xchg edx, eax
mov edx, 0x32f2d1a7
outsd dx, dword [esi]
rol dword [eax], cl
xor eax, 0xae40ed10
sal edx, 1
xor ch, byte [edi - 0x2d]
add byte [0xae40ed10], dh
xor eax, 0x860b0e9f
jbe 0x68ecac
dec esp
add eax, 0xc09ef04
lea edi, gs:[edi - 0x6d]
push ebp
invalid
sbb byte [edx - 0x2a], 0x54
and dword [ebx - 0x6f4c2355], edi
frstor dword [ebx + 0x2d]
arpl word [0xed421f88], bp
fdiv qword [ebx + 0x63ddf290]
sub eax, 0xed421f88
arpl word [0xed421f88], bp
jge 0x68ec40
dec esp
loop 0x68ec5e
aam 0xab
pop edi
insb byte es:[edi], dx
fdivr qword [ebx + edi*4 - 0x43]
jl 0x68ec85
invalid
ja 0x68ec80
mov bl, 0xc1
mov al, byte [0x3a53a322]
test al, 0xdb
inc ebx
cmp esi, dword [eax - 0x77942263]
pop ebp
insb byte es:[edi], dx
rol byte [ebp - 0x2a8863ef], 1
mov bh, 0xae
inc esp
mov bl, 0xf2
mov ecx, 0x27b4b721
mov bh, 0xb4
daa
daa
shl byte [eax + 0x6b51150b], 0xfd
jo 0x68ecec
sbb al, 0x2a
xor dword [ebx], edx
invalid
Function at 0x76f998
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
mov edi, 0xafa7cba8
adc al, 0x71
test dword [edx], 0x63022974
js 0x76f925
jno 0x76f8c7
add dh, byte [ecx + ebp + 2]
arpl word [eax + 0x4e], di
inc esp
adc esi, dword [ecx + ebx*4 - 0x39]
inc ebx
and ecx, edi
xlatb
jmp 0x76f8fa
xchg ebp, eax
int1
retf
mov ah, 0x54
jns 0x76f97a
pop esi
adc eax, 0x683669f2
inc ecx
xor al, 0xd1
nop
add esi, dword cs:[edi + 0x14]
pushal
movsb byte es:[edi], byte [esi]
rol byte [0x611fb8a1], 1
sbb dword [ecx + 0x41], esp
jge 0x76f99f
les edx, [ebx + 0x54]
into
jp 0x76f8ce
pop eax
add ecx, ebx
xor dword [esi - 0x63476b21], esp
in eax, dx
sub dl, byte [ecx + 0x16ddcfe9]
fst qword [ebx - 0x66396c2b]
jo 0x76f912
xchg esp, eax
mov eax, 0x912aed9c
jmp 0xdd8dd717
mov bl, ah
int3
adc al, 0x1c
insd dword es:[edi], dx
lahf
sbb al, 0x39
jno 0x76f9d7
mov dword [ebx + 0x75], esi
inc esp
mov eax, 0x1f8cefd8
cmp eax, 0xfbbaf636
jecxz 0x76f980
idiv byte ss:[edx + 0x14fae3fb]
in eax, 0x1f
pop ds
adc al, 0xe5
pop ds
ja 0x76f93d
dec edx
mov ebp, 0x40559d8c
mov edx, 0xb8da54f8
pop edi
add dword [edx - 0x40], 0xffffffce
inc edx
ror dh, 0x1a
fstp qword [eax]
inc eax
or al, 0xe2
invalid
or al, 0xe2
and esi, dword [eax - 0x32915cc2]
mov al, 0x3e
mov dword [0xe2d8cd6e], eax
fsub st(2)
cli
jg 0x76f9a7
bnd jle 0x76f96d
jg 0x76f937
adc eax, dword [esi + 0xa]
test al, 0x83
sub byte [ebx], 0xd4
and eax, 0x443c072e
pop ecx
lcall 0xdbe7, 0x18fe09b
out 0xdb, eax
invalid
lds esp, [edi + 0x28]
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x163428ce
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x54321a53
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402fdc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x483008], 0x8088405
inc edx
mov dword [ebx + 0x483008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4036e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403780
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403760
xor eax, eax
push ebp
push 0x403759
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40379c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403760
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x483024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4045d4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48e04c], 0
je 0x404635
cmp word [0x48e220], 0xd7b2
jne 0x4045fd
cmp dword [0x48e228], 0
jbe 0x4045fd
mov eax, 0x48e21c
call dword [0x48e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40465c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x483030], 0
jne 0x404651
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405fd4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406204
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406057
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406204
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406057
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406220
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4060e0
xor eax, eax
push ebp
push 0x4060d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405e10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4060be
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406240
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4060be
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060e0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4061fa
cmp byte [ebp - 0xd], 0
jne 0x406127
cmp byte [ebp - 0x12], 0
je 0x4061fa
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406140
dec ebx
cmp byte [ebx], 0x2e
je 0x40614f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40613f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4061fa
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40618c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4061fa
cmp byte [ebp - 0xd], 0
je 0x4061fa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4061fa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408740
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4087d0
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4087d0
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408783
test edx, 3
jne 0x408772
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40877d
jmp 0x408783
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408783
cmp dword [ecx - 8], 1
je 0x40878d
mov edx, ebx
or edx, 3
call fcn.00404ea0
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40879f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404754

Function at 0x4087dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40886c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40886c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40881f
test edx, 3
jne 0x40880e
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408819
jmp 0x40881f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40881f
cmp dword [ecx - 8], 1
je 0x408829
mov edx, ebx
or edx, 3
call fcn.00404ea0
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40883b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404754

Function at 0x409108
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c18
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409121
test al, 0x10
je 0x409125
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40bb84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bbbd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404844
jmp 0x40bbc6
mov eax, ebx
mov edx, esi
call fcn.004047a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bbd0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bbf2
movzx eax, byte [esp]
jmp 0x40bbf4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret