joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402108
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
call fcn.00401018
mov ebx, 2
mov ecx, 0x17
test dword [ebp + 8], 1
cmovne ebx, ecx
mov edi, 1
mov ecx, 2
mov esi, 6
mov edx, 0x11
test dword [ebp + 8], 2
cmovne edi, ecx
cmovne esi, edx
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.DLL_socket]
inc eax
test eax, eax
je 0x4021ac
dec eax
mov edx, eax
mov esi, 0x10
sub esp, 0x10
test dword [ebp + 8], 1
je 0x40216a
sub esp, 0x10
add esi, 0x10
mov edi, esp
xor eax, eax
mov ecx, esi
rep stosb byte es:[edi], al
mov edi, esp
mov word [edi], bx
mov eax, dword [ebp + 0xc]
xchg ah, al
mov word [edi + 2], ax
mov ebx, edx
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.DLL_bind]
inc eax
test eax, eax
je 0x4021b4
test dword [ebp + 8], 2
jne 0x4021aa
push 0x7fffffff
push ebx
call dword [sym.imp.WS2_32.DLL_listen]
inc eax
test eax, eax
je 0x4021b4
mov eax, ebx
call fcn.00401026
ret 8
push ebx
call dword [sym.imp.WS2_32.DLL_closesocket]
xor eax, eax
jmp 0x4021ac

Function at 0x402457
Capabilities:
Send data
Send data on socket

Disassembly:
call fcn.00401018
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
jmp 0x40246e
push 1
call fcn.0040209a
push 0
push dword [edi]
push esi
push ebx
call dword [sym.imp.WS2_32.DLL_send]
test eax, eax
je 0x402494
inc eax
test eax, eax
jne 0x4024f6
mov ecx, 3
test dword [ebp + 0xc], 1
cmovne eax, ecx
jne 0x4024fb
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2747
je 0x402467
mov ecx, 1
cmp eax, 0x271e
cmove eax, ecx
je 0x4024fb
cmp eax, 0x2734
je 0x4024d5
cmp eax, 0x2733
je 0x4024d5
cmp eax, 0x2751
je 0x4024d5
cmp eax, 0x2714
je 0x4024d5
mov eax, 2
jmp 0x4024fb
push 0x1e
call fcn.0040209a
test dword [ebp + 0xc], 8
je 0x402467
sub dword [ebp + 0x10], 0x1e
jae 0x402467
mov eax, 4
jmp 0x4024fb
dec eax
mov dword [edi], eax
xor eax, eax
call fcn.00401026
ret 0x14
Function at 0x402503
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
call fcn.00401018
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, eax
xor edx, edx
push ecx
xor eax, eax
mov ecx, esi
and ecx, 2
cmovne edx, eax
push edx
jmp 0x402530
push 1
call fcn.0040209a
mov ecx, esi
and ecx, 2
mov eax, dword [edi]
pop edx
jne 0x40253c
sub eax, edx
push edx
push ecx
push eax
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.WS2_32.DLL_recv]
test eax, eax
je 0x402566
inc eax
test eax, eax
jne 0x402592
mov ecx, 3
test esi, 1
cmovne eax, ecx
jne 0x4025ee
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
push eax
push 1
call fcn.0040209a
pop eax
cmp eax, 0x2733
je 0x4025c8
mov ecx, 2
cmp eax, 0x2749
cmove eax, ecx
je 0x4025ee
mov eax, 3
jmp 0x4025ee
dec eax
test esi, 4
je 0x4025a5
test eax, eax
je 0x4025c8
mov dword [edi], eax
xor eax, eax
jmp 0x4025ee
xor ecx, ecx
test esi, 2
pop edx
cmovne edx, eax
jne 0x4025b5
add edx, eax
push edx
cmp edx, dword [edi]
cmove eax, ecx
je 0x4025ee
test esi, 2
jne 0x4025c8
add dword [ebp + 0x14], eax
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402529
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [esp + 4]
cmp eax, dword [ebp + 0x10]
jb 0x402529
mov eax, 4
pop edx
mov dword [edi], edx
call fcn.00401026
ret 0x14
Function at 0x4010fc
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, 0x4065d0
cmp dword [ebx], 0
jne 0x401163
push 0x644
push 0
call sub.KERNEL32.DLL_ReadFile
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x401128
xor eax, eax
mov dword [esp], eax
jmp 0x401178
mov eax, dword [esp + 8]
mov edx, dword [0x4065cc]
mov dword [eax], edx
mov eax, dword [esp + 8]
mov dword [0x4065cc], eax
xor eax, eax
mov edx, eax
add edx, edx
mov ecx, dword [esp + 8]
lea edx, [ecx + edx*8 + 4]
mov dword [esp + 4], edx
mov edx, dword [esp + 4]
mov ecx, dword [ebx]
mov dword [edx], ecx
mov edx, dword [esp + 4]
mov dword [ebx], edx
inc eax
cmp eax, 0x64
jne 0x40113f
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop ebx
ret

