joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e30
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
xor edx, edx
call fcn.00406b98
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00406c24
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x415e77
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00406cd4
jmp 0x415e90
mov edx, ebx
dec edx
mov eax, esi
call fcn.00406ef0
push ebx
mov eax, dword [esi]
call fcn.00406c24
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x439554
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4396cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406bec
mov eax, dword [ebp - 4]
call fcn.00438dec
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4395a6
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407384
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0043a200
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x439685
xor eax, eax
push ebp
push 0x43967e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00439154
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00439704
test al, al
je 0x43965c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406cd4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x43965c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00406c24
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004390b4
test al, al
je 0x439656
mov eax, dword [ebp - 8]
call fcn.00406c24
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00406d44
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00439554
dec ebx
cmp ebx, 0xffffffff
jne 0x439605
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439685
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00439154
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.00406c24
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00439140
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004390b4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4396d6
lea eax, [ebp - 0x3c]
call fcn.00406b88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b90
ret
Function at 0x43a0dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00438e60
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406c24
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004390b4
test al, al
jne 0x43a144
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x441144]
mov dl, 1
mov eax, dword [0x437c10]
call fcn.004136d0
call fcn.00405c54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43a150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00406c24
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004390b4
test al, al
jne 0x43a1b1
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x441290]
mov dl, 1
mov eax, dword [0x437c10]
call fcn.004136d0
call fcn.00405c54
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00438e90
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43a7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43a8d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00439154
xor eax, eax
push ebp
push 0x43a8b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00439704
test al, al
je 0x43a897
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0043a690
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406cd4
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x43a897
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c24
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004390b4
test al, al
je 0x43a893
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c24
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00406d44
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0043a690
pop ecx
inc edi
dec ebx
jne 0x43a83b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a8ba
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00439154
ret
Function at 0x43a8e8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43ab36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00439154
xor eax, eax
push ebp
push 0x43ab0c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00439704
test al, al
je 0x43aaf0
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406cd4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x43aaf0
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c24
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004390b4
test al, al
je 0x43aae4
mov eax, dword [ebp - 4]
call fcn.00406c24
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00406d44
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043a200
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43aae4
xor eax, eax
push ebp
push 0x43aadd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00439154
xor eax, eax
push ebp
push 0x43aabf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406c24
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00406d44
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00439158
mov eax, dword [ebp - 4]
call fcn.00406c24
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00406d44
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043a200
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x43aa9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043a7b0
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043a8e8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43aaa3
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x43a973
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ab13
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00439154
ret
Function at 0x43b18d
Capabilities:
Delete file

Disassembly:
push ebp
movzx ebp, cx
mov ebp, esp
mov ecx, 0x17
jmp loc.0044d83c

Function at 0x43b253
Capabilities:
Create process on windows
Delete file
Execute anti-debugging instructions
Set environment variable

Disassembly:
push ebp
mov ebp, esp
bswap ecx
mov cx, ax
mov ecx, 0x2a
jmp loc.0044d0bf

Function at 0x43b98e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
or bp, 0x4dc
mov ebp, esp
push ecx
test bp, bx
cmc
push ebx
xadd bh, bh
cmovno bx, di
or bx, si
push esi
shl esi, 0x6a
bts ebx, eax
add bl, 0xa
mov word [ebp - 2], cx
mov esi, edx
mov ecx, eax
mov ebx, dword [ebp + 8]
cmp esi, 8
jmp loc.0044db51

Function at 0x43bb6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, esp
cmp ebp, 0x414c2a3c
rcr ch, 0x4e
rcl cx, 0x25
add esp, 0xffffffc0
shld cx, dx, 0x2e
or cx, bp
push ebx
push esi
not bl
bts bx, bx
bsr cx, dx
xor edx, edx
mov dword [ebp - 0x40], edx
shr cx, 0x2a
mov dword [ebp - 0x28], edx
bt bx, ax
mov dword [ebp - 0x18], edx
btr ebx, esp
xchg ecx, ecx
mov dword [ebp - 0x24], edx
rcr ch, 0x91
btr bx, sp
test ebx, 0x4c0345d3
mov dword [ebp - 4], edx
ror ch, 0xcb
mov ebx, eax
ror dx, 0x17
shld cx, bp, 0xf4
rcr cx, 0x84
sub eax, eax
cmovns ecx, ebx
movsx edx, dx
xchg ecx, ecx
push ebp
cdq
push 0x44b3b7
mov cl, dh
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
cdq
mov byte [ebp - 0x20], 0xba
movsx eax, dx
mov byte [ebp - 0x1f], 0x39
setp ah
mov al, dh
mov byte [ebp - 0x1e], 0x5c
xchg ah, al
cmovnp eax, esi
setne dh
mov byte [ebp - 0x1d], 0x71
mov byte [ebp - 0x1c], 0x7f
rdtsc
mov byte [ebp - 0x1b], 0x6e
rdtsc
mov dl, 0xf1
cbw
lea eax, [ebp - 0x20]
cdq
mov edx, 5
jmp loc.0044b7a6
push ebp
jmp 0x43b8d0

Function at 0x43ca50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
bsf bp, bp
xchg ebp, ebp
mov ebp, esp
clc
lea esp, [esp - 0x14]
cmp bp, 0x524d
cmp di, si
push ebx
test si, 0x1684
stc
test cl, ah
push esi
test si, sp
cmc
push edi
test bp, 0x6eb8
cmc
mov dword [ebp - 8], ecx
jmp loc.0044b88c

Function at 0x44b3f7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
stc
test edi, 0x66583c9c
add esp, 0xfffffeb8
cmc
clc
push ebx
movsx ebx, sp
push esi
push edi
adc ebx, esi
xor bh, 0x32
mov dword [ebp - 8], ecx
movsx bx, bh
neg bh
shl bh, cl
mov esi, edx
mov ebx, eax
and ecx, 0x2a3f731b
rcr cx, cl
bts ecx, ebp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
test bp, 0xacb
stc
sub edx, edx
mov dword [eax], edx
bts ecx, ebp
rol ch, cl
sbb ecx, 0x78e373c8
sub eax, eax
xor cl, dh
stc
btr cx, bx
mov dword [ebp - 0xc], eax
cmp cl, 9
xor edx, edx
movzx ax, ch
lahf
push ebp
movzx ax, ch
push 0x43c240
cwde
push dword fs:[edx]
mov ax, sp
not ecx
mov dword fs:[edx], esp
lahf
movzx edx, dx
lea edx, [ebp - 0x50]
mov eax, esi
seta cl
bswap ecx
not cl
mov ecx, 0x40
jmp loc.0043c90b
Function at 0x44bdf6
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
neg ebp
shrd ebp, ebx, 0xd8
mov ebp, esp
btc ax, 0x23
mov eax, dword [ebp + 8]
clc
cmc
xor edx, edx
test eax, 0x4000000
jmp 0x44c00f
je 0x44c01b
or edx, 0x200
test eax, 0x20000000
jmp loc.004184c1

Function at 0x44d3f4
Capabilities:
Read .ini file

Disassembly:
call fcn.00406c24
push eax
movsx eax, si
mov ax, si
mov eax, edi
jmp loc.0043c061
push ebp
adc ebp, 0x2c687e32
clc
xor ebp, 0x4b7c3817
mov ebp, esp
test esp, 0x448f3b5b
add esp, 0xfffff004
push eax
push ebx
push esi
mov bx, dx
bswap bx
push edi
cmovs edi, edi
movsx edi, cx
mov edi, ecx
movzx esi, ax
not esi
mov esi, edx
movsx ebx, bx
mov ebx, eax
cmovg eax, eax
movsx eax, ax
movzx eax, di
mov eax, ebx
jmp 0x44e2c1
call fcn.00406c24
push eax
push 0x800
cwde
lea eax, [ebp - 0x1000]
jmp 0x44e502
push eax
not eax
mov eax, dword [ebp + 0xc]
jmp 0x44c779

Function at 0x44d6ac
Capabilities:
Get disk information

Disassembly:
push eax
lahf
lea eax, [esp + 0x10]
jmp 0x44d1a8
push eax
cmovnp eax, ecx
movsx eax, si
lea eax, [esp + 0x10]
jmp loc.0043c66f
lea esp, [esp - 0x41c]
cmc
xor eax, eax
mov dword [esp], eax
movzx eax, di
mov ax, sp
push 0x104
nop
lea eax, [esp + 0x218]
jmp 0x44c1a7

Function at 0x44e11f
Capabilities:
Get file size

Disassembly:
call sub.kernel32.dll_GetFileSize_1
sub edx, edx
jmp loc.0043c01d
call fcn.0040f4dc
mov ebx, eax
jmp 0x44dc7f
push 0
push ebx
jmp 0x44baca
push ebx
add esp, 0xfffffff8
mov edx, 0x20
jmp 0x44d8f8
Function at 0x4031e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403278
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403258
xor eax, eax
push ebp
push 0x403251
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403294
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403258
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x403b85
cmp word [0x40a218], 0xd7b2
jne 0x403b4d
cmp dword [0x40a220], 0
jbe 0x403b4d
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403bac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x403ba1
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4044dc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40470c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40455f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40470c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40455f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404728
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4045e8
xor eax, eax
push ebp
push 0x4045e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404324
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045c6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404748
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045c6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4045e8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404702
cmp byte [ebp - 0xd], 0
jne 0x40462f
cmp byte [ebp - 0x12], 0
je 0x404702
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404648
dec ebx
cmp byte [ebx], 0x2e
je 0x404657
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404647
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404702
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404694
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404702
cmp byte [ebp - 0xd], 0
je 0x404702
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404702
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4045e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40470c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40455f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40470c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40455f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404728
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4045e8
xor eax, eax
push ebp
push 0x4045e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404324
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045c6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404748
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045c6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4045e8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404702
cmp byte [ebp - 0xd], 0
jne 0x40462f
cmp byte [ebp - 0x12], 0
je 0x404702
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404648
dec ebx
cmp byte [ebx], 0x2e
je 0x404657
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404647
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404702
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404694
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404702
cmp byte [ebp - 0xd], 0
je 0x404702
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404702
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404898
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4048fe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403ee8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c08
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4048e8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404905
lea eax, [ebp - 0x10]
call fcn.00403ca0
ret

Function at 0x40669c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4066d5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d90
jmp 0x4066de
mov eax, ebx
mov edx, esi
call fcn.00403cf4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4066e8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406709
mov al, byte [esp]
jmp 0x40670b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406d90
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406c08
mov eax, dword [0x4093b0]
cmp byte [eax], 0
je 0x406e0c
mov eax, dword [0x409304]
call fcn.004029cc
call fcn.0040262c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405b90
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406e54
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x406e42
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4092e4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.004042e8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret