joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d66f
Capabilities:
Encode data using xor

Disassembly:
dec ebx
out dx, al
arpl word [edi + 0x1b], bx
in eax, 0x96
adc byte [eax + 0x361f04b9], bl
test eax, 0x540a108f
adc dword [ebp + 0x15], 0xdf7f9833
sbb ebp, dword [edx + 0x6b8288d1]
mov byte [edx + 0x69de736b], al
cmp dh, bh
sub eax, dword [eax - 0x77b08690]
xor al, 0xf8
jae 0x47d652
imul edi, dword [edx], 0x70802bf7
jns 0x47d6cb
mov byte [eax + edi*8], dh
and bh, byte [edi]
dec esp
cli
jle 0x47d672
test eax, 0xd2b83c5f
mov fs, esp
pop edx
push ebx
invalid
jge 0x47d6d4
sar byte [ebx - 0x3a5061a6], 0x3b
xchg edi, eax
int 0xbb
ficom dword [eax]
wait
lodsd eax, dword ds:[esi]
xor dh, byte [edi]
fcmovu st(0), st(7)
xchg ebp, eax
aas
lcall 0xce8c, 0xfaf4b06a
xor ah, byte [ebx + 7]
mov ebx, 0x108db2f4
pushal
push ebx
cmp al, 0xf5
dec dword [edi]
cmp eax, 0x188fb63e
or edx, esp
pop ebx
mov edi, 0x2bb2f23b
mov dword [ebx - 0x5c], esp
add byte [esi + eax], bl
scasd eax, dword es:[edi]
push ebx
add dl, dh
cwde
jae 0x47d6cb
dec eax
int1
cld
xor eax, esp
outsd dx, dword [esi]
push eax
mov bh, 0x28
loop 0x47d72f
or eax, ecx
sbb al, 0xc6
lcall 0x4767, 0x3a1cfb8e
sti
sbb al, 0x3a
inc edi
jbe 0x47d725
enter 0x2c43, 0x73
in al, dx
jae 0x47d71d
call 0xe1e42a9b
jns 0x47d79f
push ss
xchg esi, eax
push ecx
sbb byte [ecx], 0x59
push ebp
and ah, byte [eax]
inc edi
ret 0x684d
pop eax
push es
xchg dl, ch
test byte [ebx], al
sahf
mov ah, 3
in eax, 0xf5
pop ecx
invalid
aad 0xe0
enter 0x2355, 0x5c
cwde
int 0xef
sbb al, 0xfa
jne 0x47d798
wait
mov esi, 0x5f62bf42
test dword [edi + 0x3a], esp
jmp 0x47d778
push ebx
rol dword [eax], cl
enter 0x225e, 0x2c
adc bh, al
dec edi
jno 0x47d766
das
cmpsd dword [esi], dword es:[edi]
out dx, eax
push es
in al, dx
loopne 0x47d78d
inc edx
fistp dword [eax - 0x57]
add ah, byte [edx - 0x59]
into
ret
Function at 0x4b3220
Capabilities:
Encode data using xor

Disassembly:
test dword [edi - 0x76], ecx
mul dword [ebx + ebx - 0x21]
cmp edi, ebx
pop ds
pop esp
adc ebx, dword [esi - 0x67]
add al, al
lea eax, [ebp - 0x15]
xchg esi, eax
fistp qword [ebx]
sbb bl, bh
xchg esi, eax
rcr dword [edi], cl
fist word [ebx]
cmp eax, 0xdd96284a
hlt
fistp dword [esi]
push esp
adc edi, dword [ebp - 0x6a]
jge 0x4b31b8
jge 0x4b31b8
xchg ebx, eax
push ebx
pop edi
sub byte [ebx - 0x239d290a], ah
pop ebp
scasd eax, dword es:[edi]
out dx, eax
pop esp
mov ebp, 0xc1df1ce1
imul ecx, dword [ecx - 0x40], 0x6ea1f63c
pop ss
adc bl, byte [edi]
shr dword [ecx + 0x49], 0xc0
cmp al, 0xf6
mov eax, dword [0x1f12176e]
aad 0x46
pop edi
adc al, 0x25
pop esp
or ah, byte [0x1f8d8968]
xor al, dl
lahf
or eax, 0x7bd32fa4
add dl, byte [eax]
jle 0x4b321c
movsd dword es:[edi], dword [esi]
mov edi, 0x52d4f11e
jnp 0x4b3233
lahf
jmp 0x91ec7d06

Function at 0x4bae26
Capabilities:
Query environment variable

Disassembly:
push 0x94ffffff
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x4bae52
cmp dword [ebp - 0x88], 2
jne 0x4bae52
cmp dword [ebp - 0x94], 5
jb 0x4bae52
push 1
pop eax
jmp 0x4baf54
lea eax, [ebp - 0x122c]
push 0x1090
push eax
push str.__MSVCRT_HEAP_SELECT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4baf41
xor ebx, ebx
lea ecx, [ebp - 0x122c]
cmp byte [ebp - 0x122c], bl
je 0x4bae94
mov al, byte [ecx]
cmp al, 0x61
jl 0x4bae8f
cmp al, 0x7a
jg 0x4bae8f
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4bae81
lea eax, [ebp - 0x122c]
push 0x16
push eax
push str.__GLOBAL_HEAP_SELECTED
call fcn.004bcdc0
add esp, 0xc
test eax, eax
jne 0x4baeb6
lea eax, [ebp - 0x122c]
jmp 0x4baeff
lea eax, [ebp - 0x19c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x19c], bl
lea ecx, [ebp - 0x19c]
je 0x4baeea
mov al, byte [ecx]
cmp al, 0x61
jl 0x4baee5
cmp al, 0x7a
jg 0x4baee5
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4baed7
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x122c]
push eax
call fcn.004bcd40
pop ecx
pop ecx
cmp eax, ebx
je 0x4baf41
push 0x2c
push eax
call fcn.004bcc80
pop ecx
cmp eax, ebx
pop ecx
je 0x4baf41
inc eax
mov ecx, eax
cmp byte [eax], bl
je 0x4baf26
cmp byte [ecx], 0x3b
jne 0x4baf21
mov byte [ecx], bl
jmp 0x4baf22
inc ecx
cmp byte [ecx], bl
jne 0x4baf18
push 0xa
push ebx
push eax
call fcn.004bca52