Function at 0x4019dc
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp byte [0x4065ac], 0
je 0x401ad7
xor eax, eax
push ebp
push 0x401ad0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x406035], 0
je 0x401a10
push 0x4065b4
call sub.KERNEL32.DLL_WritePrivateProfileStringA
mov byte [0x4065ac], 0
mov eax, dword [0x40660c]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
xor eax, eax
mov dword [0x40660c], eax
mov eax, dword [0x4065d4]
mov dword [ebp - 8], eax
jmp 0x401a4e
push 0x8000
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, 0x4065d4
cmp eax, dword [ebp - 8]
jne 0x401a33
mov eax, 0x4065d4
call fcn.00401180
mov eax, 0x4065e4
call fcn.00401180
mov eax, 0x406610
call fcn.00401180
mov eax, dword [0x4065cc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401aa5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x4065cc], eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [0x4065cc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ad7
cmp byte [0x406035], 0
je 0x401ac5
push 0x4065b4
call sub.KERNEL32.DLL_lstrcmpiA
push 0x4065b4
call sub.KERNEL32.DLL_lstrlenA
ret
pop ecx
pop ecx
pop ebp
ret
Function at 0x402908
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 4], edx
mov dword [esp], eax
mov esi, esp
lea edi, [esp + 0x14]
jmp 0x402928
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esi], eax
mov eax, dword [esi]
mov bl, byte [eax]
test bl, bl
je 0x402935
cmp bl, 0x20
jbe 0x40291e
mov eax, dword [esi]
cmp byte [eax], 0x22
jne 0x402949
mov eax, dword [esi]
cmp byte [eax + 1], 0x22
jne 0x402949
add dword [esi], 2
jmp 0x402928
xor ebp, ebp
mov eax, dword [esi]
mov dword [esp + 0xc], eax
jmp 0x4029ae
mov eax, dword [esi]
cmp byte [eax], 0x22
jne 0x40299a
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esi], eax
jmp 0x40297a
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [edi], eax
mov eax, dword [edi]
sub eax, dword [esi]
add ebp, eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [esi]
mov bl, byte [eax]
test bl, bl
je 0x402987
cmp bl, 0x22
jne 0x402966
mov eax, dword [esi]
cmp byte [eax], 0
je 0x4029ae
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esi], eax
jmp 0x4029ae
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [edi], eax
mov eax, dword [edi]
sub eax, dword [esi]
add ebp, eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [esi]
cmp byte [eax], 0x20
ja 0x402953
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.004038c8
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
xor ebp, ebp
jmp 0x402a4f
mov eax, dword [esi]
cmp byte [eax], 0x22
jne 0x402a2b
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esi], eax
jmp 0x402a0b
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [edi], eax
mov eax, dword [esi]
cmp eax, dword [edi]
jae 0x402a0b
mov eax, dword [esi]
mov al, byte [eax]
mov edx, dword [esp + 0x10]
mov byte [edx + ebp], al
inc dword [esi]
inc ebp
mov eax, dword [esi]
cmp eax, dword [edi]
jb 0x4029f7
mov eax, dword [esi]
mov bl, byte [eax]
test bl, bl
je 0x402a18
cmp bl, 0x22
jne 0x4029e7
mov eax, dword [esi]
cmp byte [eax], 0
je 0x402a4f
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [esi], eax
jmp 0x402a4f
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [edi], eax
mov eax, dword [esi]
cmp eax, dword [edi]
jae 0x402a4f
mov eax, dword [esi]
mov al, byte [eax]
mov edx, dword [esp + 0x10]
mov byte [edx + ebp], al
inc dword [esi]
inc ebp
mov eax, dword [esi]
cmp eax, dword [edi]
jb 0x402a3b
mov eax, dword [esi]
cmp byte [eax], 0x20
ja 0x4029d4
mov eax, dword [esi]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403364
Capabilities:
Create process on windows
Create process suspended
Set thread local storage value

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x4033c5
cmp word [0x406208], 0xd7b2
jne 0x40338d
cmp dword [0x406210], 0
jbe 0x40338d
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_CreateProcessA
push eax
call sub.KERNEL32.DLL_FreeResource
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4033ec
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_CreateProcessA
push eax
call sub.KERNEL32.DLL_FreeResource
pop edx
ret
cmp byte [0x405018], 0
jne 0x4033e1
push 0
push 0x40504c
push 0x405054
push 0
call sub.KERNEL32.DLL_TlsSetValue
pop edx
ret

Function at 0x4033f0
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, 0x406620
mov esi, 0x406030
cmp byte [ebx + 0x28], 0
jne 0x40341b
cmp dword [esi], 0
je 0x40341b
mov eax, dword [esi]
mov dword [esp], eax
xor eax, eax
mov dword [esi], eax
call dword [esp]
cmp dword [esi], 0
jne 0x40340a
cmp dword [0x405004], 0
je 0x403435
call fcn.004032d8
call fcn.00403364
xor eax, eax
mov dword [0x405004], eax
cmp byte [ebx + 0x28], 2
jne 0x403449
cmp dword [section.DATA], 0
jne 0x403449
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004031b8
cmp byte [ebx + 0x28], 1
jbe 0x40345d
cmp dword [section.DATA], 0
je 0x403480
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x403480
mov eax, edi
call fcn.004039a0
mov ebp, dword [ebx + 0x10]
mov esi, dword [ebp + 0x10]
cmp esi, dword [ebp + 4]
je 0x403480
test esi, esi
je 0x403480
push esi
call sub.KERNEL32.DLL_GetProcAddress
call fcn.00403190
cmp byte [ebx + 0x28], 1
jne 0x40348e
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x403499
call fcn.00403334
cmp dword [ebx], 0
jne 0x4034b8
cmp dword [0x406018], 0
je 0x4034ad
call dword [0x406018]
mov eax, dword [section.DATA]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov eax, dword [ebx]
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
jmp 0x403435

Function at 0x403a24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403a8a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403618
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b58
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403a74
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a91
lea eax, [ebp - 0x10]
call fcn.004034e8
ret

Function at 0x403be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_VirtualAlloc
ret
Function at 0x404390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call sub.advapi32.dll_RegOpenKeyExA
push ebx
call sub.advapi32.dll_RegCreateKeyExA
inc eax
push eax
push ebx
push 1
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x6a23f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x161000]
push edi
or ebp, 0xffffffff
jmp 0x6a2412
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6a2419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6a2408
mov eax, 1
add ebx, ebx
jne 0x6a242b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6a243c
jne 0x6a245b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6a245b
dec eax
add ebx, ebx
jne 0x6a2448
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6a2420
add ebx, ebx
jne 0x6a2457
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6a24ad
xor ecx, ecx
sub eax, 3
jb 0x6a2473
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6a24e2
sar eax, 1
mov ebp, eax
jmp 0x6a247e
add ebx, ebx
jne 0x6a247e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6a244c
inc ecx
add ebx, ebx
jne 0x6a248c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6a244c
add ebx, ebx
jne 0x6a2499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6a248e
jne 0x6a24aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6a248e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6a24cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6a24be
jmp 0x6a240e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6a24cc
add edi, ecx
jmp 0x6a240e
pop esi
mov edi, esi
mov ecx, 0x47b9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6a24ea
cmp byte [edi], 0x21
jne 0x6a24ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6a24ef
lea edi, [esi + 0x29e000]
mov eax, dword [edi]
or eax, eax
je 0x6a255e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a70bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a719c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6a251c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a71a4]
or eax, eax
je 0x6a2558
mov dword [ebx], eax
add ebx, 4
jmp 0x6a2539
call dword [esi + 0x2a71a0]
mov ebp, dword [esi + 0x2a71a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6a2592
sub esp, 0xffffff80
jmp 0x489f24
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x407610
pop dword [ebp - 0x20]
mov eax, 0xb705fd53
sub eax, 0xb6c58743
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x363ac
push 0
mov eax, 0x3a2e1ffe
sub eax, 0x39ed3f26
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xc4804b11
sub ecx, 0xc4800f4d
xor esi, esi
add esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x20]
mov ebx, 0x3de3007
add dword [ebp - 0xc], 0x40597d5c
mov edx, dword [edi]
sub dword [ebp - 0x1c], edi
add edx, ebx
xor dword [ebp - 0x18], 0x43384387
mov dword [esi], edx
xor dword [ebp - 0x18], esi
add esi, 0xa3fb959d
sub esi, 0xa3fb9599
add edi, 0xada7d7c7
add edi, 0x5258283d
loop 0x407665
add eax, 0xe1e3
xor ebx, ebx
add ebx, eax
add eax, 0x30b9ad10
add eax, 0xcf4652f5
mov ecx, 0x82f4f067
sub ecx, 0x82b4f067
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x402f24
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x425008], 0x8088405
inc edx
mov dword [ebx + 0x425008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x425018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403518
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034f8
xor eax, eax
push ebp
push 0x4034f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403534
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x425018]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x425018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403eb0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x427044], 0
je 0x403f11
cmp word [0x427218], 0xd7b2
jne 0x403ed9
cmp dword [0x427220], 0
jbe 0x403ed9
mov eax, 0x427214
call dword [0x427230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f38
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x425024], 0
jne 0x403f2d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4069a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404120
jmp 0x4069aa
mov eax, ebx
mov edx, esi
call fcn.00404084
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4069b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4069d6
movzx eax, byte [esp]
jmp 0x4069d8
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407068
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406ee0
mov eax, dword [0x426348]
cmp byte [eax], 0
je 0x4070e4
mov eax, dword [0x4262a4]
call fcn.00402f88
call fcn.00402dac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405e28
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40712c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40711a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x426284]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4297f0]
call fcn.00404698
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x848f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f2000]
push edi
jmp 0x848f3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x848f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x848f30
mov eax, 1
add ebx, ebx
jne 0x848f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x848f64
jne 0x848f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x848f83
dec eax
add ebx, ebx
jne 0x848f70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x848f48
add ebx, ebx
jne 0x848f7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x848fd5
xor ecx, ecx
sub eax, 3
jb 0x848f9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84900a
sar eax, 1
mov ebp, eax
jmp 0x848fa6
add ebx, ebx
jne 0x848fa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x848f74
inc ecx
add ebx, ebx
jne 0x848fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x848f74
add ebx, ebx
jne 0x848fc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x848fb6
jne 0x848fd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x848fb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x848ff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x848fe6
jmp 0x848f36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x848ff4
add edi, ecx
jmp 0x848f36
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x849012
cmp byte [edi], 0x11
jne 0x849012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x849017
lea edi, [esi + 0x441000]
mov eax, dword [edi]
or eax, eax
je 0x84908f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b9858]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b99d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x849044
mov ecx, edi
jns 0x849073
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b99d8]
or eax, eax
je 0x849089
mov dword [ebx], eax
add ebx, 4
jmp 0x849061
call dword [esi + 0x7b99e8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x8490c0
cmp al, 0xef
ja 0x8490b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x849095
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8490a2
mov ebp, dword [esi + 0x7b99dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8490f4
sub esp, 0xffffff80
jmp 0x427f4a