joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468b37
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x468b4e
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]

Function at 0x478a07
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc esi
jbe 0x478a09
mov ax, 0x97c4
jmp 0x478a0d
jmp 0x4789f1
mov ax, 0x97c4
mov ebp, dword [esp + 0x30]
jmp 0x478a8e
push esp
xor bx, di
jmp 0x478a56
jmp 0x478a6c
mov byte [esp], al
lea esi, [esp + 8]
sub esp, 0x1d
jbe 0x478a40
ja 0x478ac9
dec eax
invalid
push word [esp + 0x18]
rdtsc
pop word [esp + 4]
lea esp, [esp + 1]
jmp 0x478a9a
clc
jnp 0x478a13
push esp
xor bx, di
mov byte [esp], al
jmp 0x478a59
sub esp, 0x9c
jmp 0x478b3b
lea esp, [esp + 1]
jmp 0x478a9a
push word [esp + 0x18]
rdtsc
pop word [esp + 4]
jmp 0x478ab0
push dx
sub esp, 2
btr ax, dx
mov bh, byte [esp]
dec bx
bswap eax
bswap ebx
jmp 0x478b01
mov ax, word [esp]
add ax, si
js 0x478ad7
push dx
jmp 0x478b17
dec bx
jmp 0x478ae5
lea ebx, [ecx + ecx]
jmp 0x478b23
sub esp, 2
btr ax, dx
mov bh, byte [esp]
jmp 0x478afd
neg ebp
mov eax, 0xdc4725b6
xchg ecx, ebx
xchg bh, ch
mov ecx, edi
jmp 0x478b62
mov edi, esp
bswap edx
bswap edx
mov ah, dl
mov edx, ebp
jmp 0x478af0
mov ch, byte [esp]
jmp 0x478b77
bsf ebx, ebx
mov bx, word [esp]
mov al, 0x85
jmp 0x478bc0
sub ebp, 0x72a55f3e
btr bx, di
jg 0x478b47
mov ch, byte [esp]
jmp 0x478b4c
bsf ebx, ebx
mov bx, word [esp]
mov al, 0x85
mov ah, byte [esp]
clc
jmp 0x478baa
neg ebp
not ecx
bsr ebx, esp
jp 0x478bc5
jnp 0x478e0d
loopne 0x478c35
call 0xdc04064f
mov ah, byte [esp]
jmp 0x478b83
sub esp, 0xe
push word [esp]
mov al, bh
mov ch, bl
jmp 0x478c02
bswap eax
rol ebp, 0
xchg bx, cx
jmp 0x478c1b
lea esp, [esp + 0x10]
add ebp, 0x8689a95
mov ebx, dword [esp]
mov bx, di
btr cx, sp
jmp 0x478d10
mov cx, word [esp]
mov bx, word [esp]
pushal
jmp 0x478c8e
mov ch, bl
jmp 0x478c02
add ebp, dword [esi]
mov bx, word [esp]
mov cx, 0x72bf
jmp 0x478c57
jle 0x478be3
bswap eax
jmp 0x478be5
sub esp, 0xe
push word [esp]
mov al, bh
jmp 0x478c31

Function at 0x47b2d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl bx, cl
mov bx, 0xa406
not ah
lea esp, [esp + 8]
lea ebx, [esi + edi]
add esp, 1
jmp 0x47b1d1
jmp 0x47b225
mov eax, dword [esp + 1]
sub esp, 0xf
jo 0x47b26f
lea esp, [esp + 8]
lea ebx, [esi + edi]
add esp, 1
shl bx, cl
mov bx, 0xa406
jmp 0x47b1d8
Function at 0x4b7bc7
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x4b7c2e
lea esp, [esp + 4]
popal
jmp 0x46a40b

Function at 0x51eccd
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0051e08d
push eax
jmp 0x51e088
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x51ea63
mov dword [esp + 4], esi
mov dword [esp], edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x51eaa7
mov byte [esp], ch
mov dword [esp + 1], ebp
push word [esp + 7]
lea esp, [esp + 2]
jmp 0x51ec1c
Function at 0x10027c1
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1002cc8
call fcn.010029f4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1004750
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100257c
cmp eax, esi
jne 0x100256f
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100257f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002556
xor esi, esi
inc esi
mov eax, dword [0x100474c]
cmp eax, esi
jne 0x1002592
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10025c1
mov eax, dword [0x100474c]
test eax, eax
jne 0x10025bb
mov dword [0x100474c], esi
push 0x1001154
push 0x1001148
call fcn.010024b8
pop ecx
pop ecx
test eax, eax
je 0x10025c1
jmp 0x10026e5
mov dword [0x1004414], esi
mov eax, dword [0x100474c]
cmp eax, esi
jne 0x10025e5
push 0x1001144
push 0x100113c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100474c], 2
cmp dword [ebp - 0x20], ebx
jne 0x10025f2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1004754], ebx
je 0x1002613
push 0x1004754
call fcn.01002969
pop ecx
test eax, eax
je 0x1002613
push ebx
push 2
push ebx
call dword [0x1004754]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10026e5
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100267d
cmp cx, bx
je 0x1002638
cmp dword [ebp - 0x1c], ebx
jne 0x100267d
movzx ecx, word [eax]
cmp cx, bx
je 0x100264d
cmp cx, 0x20
ja 0x100264d
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1002638
test byte [ebp - 0x40], 1
je 0x1002659
movzx ecx, word [ebp - 0x3c]
jmp 0x100265c
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1004410], eax
cmp dword [0x1004404], ebx
jne 0x10026c2
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100268e
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1002622
cmp dword [0x1004414], ebx
jne 0x10026d0
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004410]
jmp 0x10026f1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002a39
ret
call fcn.01002b41
jmp 0x1002519

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x74101000
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret

Function at 0x74101020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 0x3c]
sub esp, 8
cmp dword [eax + edx + 0x7c], 0
jne 0x74101036
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + edx + 0x78]
test ecx, ecx
je 0x74101030
mov eax, dword [ecx + edx + 0x1c]
push ebx
mov ebx, dword [ecx + edx + 0x14]
push esi
mov esi, dword [ecx + edx + 0x24]
add esi, edx
push edi
mov edi, dword [ecx + edx + 0x20]
mov dword [ebp - 8], esi
xor esi, esi
add edi, edx
add eax, edx
dec ebx
mov dword [ebp - 4], esi
je 0x741010dc
mov ecx, dword [edi + esi*4]
add ecx, edx
cmp byte [ecx], 0x47
jne 0x741010ba
cmp byte [ecx + 1], 0x65
jne 0x741010ba
cmp byte [ecx + 2], 0x74
jne 0x741010ba
cmp byte [ecx + 3], 0x50
jne 0x741010ba
cmp byte [ecx + 4], 0x72
jne 0x741010ba
cmp byte [ecx + 5], 0x6f
jne 0x741010ba
cmp byte [ecx + 6], 0x63
jne 0x741010ba
cmp byte [ecx + 7], 0x41
jne 0x741010ba
cmp byte [ecx + 8], 0x64
jne 0x741010ba
cmp byte [ecx + 9], 0x64
jne 0x741010ba
cmp byte [ecx + 0xa], 0x72
jne 0x741010ba
cmp byte [ecx + 0xb], 0x65
jne 0x741010ba
cmp byte [ecx + 0xc], 0x73
jne 0x741010ba
cmp byte [ecx + 0xd], 0x73
je 0x741010c9
inc esi
cmp esi, ebx
jb 0x74101062
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx ecx, word [ecx + esi*2]
mov eax, dword [eax + ecx*4]
pop edi
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x741010f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], 0x4d746547
mov dword [ebp - 0x24], 0x6c75646f
mov dword [ebp - 0x20], 0x6e614865
mov dword [ebp - 0x1c], 0x41656c64
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0x10], 0x506c6175
mov dword [ebp - 0xc], 0x65746f72
mov word [ebp - 8], 0x7463
mov byte [ebp - 6], 0
call fcn.74101000
mov esi, eax
mov edx, esi
call fcn.74101020
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push esi
call ebx
lea ecx, [ebp - 0x14]
push ecx
push esi
mov dword [ebp - 0x34], eax
call ebx
push 0
mov esi, eax
call dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
push eax
mov eax, 1
add eax, 2
sub eax, 3
add eax, dword [ebp - 0x38]
xor eax, eax
add eax, dword [ebp - 0x2c]
add eax, 0x1c03
add eax, 0x10a0
mov dword [ebp - 0x2c], eax
pop eax
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
push edx
push 0x40
push 0x10
push eax
call esi
push ebx
push esi
lea ebx, [0x74101220]
sub ebx, dword [ebp - 0x2c]
sub ebx, 2
sub ebx, 1
add ebx, 1
sub ebx, 1
sub ebx, 2
mov esi, dword [ebp - 0x2c]
mov al, 0xe9
mov byte ds:[esi], al
inc esi
mov dword [esi], ebx
pop esi
pop ebx
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.74101463
mov esp, ebp
pop ebp
ret

