joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100770f0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x10077110
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x1007a330
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret

Function at 0x1007a750
Capabilities:
Hash data using sha256

Disassembly:
mov eax, 0x70
call fcn.100e2c60
push esi
mov esi, dword [esp + 0x80]
test esi, esi
jne 0x1007a76b
mov esi, 0x10129034
push 0x70
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x88], 0x20
call fcn.1007a390
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.1007a470
lea edx, [esp + 0x24]
push 0x70
push edx
call fcn.10089ca0
add esp, 0x28
mov eax, esi
pop esi
add esp, 0x70
ret
Function at 0x1007f810
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.100e2c60
mov eax, dword [0x10128b90]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x1007f885
cmp ebx, dword [esi]
je 0x1007f87c
test edi, edi
je 0x1007f862
cmp dword [esp + 0xa0], eax
jge 0x1007f87c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100e3224
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x1007f88b
mov ebx, dword [esi]
test ebx, ebx
je 0x1007f862
push ebp
test edi, edi
je 0x1007f95d
push ebx
call fcn.1007fda0
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x1007f8bb
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.1008a590
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x1007f915
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.10080a50
add esp, 0xc
test eax, eax
je 0x1007fa0a
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.10080c00
add esp, 0xc
test eax, eax
je 0x1007fa0a
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.10080c10
add esp, 0xc
test eax, eax
je 0x1007fa0a
jmp 0x1007f93a
cmp eax, 0x80
ja 0x1007fa0a
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call sub.MSVCR90.dll_memcpy
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x1007f965
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
jmp 0x1007f965
test eax, eax
je 0x1007f9f6
xor eax, eax
jmp 0x1007f970
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x1007f970
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.10080a50
add esp, 0xc
test eax, eax
je 0x1007fa0a
push ebx
call fcn.1007fda0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10080c00
add esp, 0x10
test eax, eax
je 0x1007fa0a
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x1007f9b4
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.10080a50
add esp, 0xc
test eax, eax
je 0x1007fa0a
push ebx
call fcn.1007fda0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10080c00
add esp, 0x10
test eax, eax
je 0x1007fa0a
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.10080d70
add esp, 8
test eax, eax
jne 0x1007fa0e
xor eax, eax
jmp 0x1007fa13
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e3224
add esp, 0x88
ret
Function at 0x1008a440
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.100e2c60
mov eax, dword [0x10128b90]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x1008a4c8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1008a4c8
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call dword [sym.imp.MSVCR90.dll__vsnprintf]
add esp, 0x10
test eax, eax
jge 0x1008a49e
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100e3224
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call dword [sym.imp.MSVCR90.dll__vsnprintf]
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1008a55b
call fcn.1008a300
test eax, eax
jle 0x1008a55b
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x1008a56f
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100e3224
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.100e3224
add esp, 0x108
ret

Function at 0x1008a5c0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x1008a5e8
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
sub edi, 1
jne 0x1008a5d7
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x100a0c60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x100a0c79
mov esi, edi
mov edi, eax
jmp 0x100a0c7b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x100a0c8b
mov eax, ebx
jmp 0x100a0c95
push eax
push ebx
call fcn.1007ed80
add esp, 8
test eax, eax
jne 0x100a0c9d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x100a0cb9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x100a0ca4
cmp eax, dword [esi + 4]
jge 0x100a0cd0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x100a0cc0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x100a0cf1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100a0cee
dec eax
test eax, eax
jg 0x100a0ce0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100e0580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x100e0664
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x100e05ff
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100e0120
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100e05cd
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x100e071d
call 0x100e0611
pop edx
lea ecx, [edx + 0x12f]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x100e06bc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100e0250
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100e0675
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x100e071d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100e0250
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100e0718
jmp 0x100e071d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100e3224
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10128b90]
jne 0x100e322e
repz ret
jmp fcn.100e3842
Function at 0x101330d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x101331dc
test eax, eax
je 0x101331dc
push esi
push edi
mov ecx, 0x10
mov esi, 0x1014e018
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x101331c3
lea edi, [eax + 4]
jmp 0x10133127
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1013313c
mov dword [ebp - 4], 2
jmp 0x1013315d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10133153
mov dword [ebp - 4], 1
jmp 0x1013315d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x101331d3
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10133196
mov byte [ecx], 0x3d
jmp 0x101331a2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x101331ad
mov byte [ecx], 0x3d
jmp 0x101331b3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10133124
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45900c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403428
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403408
xor eax, eax
push ebp
push 0x403401
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403444
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403408
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45900c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45900c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404108
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45b048], 0
je 0x404169
cmp word [0x45b21c], 0xd7b2
jne 0x404131
cmp dword [0x45b224], 0
jbe 0x404131
mov eax, 0x45b218
call dword [0x45b234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x459054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404190
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45901c], 0
jne 0x404185
push 0
push 0x459074
push 0x459054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405bc0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405df0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c43
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405df0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c43
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405ccc
xor eax, eax
push ebp
push 0x405cc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405a08
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405caa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405e2c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405caa
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ccc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405de6
cmp byte [ebp - 0xd], 0
jne 0x405d13
cmp byte [ebp - 0x12], 0
je 0x405de6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405d2c
dec ebx
cmp byte [ebx], 0x2e
je 0x405d3b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405d2b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405de6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405d78
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405de6
cmp byte [ebp - 0xd], 0
je 0x405de6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405de6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4097b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4097e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404374
jmp 0x4097f2
mov eax, ebx
mov edx, esi
call fcn.004042d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4097fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40981d
mov al, byte [esp]
jmp 0x40981f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409ea4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409d1c
mov eax, dword [0x459f1c]
cmp byte [eax], 0
je 0x409f0c
mov eax, dword [0x459d64]
call fcn.00402c70
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004089e8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409f54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409f42
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x459d24]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45b714]
call fcn.004059cc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40aaa8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40ab0c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044ec
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004086e0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ab13
lea eax, [ebp - 0xc]
call fcn.00404284
ret
Function at 0x41c868
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45ba20
cmp dword [edi], 0
jne 0x41c8e4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45ba1c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4594bc
mov ecx, 2
call fcn.004028d4
mov edx, 0x41c840
lea eax, [esi + 5]
call fcn.0041c860
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041c860
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41c8b9
mov dword [0x45ba1c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41dd78
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41dd7e
ret

Function at 0x420210
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x420261
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x420248
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x420238
jmp 0x420261
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x420249
pop ebx
mov esp, ebp
pop ebp
ret