add esp, 0xc
cmp eax, 2
je 0x4baf54
cmp eax, 3
je 0x4baf54
cmp eax, 1
je 0x4baf54
lea eax, [ebp - 4]
push eax
call fcn.004bade2
cmp byte [ebp - 4], 6
pop ecx
sbb eax, eax
add eax, 3
pop ebx
leave
ret
Function at 0x401790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edx
push ecx
push 0
mov dword [esp], ecx
sub ecx, ecx
or ecx, dword [ebp + 8]
mov eax, ecx
pop ecx
add eax, dword [eax + 0x3c]
push eax
push 0
mov dword [esp], esi
xor esi, esi
xor esi, eax
mov edi, esi
pop esi
movzx eax, word [edi + 6]
push 0
mov dword [esp], ebx
xor ebx, ebx
or ebx, eax
mov dword [ebp - 4], ebx
pop ebx
push edi
push 0
mov dword [esp], ebp
sub ebp, ebp
or ebp, dword [edi + 0x54]
mov edx, ebp
pop ebp
push 0
mov dword [esp], eax
xor eax, eax
xor eax, dword [ebx + 0x48c0cc]
mov edi, eax
pop eax
push 0
mov dword [esp], edx
sub edx, edx
or edx, dword [ebp + 8]
mov esi, edx
pop edx
push 0
mov dword [esp], esi
sub esi, esi
add esi, edx
mov ecx, esi
pop esi
cmp edi, esi
je 0x401830
movsb byte es:[edi], byte [esi]
dec ecx
jne 0x401801
push 0
mov dword [esp], ecx
xor ecx, ecx
or ecx, dword [ebx + 0x48c0cc]
mov edi, ecx
pop ecx
mov dword [ebx + 0x48c0ac], 0x40
lea eax, [ebx + 0x48c0ac]
push eax
push 2
push edx
push edi
call dword [ebx + sym.imp.kernel32.dll_VirtualProtect]
pop edi
add edi, 0xf8
push edi
push 0
mov dword [esp], edx
sub edx, edx
xor edx, dword [ebp + 8]
mov esi, edx
pop edx
push 0
mov dword [esp], ebp
xor ebp, ebp
or ebp, dword [edi + 0x10]
mov ecx, ebp
pop ebp
add esi, dword [edi + 0x14]
mov edi, dword [edi + 0xc]
add edi, dword [ebx + 0x48c0cc]
rep movsb byte es:[edi], byte [esi]
pop edi
add edi, 0x28
dec dword [ebp - 4]
jne 0x401837
pop edi
push 0
mov dword [esp], edx
sub edx, edx
or edx, dword [edi + 0x28]
mov eax, edx
pop edx
add eax, dword [ebx + 0x48c0cc]
push 0
mov dword [esp], edx
xor edx, edx
xor edx, eax
mov dword [ebx + 0x48c028], edx
pop edx
push 0
mov dword [esp], edi
sub edi, edi
add edi, dword [ebx + 0x48c0cc]
mov esi, edi
pop edi
cmp esi, 0
jbe 0x4018a8
push esi
call fcn.00401380
pop ecx
pop edx
leave
ret 4
Function at 0x404844
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x404886
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4048a6
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00407f3c
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x404ac8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406f98
test esi, esi
jne 0x404afe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407120
jmp 0x404b1c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404a0c
mov edi, eax
test esi, esi
je 0x404b1c
cmp dword [ebx], 0
je 0x404b1c
dec esi
jmp 0x404b05
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404b50
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x73f008], 0x8088405
inc edx
mov dword [ebx + 0x73f008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x405cf8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004060f0
mov byte [esp], al
cmp byte [esp], 0
jne 0x405e84
test edi, edi
je 0x405e84
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405dbb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405d96
cmp edi, 0xffffffff
je 0x405d57
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405d57
mov byte [esp], 0
jmp 0x405e84
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405d96
test ebx, ebx
jne 0x405d8c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.004028b4
test eax, eax
jne 0x405d8c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405e84
call 0x406214
dec ebp
test ebp, ebp
jg 0x405d3c
cmp edi, 0xffffffff
je 0x405dbb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405db9
mov byte [esp], 0
jmp 0x405e84
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x405d06
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.004028b4
cmp ebx, eax
jne 0x405dbb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405ef4
mov edx, eax
mov ebx, dword [0x77d8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405e22
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405e20
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405e22
xor edi, edi
cmp byte [esp], 0
je 0x405e4b
mov ebx, dword [esi]
test bl, 1
jne 0x405e64
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.004028b4
cmp ebx, eax
jne 0x405e28
mov byte [esp + 1], 1
jmp 0x405e64
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.004028b4
cmp ebx, eax
jne 0x405e4b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405dd5
cmp byte [esp], 0
je 0x405e84
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406c30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x77d058], 0
je 0x406c97
cmp word [0x77d344], 0xd7b2
jne 0x406c59
cmp dword [0x77d34c], 0
jbe 0x406c59
mov eax, 0x77d340
call dword [0x77d35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x406cc4
call fcn.00407910
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x73f034], 0
jne 0x406cb3
push 0
push 0x73f9d2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406e54
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x73f038], 0
je 0x406e7f
mov edx, edi
mov eax, esi
call dword [0x73f038]
mov ebx, eax
jmp 0x406e90
mov eax, 8
call fcn.0040466c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x77d059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406e1c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406ec5
mov edx, 8
mov eax, ebx
call fcn.00404688
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x409a80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409be5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406f98
cmp si, word [0x73fa10]
jb 0x409b18
cmp si, word [0x73fc10]
ja 0x409b18
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x409b18
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x73fa10]
jae 0x409af2
mov edi, ebx
dec edi
jmp 0x409b13
cmp si, word [ebx*8 + 0x73fa10]
jbe 0x409b02
inc ebx
mov dword [ebp - 8], ebx
jmp 0x409b13
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x73fa14]
call fcn.00409990
jmp 0x409b18
cmp edi, dword [ebp - 8]
jae 0x409adc
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x409bc7
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409bc7
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407f3c
push dword [ebp - 0x160]
push 0x409c00
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00407f3c
push dword [ebp - 0x164]
push 0x409c10
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407f3c
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00408174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409bec
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406ff8
ret
Function at 0x409d98
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409e9b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x77fb88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x77fba0]
jne 0x409de4
mov eax, esi
mov edx, 0x77fba2
mov ecx, 0x55
call fcn.00407f3c
push 0x77fb88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x409e85
push 0x77fb88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406f98
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409e53
cmp byte [0x77fb84], 0
je 0x409e18
mov edx, esi
mov eax, ebx
call fcn.00409c7c
jmp 0x409e53
mov edx, esi
mov eax, ebx
call fcn.00409a80
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x409e53
cmp dword [esi], 0
je 0x409e3c
mov eax, esi
mov edx, 0x409eb4
call fcn.00408094
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00409a80
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00408094
push 0x77fb88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x77fba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407e90
push eax
push 0x77fba2
call sub.kernel32.dll_lstrcpynW
push 0x77fb88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ea2
lea eax, [ebp - 4]
call fcn.00406f98
ret
Function at 0x40a0d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040707c
xor eax, eax
push ebp
push 0x40a2f5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40a110
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40a12a
push 0x105
mov eax, dword [ebp - 4]
call fcn.00407e90
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40a2df
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40a304
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a1f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40a304
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a1f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40a340
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a1f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40a340
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a1f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40a374
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40a1f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40a3a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40a2df
xor eax, eax
push ebp
push 0x40a2d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00409edc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40a268
mov eax, dword [ebp - 0x10]
call fcn.0040466c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407ee8
jmp 0x40a2b3
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40a3e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40a2b3
mov eax, dword [ebp - 0x10]
call fcn.0040466c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40a3e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a2df
cmp dword [ebp - 8], 0
je 0x40a2ce
mov eax, dword [ebp - 8]
call fcn.00404688
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a2fc
lea eax, [ebp - 4]
call fcn.00406f98
ret
Function at 0x40a5d8
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040707c
xor eax, eax
push ebp
push 0x40a698
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407f3c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004080ec
mov eax, dword [ebx]
call fcn.0040a4a0
test al, al
jne 0x40a675
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407f3c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004080ec
mov eax, dword [ebx]
call fcn.0040a4a0
test al, al
jne 0x40a675
mov eax, ebx
call fcn.00406f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a69f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ff8
lea eax, [ebp - 4]
call fcn.00406f98
ret

Function at 0x41f1e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41f23d
test eax, edx
je 0x41f240
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41f1fb
movzx eax, word [eax]
sub eax, ecx
jmp 0x41f222
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41f223
add ecx, 4
js 0x41f213
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41f220
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41f222
xor eax, eax
ret
test eax, eax
je 0x41f24c
test edx, edx
jne 0x41f1ec
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x41fb90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov byte [esp], 0
mov eax, ebp
test eax, eax
je 0x41fba8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x41fbb0
mov al, 1
jmp 0x41fbcd
movzx esi, word [ebp]
mov eax, esi
call fcn.004105f0
test al, al
jne 0x41fbc9
cmp si, 0x5f
je 0x41fbc9
xor eax, eax
jmp 0x41fbcb
mov al, 1
xor al, 1
test al, al
jne 0x41fc5d
test bl, bl
je 0x41fc1d
mov eax, ebp
test eax, eax
je 0x41fbe4
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x41fc59
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0041067c
test al, al
jne 0x41fc11
cmp di, 0x5f
je 0x41fc11
cmp di, 0x2e
je 0x41fc11
xor eax, eax
jmp 0x41fc13
mov al, 1
test al, al
je 0x41fc5d
inc esi
dec ebx
jne 0x41fbf1
jmp 0x41fc59
mov eax, ebp
test eax, eax
je 0x41fc28
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x41fc59
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.0041067c
test al, al
jne 0x41fc4f
cmp di, 0x5f
je 0x41fc4f
xor eax, eax
jmp 0x41fc51
mov al, 1
test al, al
je 0x41fc5d
inc esi
dec ebx
jne 0x41fc35
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x420808
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00407e90
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x420872
test ah, 4
je 0x42086b
test bl, bl
jne 0x420830
mov al, 1
jmp 0x420899
test al, 0x10
je 0x420838
xor eax, eax
jmp 0x420899
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x42085c
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x420899
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x420899
test al, 0x10
sete al
jmp 0x420899
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x420893
cmp ebx, 3
je 0x420893
cmp ebx, 0x7b
je 0x420893
mov eax, esi
call fcn.004207c8
test al, al
jne 0x420897
xor eax, eax
jmp 0x420899
mov al, 1
pop edi
pop esi
pop ebx
ret