Function at 0x74101463
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x7410146d
repz ret
jmp fcn.7410172a
Function at 0x7410529a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.74101830
and dword [ebp - 0x14], 0
cmp dword [0x74109784], 0
mov dword [ebp - 0x18], eax
jne 0x7410534d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x741053f5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x741053f5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x74109784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x74109788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x7410978c], eax
call edi
push eax
call esi
mov dword [0x74109794], eax
test eax, eax
je 0x7410534d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x74109790], eax
mov eax, dword [0x74109790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x741053a6
cmp dword [0x74109794], ecx
je 0x741053a6
push eax
call esi
push dword [0x74109794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x741053a6
test ebx, ebx
je 0x741053a6
call edi
test eax, eax
je 0x7410539d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x7410539d
test byte [ebp - 8], 1
jne 0x741053a6
or dword [ebp + 0x10], 0x200000
jmp 0x741053d9
mov eax, dword [0x74109788]
cmp eax, dword [ebp - 0x18]
je 0x741053d9
push eax
call esi
test eax, eax
je 0x741053d9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x741053d9
mov eax, dword [0x7410978c]
cmp eax, dword [ebp - 0x18]
je 0x741053d9
push eax
call esi
test eax, eax
je 0x741053d9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x74109784]
call esi
test eax, eax
je 0x741053f5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x741053f7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.74101463
leave
ret
Function at 0x2d7e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x2d7e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2d7e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2d7e06a
add dl, dl
jne 0x2d7e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2d7e0dc
xor eax, eax
add dl, dl
jne 0x2d7e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2d7e17d
add dl, dl
jne 0x2d7e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2d7e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2d7e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2d7e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x2d7e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2d7e075
mov eax, 1
add dl, dl
jne 0x2d7e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2d7e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2d7e0e1
sub eax, ebx
mov ebx, 1
jne 0x2d7e128
mov ecx, 1
add dl, dl
jne 0x2d7e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2d7e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2d7e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d7e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2d7e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2d7e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2d7e136
cmp eax, 0x7d00
jae 0x2d7e16d
cmp eax, 0x500
jb 0x2d7e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d7e075
cmp eax, 0x7f
ja 0x2d7e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d7e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2d7e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2d7e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403418
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004053c0
test esi, esi
jne 0x40344e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004054b0
jmp 0x40346c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040331c
mov edi, eax
test esi, esi
je 0x40346c
cmp dword [ebx], 0
je 0x40346c
dec esi
jmp 0x403455
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40421c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x59f020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4042b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404294
xor eax, eax
push ebp
push 0x40428d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4042d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404294
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x59f020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x59f020], ax
mov esp, ebp
pop ebp
ret

Function at 0x405220
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5bf04c], 0
je 0x405281
cmp word [0x5bf220], 0xd7b2
jne 0x405249
cmp dword [0x5bf228], 0
jbe 0x405249
mov eax, 0x5bf21c
call dword [0x5bf238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4052a8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x59f02c], 0
jne 0x40529d
push 0
push 0x59f75c
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x407220
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x407450
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4072a3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x407450
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4072a3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40746c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40732c
xor eax, eax
push ebp
push 0x407325
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040705c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40730a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40748c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40730a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40732c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x407446
cmp byte [ebp - 0xd], 0
jne 0x407373
cmp byte [ebp - 0x12], 0
je 0x407446
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40738c
dec ebx
cmp byte [ebx], 0x2e
je 0x40739b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40738b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x407446
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4073d8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x407446
cmp byte [ebp - 0xd], 0
je 0x407446
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x407446
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407e40
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, 0x5c1808
mov dword [esi], sub.borlndmm.dll__Borlndmm_SysGetMem_qqri
push 0x407ec8
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
call fcn.00407d78
push 0x407ed8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
push 0x407ef4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi + 4], eax
push 0x407f10
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi + 8], eax
push 0x407f30
push ebx
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x407e99
mov dword [esi + 0xc], eax
push 0x407f4c
push ebx
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x407eab
mov dword [esi + 0x10], eax
push 0x407f7c
push ebx
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x407ebd
mov dword [esi + 0x14], eax
mov eax, esi
call fcn.00403054
pop esi
pop ebx
ret

Function at 0x409f2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409f7e
test eax, edx
je 0x409f81
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409f41
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x409f67
add ecx, 4
js 0x409f57
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x409f64
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409f8d
test edx, edx
jne 0x409f34
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405850
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40b039
test al, 0x10
je 0x40b03d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40e778
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e7b1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004054b0
jmp 0x40e7ba
mov eax, ebx
mov edx, esi
call fcn.00405414
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e7c4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e7e6
movzx eax, byte [esp]
jmp 0x40e7e8
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret