joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dc00
Capabilities:
Encode data using xor

Disassembly:
and al, 0
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x61993]
add byte [eax], al
nop
mov esp, 0x24
add byte [eax], al
add byte [eax], al
add byte [eax], al
or eax, dword [eax]
add byte [eax], al
sar byte [esp + 0x2000], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x41993]
add byte [eax], al
add byte [edx], ah
add eax, 0x41993
add byte [eax], al
and byte [esp], bh
add byte [eax], al
add byte [eax], al
add byte [edi], al
add byte [eax], al
add byte [eax - 0x44], al
and al, 0
xor byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x31993]
add byte [eax], al
les edi, [ebx + 0x24]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
loopne 0x45dc33
and al, 0
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x31993]
add byte [eax], al
js 0x45dc4b
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
nop
mov ebx, 0x24
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x21993]
add byte [eax + 0x24bb], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], ah
add eax, 0x21993
add byte [eax], al
xor al, 0xbb
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
dec eax
mov ebx, 0x280024
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x81993]
add byte [eax], al
jl 0x45dc9d
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
sar byte [ebp + 0x480024], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], ah
add eax, 0x21993
add byte [eax], al
xor al, 0xbd
and al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
dec eax
mov ebp, 0x480024
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x11993]
add byte [eax], al
sub byte [esi + 0x23], bh
and eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
push eax
invalid
and al, 0
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, byte [0x11993]
add byte [eax], al
mov al, byte [0x239d]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], dh
invalid
Function at 0x4972f0
Capabilities:
Encode data using xor

Disassembly:
and al, byte [eax]
or al, 6
add dword [eax], eax
add byte [esi], 1
add byte [eax], al
fsub dword [edx]
add byte [eax - 0x29fffefa], al
pop es
add dword [eax], eax
or al, 0xd8
and al, byte [eax]
fadd dword [edi]
add dword [eax], eax
jno 0x49731d
add dword [eax], eax
dec eax
fsub dword [edx]
add byte [ebp + ecx + 1], dh
add byte [0x8800010e], dl
fsub dword [edx]
add byte [eax], bl
add byte [eax + 0x180022d8], cl
push cs
add dword [eax], eax
jecxz 0x497337
add dword [eax], eax
rcr al, 0x22
add ah, ah
sgdt [eax]
rcl byte [eax], cl
add dword [eax], eax
call 0xd4499613
fsub dword [edx]
add ah, dl
adc byte [ecx], al
add byte [ecx + 0x11], bh
add dword [eax], eax
cld
fsub dword [edx]
add byte [ecx + edx + 0x12cf0001], al
add dword [eax], eax
adc byte [esi + 0x12d00022], bh
add dword [eax], eax
mov edx, 0x10000113
mov esi, 0x13bc0022
add dword [eax], eax
adc al, 1
add byte [edx + ecx*8 + 0x14400022], dl
add dword [eax], eax
xchg esp, eax
adc al, 1
add byte [edi*4 + 0x14940022], dh
add dword [eax], eax
rcl dword [ecx + eax]
add byte [eax - 0x41], ch
and al, byte [eax]
aam 0x14
add dword [eax], eax
or edx, dword [0xbf680001]
and al, byte [eax]
or al, 0x15
add dword [eax], eax
jne 0x4973a9
add dword [eax], eax
and cl, bl
and al, byte [eax]
js 0x4973b1
add dword [eax], eax
test al, 0x15
add cl, ah
adc eax, 0xd9980001
and al, byte [eax]
in al, 0x15
add dword [eax], eax
push eax
push ss

Function at 0x4ea32d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d2f90
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x5dd040]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, eax
mov edi, dword [ebp + 8]
mov eax, edx
shr eax, 4
and eax, 0xffffff01
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], eax
mov eax, edx
shr eax, 6
and eax, 0xffffff01
mov byte [esp + 0x17], 0
mov dword [esp + 0x28], eax
mov eax, edx
shr eax, 7
and eax, 0xffffff01
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x17]
push eax
mov eax, dword [edi + 0x14]
push ecx
push ecx
mov ecx, ebx
push dword [eax + 0x14]
push edi
call fcn.004ea123
mov esi, eax
mov byte [esp + 0x16], 1
mov eax, dword [esi + 0x54]
test eax, eax
je 0x5ceb14
jmp 0x5ceb0d
Function at 0x4fc114
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
or eax, 0x3f2ce900
or eax, 0xec8b5500
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d303d
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x5dd040]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x1c], edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
mov esi, dword [ebp + 0xc]
push esi
push ebx
mov dword [esp + 0x1c], 0
call 0x5cfeae
mov edx, eax
mov dword [esp + 0x18], edx
push 5
test edx, edx
je 0x5cf12a
mov eax, dword [edx + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
push edx
push dword [eax + 0x78]
lea ecx, [eax + 0x14]
call fcn.004f22dc
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0x14]
mov dword [esp + 0x2c], esi
or dword [esi + 0xc], 8
or byte [esi + 0x20], 1
push ebx
call fcn.004fbee8
mov dword [esp + 0x14], eax
test eax, eax
je 0x5cf08e
mov eax, dword [edi + 4]
push 0
push 0
push dword [eax + 0x80]
lea ecx, [eax + 0x14]
push ebx
call fcn.004ea794
mov ecx, dword [edi + 4]
mov dword [esp + 0x38], eax
push ecx
mov eax, dword [ecx + 0x7c]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [ecx + 0x74]
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0x68]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 0x70]
mov dword [esp + 0x44], eax
mov eax, dword [ecx + 0x6c]
mov dword [esp + 0x34], edx
mov edx, ebx
mov dword [esp + 0x48], eax
call fcn.004e8962
mov ecx, dword [edi + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ebx, dword [eax]
mov dword [esp + 0x30], ebx
lea edx, [ebx + 0xbc]
mov dword [eax], edx
cmp edx, dword [eax + 4]
ja 0x5cf14b
jmp 0x5cf161
Function at 0x4fc9fa
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d30a9
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x5dd040]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
test eax, eax
jne 0x5cf742
mov eax, dword [eax + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 4]
push 6
push edx
push dword [eax + 0x78]
lea ecx, [eax + 0x14]
call fcn.004f22dc
mov esi, dword [ebp + 8]
push 0
push 0
or dword [eax + 0xc], 8
or byte [eax + 0x20], 1
mov ecx, dword [ebx + 4]
mov dword [esp + 0x24], eax
push dword [ecx + 0x80]
lea ecx, [ecx + 0x14]
push esi
call fcn.004ea794
mov ecx, dword [ebx + 4]
mov dword [esp + 0x38], eax
push ecx
mov eax, dword [ecx + 0x7c]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0x74]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 0x68]
mov dword [esp + 0x48], eax
mov eax, dword [ecx + 0x70]
mov dword [esp + 0x40], eax
mov eax, dword [ecx + 0x6c]
mov dword [esp + 0x30], edx
mov edx, esi
mov dword [esp + 0x44], eax
call fcn.004e8962
mov ecx, dword [ebx + 4]
mov edi, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov ebx, dword [eax]
lea edx, [ebx + 0xbc]
mov dword [eax], edx
cmp edx, dword [eax + 4]
ja 0x5cf751
jmp 0x5cf763
Function at 0x51ad8c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cdc39
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5dd040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x402284
mov dword [ebp - 4], 0
mov dword [esi], 0x402a48
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 2
lea eax, [esi + 0x3c]
mov dword [esi], 0x461470
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0xa
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 5
push 0x18
call dword [0x5e2228]
jmp 0x59eece

Function at 0x51d312
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cdfd0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5dd040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [esi], edx
mov dword [esi + 8], 0
mov dword [ebp + 8], ecx
lea eax, [edx + 0x94]
mov dword [esi + 4], eax
mov eax, dword [edx + 0x10]
add eax, 0x30
mov dword [ecx], 0x4639f8
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0xffffffff
mov dword [ebp - 4], 0
mov dword [ecx], 0x4639f8
mov dword [ebp - 4], 1
mov eax, dword [edx + 0x10]
add eax, 0x30
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], eax
mov byte [ebp - 4], 2
lea eax, [esi + 0x30]
mov dword [esi + 0x2c], 0
mov dword [ebp + 8], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5209c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test bx, bx
je 0x520ee0
fisttp dword [edi]
test byte [ebx + 0x10], bl
add byte [eax], al
push ebx
call fcn.00520d0b
push dword [ebp + 8]
movzx ebx, ax
call fcn.00520d0b
movzx eax, ax
mov ecx, ebx
sub ecx, eax
jne 0x520ee0
jmp 0x520edb
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5dd040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
lea eax, [ebp - 0x210]
push esi
push edi
cmp dword [ebx + 0xc], 0
je 0x5328e1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x4baa0e
mov esp, ebp
pop ebp
ret
movzx eax, word [esi]
movzx ebx, word [edi + esi]
mov dword [ebp + 8], eax
movzx eax, ax
mov ecx, ebx
lea esi, [esi + 2]
sub ecx, eax
jne 0x51fe7c
test bx, bx
jne 0x520ec1
push ecx
call fcn.00520e7d
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], eax
jmp 0x51fe7e

Function at 0x521e28
Capabilities:
Access peb ldr_data

Disassembly:
pop esp
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x51], dl
Function at 0x5244ac
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc0eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5dd040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xa
mov dword [ebp - 4], 0
lea ecx, [edi + 0x48]
mov ebx, dword [ebp + 0x18]
lea eax, [edi + 0x84]
push ecx
push eax
push 0
push ebx
lea esi, [edi + 0x10c]
push esi
push dword [ebp + 8]
call fcn.00524477
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [edi + 0x68], eax
lea eax, [edi + 0x84]
mov dword [edi + 0x78], eax
mov eax, dword [ebp + 0x14]
push 1
mov dword [edi + 0x64], esi
mov byte [edi + 0x74], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x80], eax
mov edi, dword [ebp + 0xc]
push 0xd
push edi
call fcn.0052050c
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x138], 0
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x148], 0
mov dword [esi + 0x14c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x150], 0
mov dword [esi + 0x154], 0
mov dword [esi + 0x158], 0
mov dword [esi + 0x15c], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x1c8]
mov dword [esi + 0x160], 0
mov dword [esi + 0x164], 0
mov dword [esi + 0x168], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x170], 0
mov dword [esi + 0x174], 0
mov dword [esi + 0x178], 0
mov dword [esi + 0x17c], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
mov dword [esi + 0x188], 0
mov dword [esi + 0x18c], 0
mov dword [esi + 0x190], 0
mov dword [esi + 0x194], 0
mov dword [esi + 0x198], 0
mov dword [esi + 0x19c], 0
mov dword [esi + 0x1a0], 0
mov dword [esi + 0x1a4], 0
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], edi
push 0
mov dword [esi + 0x1b4], 0
mov dword [esi + 0x1b8], 0
mov dword [esi + 0x1bc], 0
mov dword [esi + 0x1c0], 0
mov dword [esi + 0x1c4], 0
call fcn.00521e28
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 8]
mov byte [0x5dd050], 0xb
mov dword [esi + 0x108], ecx
mov dword [esi + 0x1a8], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov eax, dword [esi]
test eax, eax
je 0x5876b8
jmp 0x5876aa
Function at 0x402f8c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x467008], 0x8088405
inc edx
mov dword [ebx + 0x467008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403668
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x467024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403700
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036e0
xor eax, eax
push ebp
push 0x4036d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40371c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x467024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x467024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044f4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x522048], 0
je 0x404555
cmp word [0x52221c], 0xd7b2
jne 0x40451d
cmp dword [0x522224], 0
jbe 0x40451d
mov eax, 0x522218
call dword [0x522234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40457c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x467030], 0
jne 0x404571
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4046ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x467034], 0
je 0x4046d2
mov edx, esi
mov eax, ebx
call dword [0x467034]
jmp 0x4046e1
mov eax, 8
call fcn.00402c9c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x522049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404674
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x405b40
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d70
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405bc3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d70
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405bc3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d8c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405c4c
xor eax, eax
push ebp
push 0x405c45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040597c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c2a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405dac
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405c2a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c4c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d66
cmp byte [ebp - 0xd], 0
jne 0x405c93
cmp byte [ebp - 0x12], 0
je 0x405d66
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405cac
dec ebx
cmp byte [ebx], 0x2e
je 0x405cbb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405cab
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d66
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405cf8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d66
cmp byte [ebp - 0xd], 0
je 0x405d66
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d66
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408254
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4082e4
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4082e4
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408297
test edx, 3
jne 0x408286
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408291
jmp 0x408297
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408297
cmp dword [ecx - 8], 1
je 0x4082a1
mov edx, ebx
or edx, 3
call fcn.00404e74
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4082b3
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404728

Function at 0x4082f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408380
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408380
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408333
test edx, 3
jne 0x408322
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40832d
jmp 0x408333
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408333
cmp dword [ecx - 8], 1
je 0x40833d
mov edx, ebx
or edx, 3
call fcn.00404e74
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40834f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404728

Function at 0x40b75c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b795
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404818
jmp 0x40b79e
mov eax, ebx
mov edx, esi
call fcn.0040477c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b7a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7ca
movzx eax, byte [esp]
jmp 0x40b7cc
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret